Windows 10: Constant Screen Flicker Related to DWM

Can anyone shed some light onto the event viewer entries and behavior?

Thousands of entries over hours each can be tied to the black screen flicker lasting 5-15 seconds. Research shows it may be a display driver vulnerability introduced with the latest WIN version, made apparent by a WIN 'feature' that flickers the screen on user logon.

Fresh build with multiple fresh WIN10 reinstalls, all build hardware components test healthy in bios/memtest86. WIN 10 2004 19041.150 downloaded from Microsoft directly, hash checked, valid license key. Display drivers DDU'd and installed without bloatware. Malwarebytes and Windows Defender running with no alerts, no other tools/applications installed beside display drivers.

Reference: http://www.shdon.com/blog/2020/06/02/windows-10-screen-flicker-hackers , https://www.tenforums.com/general-s...7-seconds-desktop-window-manager-dwm-exe.html



Resolution attempts:

-Blocking 3389 from the Windows Firewall

-Registry edit for WDDM versus XPDM

-Disabling remote access



Windows events that correlate with black screen flashes:

-The Desktop Window Manager has registered the session port. 9027

-Successful auto update of third-party root certificate:: 4097

-Fault bucket , type 0 Event Name: LiveKernelEvent Response: Not available Cab Id: 0 1001

-Successfully scheduled Software Protection service for re-start at 16384

-Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON. 15

-The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event. 6003

-The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. 6000

-Offline downlevel migration succeeded. 163894

-The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds. 4625

-The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 10016

-6105 - deauth after EAPOL key exchange sequence 6105

-6062 - Lso was triggered 6062

-User Logon Notification for Customer Experience Improvement Program 7001



Security events tied to the DWM timestamps:

-An account was logged off. Subject: Security ID: Window Manager\DWM-1 Account NameWM-1 Account Domain: Window Manager Logon ID: 0x369993 Logon Type: 2 This event is generated when a logon session is destroyed. 4634

-Special privileges assigned to new logon. Subject: Security ID: SYSTEM Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege 4672

-An account was successfully logged on. Subject: Security ID: SYSTEM Account Name: DESKTOP-$ Account Domain: WORKGROUP Logon ID: 0x3E7 4624

-A logon was attempted using explicit credentials. Subject: Security ID: SYSTEM Account Name: DESKTOP-$ Account Domain: WORKGROUP Logon ID: 0x3E7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} 4648

-Credential Manager credentials were read. Subject: Security ID: DESKTOP-\ Account Name: Account Domain: DESKTOP-$ Logon ID: 0x87CB8 Read Operation: Enumerate Credentials This event occurs when a user performs a read operation on stored credentials in Credential Manager. 5379

submitted by /u/constantfrustration
[link] [comments]

:)

 

Screen flickering in Windows 10 safe mode

I haven't made any changes on my device. This screen flickering is only happening in Safe Mode.

 

Screen flickering in Windows 10 safe mode

Hi Adhio,

Screen flickering can be caused by hardware or application issue.

To better assist you, please answer the following questions:

• Is the issue only happening in Safe Mode?
• Have you made any changes on your device prior to the issue?

In the meantime, we suggest following the troubleshooting steps on this article:

Troubleshoot screen flickering in Windows 10 to resolve screen flickering issues on Windows 10.

We're looking forward to your reply.

 

Screen flickering in safe mode help!

Hi Yasmeentq,

Thank you for posting your query in Microsoft Community.

I understand your query. I suggest you to follow the steps to get out of safe mode.

• 
  Press Windows key + R
  
• 
  Type msconfig
  
• 
  In msconfig > Boot tab >
  Boot Options > uncheck Safe Boot > APPLY / OK.
  

Screen flickering in Windows 10 is usually caused by incompatible apps or display drivers. I suggest you to refer to the article below and check if it helps.

Troubleshoot screen flickering in Windows 10

http://windows.microsoft.com/en-in/windows-10/troubleshoot-screen-flickering

Regards.