Just a heads up to folks. Noticing some issues with blank screen, or "The system detected an overrun of stack-based buffer" when logging on to non-persistent VMs after the latest September 2026 Windows Updates. Manually starting explorer.exe allows desktop to proceed. Subsequent logins work fine after doing that (in my lab). In my lab it's only occuring on FSLogix based non-persistent VDI, and not when using DEM.

Thanks for posting this! This is a good sanity check for me because I started running into this yesterday. Same situation: September MS updates, non-persistent VMs, and FSLogix.

there was another thread about this somewhere

I saw a post about this on 24H2, but it's happening to my 25H2 instance as well. Latest FSLogix

UPM containers not just FSLogix according to the other thread. I deleted my reply so have lost where it was

We're using FSLogix 25.04 (we're getting ready to test the latest) and we use Windows 2024 LTSC (so it's 24H2 based).

25H2 with latest FSLogix on my side, and experienced the issue.

I have not been able to get it to crash with upm containers, but lots of people reporting fslogix. But it seems only if they have an existing profile. Sounds like if you get a new profile it doesn't happen.

When I forced myself into a new profile the issue did seem to go away for me, but I need to test more. That said, that wouldn't be a workable solution for my user base. I'm hoping for a new Microsoft patch that fixes things.

As per the earlier thread, a logon script to launch explorer would give you a workaround for now

Is that a one time requirement? Or does the explorer launch have to be one on each login?

I'd assume it might be on each login, but I don't know, haven't tried

Based on Stephen's original message, it might just need to be run once and subsequent logins would be fine. Also need to test more though.

Not sure if you're being sarcastic or not. No software vendor does anything quickly enough to avoid workarounds, IME

haha. Not sarcastic, just putting hope out into the world. We'll see if I'm rewarded.

After manually launching explorer.exe on the first failed login. I've re-logged in like 8+ times and all is working.

Isn't there a "shell" entry in the Registry or something that tells it what to run when a user logs in? Is it getting corrupted or something?

I bet it has to do with this - Microsoft says KB5120998 Windows update resets desktop settings "Following installation of Windows updates released August 27 2026 (KB5120998) and later, some Windows Desktop settings fail to load, resulting in desktop backgrounds displaying as a solid black color," Microsoft said in a Windows release health update on Wednesday. "It is possible other desktop settings may be affected, such as slideshow settings or contrast themes." According to Microsoft, because of this bug, users will also be unable to restore their custom settings on affected devices. "On affected devices, attempting to manually restore customized settings does not work. This is because the issue prevents the correct loading of settings, regardless of their value. In this case, a default black background is used instead," the company added. KB5120998 was released on August 27 with Start menu, taskbar, and Windows search improvements for Windows 11 versions 25H2 and 24H2. As Microsoft acknowledged one day later, this preview update also changes or resets mouse settings and makes it impossible for affected users to restore the previous settings after they are reverted. Since KB5120998 is an optional, non-security update, users must click the "Download and install" link. However, if they already have the "Get the latest updates as soon as they're available" option enabled, the update will install automatically. Microsoft addressed a similar bug six years ago, in February 2020, after the KB4539602 update broke desktop wallpaper functionality and caused Windows 7 wallpapers in 'Stretch' mode to display a blank black screen.

so even though that one was optional, it seems like they included the "fix" in this month's cumulative package though according to those release notes

Looks like deleting UserClass.dat from C:\Users\$username$\AppData\Local\Microsoft\Windows\UsrClass.dat works as a workaround. (offline removal from fslogix vhdx). Can anyone confirm?

so you guys didn't test the updates in a TAP process??? (ducks behind a wall 😉 )

This is test 😛

Ah, you have a Test In Production environment... fastest way to know if something breaks..

No 😅 I have my test in production on a pre-production vdi

@Rob Beekmans, we have customers that deploy updates fairly frequently, so in our lab we try to keep everything bleeding edge to find stuff like this, and determine fix before customers call to report they are experiencing it 🙂

that is a good approach... I was just messing with you 😉 only risk I see is that customers won't be running your exact lab environment, and you don't have a lab that matches every customer you have.. it is like Russian roulette, most attempts you walk away..

Historically, we catch ~90% of the stuff that comes up, so when we get the phone call we have a course of action and recommendations, which won't tie up hours with an emergency response. This frees up a bunch of times for the remaining 10% of the time where we get a phone call with an emergency and have to respond 🙂 It works out fairly well, then with those emergencies we figure out what's required when we get future calls.

Someone posted via reddit that this script is a good workaround - support.microsoft.com/en-us/…/kb5072911-explorer-the-start-menu-and-other-xaml-dependent-apps-might-not-start-or-close-unexpectedl i have a case opened with msft and they have a full memory dump to analyze

@Matt Nation currently re-register this on my test image.

nope!

Microsoft has released emergency out-of-band Windows updates to fix Remote Desktop Services failures caused by this month's security updates, along with Hyper-V and USB audio problems on some Windows versions. Affected systems could also experience problems with related components and tools, including Microsoft Management Console (MMC), RDS Licensing Diagnoser, File Explorer, and the Windows Update page, which could stop responding. Microsoft has now released multiple out-of-band updates on September 14 to fix the bug, including: Windows 10 21H2 and 22H2: KB5129236 Windows 11 24H2 and 25H2: KB5129195 Windows 11 26H1: KB5129194 Windows Server 2019: KB5129238 Windows Server 2022: KB5129237 Windows Server 2025: KB5129235 I am currently testing if the issue is gone with File Explorer

support.microsoft.com/en-us/…/kb5129195-windows-11-24h2-25h2-security-update Did anyone test this OOB?

Yes, not working 😣

support.microsoft.com/…/kb5072911-explorer-the-start-menu-and-other-xaml-dependent-apps-might-not-start-or-close-unexpectedl?App=CaseBuddy&Search=explorer%20crash%20x… MSFT recommended adding the referenced script to our login script and i've tested with 10 fully patched Win11 VDAs and it seems to do the trick. Also had to set login script to run synchronously which did add a couple of seconds to the login

JFC we have to use synchronous logon scripts to solve issues? Not a good solution

it hasn't caused us an issue yet. msft said to do it to make sure the script ran before explorer started

It's just clunky, shit and old

Is this the prevailing answer to the black screen problem on Win11 24H2 machines? https://worldofeuc.slack.com/archives/CK6RVLZ8S/p1789489855472969?thread_ts=1789046900.309649&cid=CK6RVLZ8S

For now, yes

And then? Run it as logon script?

i'm probably really dating myself here, but does anybody else remember when microsoft actually had an internal Test division and ran it through them before release?

Yes as a login script. You have to set the policy to process login scripts synchronously too

Oke thanks. Batch or powershell? Because I tried powershell this afternoon but it didn't work for us.

Bat

And user or computer policy?

Computer for the synchronously setting. User for the bat

👍👍 then it was just the powershell that doesn't do the trick

I was using Powershell with some success. I had it configured in GPO. Things looked promising but I think I ran into a bit of a race condition with a login or two and got the explorer.exe buffer overrun error. Now I'm trying to set it on the local policy in the parent image so the script is ready and waiting as soon as the VM is created. Also, note that the method that re-registers those 3 AppX packages will result in approx. 15 seconds (in our environment) of extra login/black screen time.

The article tells you exactly how to run it