Windows 10: Check Userinit setting in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon if...

I had removed the Win/7 Pro SP1 x86 PC from the Domain and uninstalled some applications such as Liquidware Labs Profile Unity, as they no longer applied to the PC's future use. After Media Creation Tool successfully generated a 32-bit Upgrade to Windows 10 Pro x86 Feature 1903 USB Memory Stick, I was able to perform a successful upgrade using that USB tool. Unfortunately, when I tried to login to the admin ID, only a black screen was presented and a mouse pointer appeared after some mouse movement. I decided to perform a Ctrl-Alt-Del and use Task Manager to start C:\Windows\explorer.exe and UP came the expected Desktop! I was able to apply some of my own user customization and then a system restart. I was disappointed when I had to use Task Manager to manually start the explorer.exe program again. After some investigation and Forum checking, I remembered that the userinit.exe program Registry Entry in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit value is modified by Profile Unity's installation. I then checked that value and found that it STILL had the reference to the uninstalled Profile Unity userinit,exe program. I modified the Userinit registry entry to be C:\Windows\system32\userinit.exe and restarted Windows 10 and VOILA! the Windows 10 desktop appeared as desired when I logged in to the admin ID. Windows 10 Pro x86 Feature 1903 appears to be working OK now. I hope this post saves someone some time and frustration.


ChevITGuy

:)

 

Cwindows\run.vbs is missing

Hey, I just fixed it.

All you have to do is run cmd as administrator and paste this :

reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f

reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /t REG_SZ /d "C:\Windows\System32\userinit.exe," /f

reg add "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f

This should fix the problem of both the black screen and the run.vbs

Hope I helped,

Sid

 

Boot problems: Black screen + CMD no explorer.exe


Check out possible explorer's hooks, like via Autoruns.

I would suggest to remove everything, but that will really remove everything.

Code:

Code:

takeown /f "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup" /a /r /d y icacls "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup" /inheritance:r /grant:r Administrators:(OI)(CI)F /t /l /q /c del "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup\*" /s /f /q del "%AppData%\Microsoft\Windows\Start Menu\Programs\Startup\*" /s /f /q reg delete "HKCU\Software\Microsoft\Command Processor" /v "AutoRun" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /f reg delete "HKCU\Software\Policies" /f reg delete "HKLM\Software\Microsoft\Command Processor" /v "AutoRun" /f reg delete "HKLM\Software\Microsoft\Policies" /f reg delete "HKLM\Software\Microsoft\Tracing" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\AppModelUnlock" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "VMApplet" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" /f reg delete "HKLM\Software\Policies" /f reg delete "HKLM\Software\WOW6432Node\Microsoft\Policies" /f reg delete "HKLM\Software\WOW6432Node\Microsoft\Tracing" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx" /f reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies" /f reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "VMApplet" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" /f reg delete "HKLM\Software\WOW6432Node\Policies" /f reg delete "HKLM\System\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /f reg delete "HKLM\System\CurrentControlSet\Control\SafeBoot" /v "AlternateShell" /f reg delete "HKLM\System\CurrentControlSet\Control\Session Manager" /v "BootExecute" /f reg delete "HKLM\System\CurrentControlSet\Control\Session Manager" /v "Execute" /f reg delete "HKLM\System\CurrentControlSet\Control\Session Manager" /v "SETUPEXECUTE" /f reg delete "HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /v "StartupPrograms" /f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /t REG_SZ /d "C:\Windows\System32\userinit.exe," /f reg add "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f reg add "HKLM\System\CurrentControlSet\Control\Session Manager" /v "BootExecute" /t REG_MULTI_SZ /d "autocheck autochk *" /f reg add "HKLM\System\CurrentControlSet\Control\Session Manager" /v "SETUPEXECUTE" /t REG_MULTI_SZ /d "" /f bcdedit /deletevalue {current} safeboot bcdedit /deletevalue {current} safebootalternateshell bcdedit /deletevalue {default} safeboot bcdedit /deletevalue {default} safebootalternateshell bcdedit /set {default} advancedoptions false bcdedit /set {default} bootems no bcdedit /set {default} bootstatuspolicy DisplayAllFailures bcdedit /set {bootmgr} displaybootmenu no bcdedit /set {current} advancedoptions false bcdedit /set {current} bootems no bcdedit /set {current} bootstatuspolicy DisplayAllFailures

 

User accounts log off immediately

Hi Sam,

I found this solution that you may want to try. It's a registry edit so make sure you back up your registry files before preforming

I found the solution
here

You may not be able to log on to system using either Normal Mode or Safe Mode. This occur only when Winlogon service tries to load the Windows default shell (explorer.exe) and user shell (userinit.exe) from registry. This service searches for Explorer.exe and
Userinit.exe in the following path of registry:



HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Edit these values and type the correct path of shell :



Shell = explorer.exe

Userinit=X:\windows\system32\userinit.exe



NOTE: These files may also be deleted by spywares. You may need to extract them using Windows CD.



Steps for rectifying this problem:

• Log on to a networked computer.
• Run Regedit.exe
• Point your cursor to HKEY_LOCAL_MACHINE
• Select File > Connect Remote Registry
• Type computer name (infected computer)
• Navigate to the following location in registry of destination or infected computer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

• Edit these two values in right pane:

Shell

Userinit

• Change these two values to

Shell=explorer.exe

Userinit = x:\windows\system32\userinit.exe

• Exit from Registry
• Restart Infected computer.
• You should be able to log on to computer.