Microsoft ties the Windows 11 black-screen bug to KB5120998 and KB5120996
BleepingComputer first reported the issue, and Microsoft's own Windows release health page for Windows 11 24H2 now documents it. The originating updates are the August 2026 optional previews: KB5120996 (Windows 11 26H1), KB5120998 (Windows 11 24H2/25H2), and this month's Patch Tuesday updates (KB5124008 and KB5122880). Microsoft's support page confirms that KB5120998 shipped on August 27, 2026 as a preview producing OS builds 26200.9278 (25H2) and 26100.9278 (24H2). Microsoft Update Catalog listings identify KB5120996 as Windows 11 26H1 build 28000.2804.
The trigger was a preview update, but staying on the regular Patch Tuesday schedule didn't protect anyone. Monthly previews carry non-security changes that are then folded into the next month's security release. As a result, September's KB5124008 inherited the problem. Microsoft's release health records list KB5124008 as OS Build 26100.9445, released September 8. BleepingComputer names KB5122880 as the other September Patch Tuesday update involved, but the Microsoft pages reviewed for this story don't say which Windows version it covers.
Japanese outlet Mado no Mori (Forest Watch) reports that Microsoft disclosed the issue on September 24 US time and has marked its status as "Mitigated." That label means a workaround exists. It does not mean a fix has shipped. Microsoft's release health entry says it is working on a resolution for this issue, and it will be released in a future Windows update.
The symptoms point at Explorer crashing during AVD and FSLogix sign-ins
Microsoft describes three symptoms, and they all point to the same part of Windows. The most common symptoms include a black screen after sign-in, so users can't access their desktop until they start the desktop session manually, and application event logs showing Windows Explorer crashes. Explorer (explorer.exe) is the process that draws the desktop, taskbar and Start menu. If it crashes while a session is starting, the user gets a working session with nothing on screen.
Microsoft is specific about where the bug appears. This issue has been primarily observed on Azure Virtual Desktop (AVD) hosts, using FSLogix. This issue appears to occur more frequently with some existing user profiles. FSLogix is Microsoft's profile-container technology for virtual desktops. It keeps each user's profile in a container file that attaches at sign-in, so the user gets a persistent profile on any host in a pool. The note about "existing user profiles" suggests that profiles which already contain settings are more likely to trigger the crash than new ones. Microsoft hasn't explained why.
"Primarily" is doing real work in that sentence. Microsoft doesn't say the bug is limited to AVD, and it doesn't say every AVD/FSLogix host that installed these updates will hit it. It also hasn't said what the offending change actually does. If a physical Windows 11 PC shows the same symptoms, it may be the same bug, but Microsoft's description is built around virtual desktop hosts.
This is a separate bug from the black wallpaper KB5124008 already fixed
KB5120998 has had a rough month. Microsoft's release health page shows that the same August preview caused a different problem that also involves black screens. On affected systems, Microsoft also resolved known issues that wiped mouse and desktop settings on some Windows 11 systems that were also triggered after installing the KB5120998 August 2026 optional update. In that bug, desktop personalization settings failed to load and backgrounds showed as solid black. Slideshow and contrast-theme settings could be affected too. Microsoft marked that issue, and the related mouse-cursor reset on non-English installations, as resolved by KB5124008 on September 8.
The two are easy to mix up, and doing so leads to the wrong fix. With the wallpaper bug, the desktop loads normally and only the background is black. Installing KB5124008 or later fixes it. With the Explorer bug, there's no desktop to speak of until someone starts Explorer, and KB5124008 is one of the updates that carries the problem. Telling an AVD user with a black screen to "install the latest update" won't help here.
AVD administrators have also dealt with black-screen sign-ins before, and not every one comes from this update. Past episodes had different causes. In 2024, The Register reported that a Windows 10 preview update left AVD users on black screens for 10 to 30 minutes because of a deadlock between the Azure AD broker and the AppX deployment service. Other cases have been traced to the AppReadiness service or to FSLogix's own profile handling. Microsoft's current symptom list is the best way to tell this bug apart: the problem started after the August 27 or later updates, Explorer crash events appear in the Application log, and launching explorer.exe by hand restores the desktop.
Two ways to get users back: manual explorer.exe and the KIR Group Policy
Microsoft offers two mitigations. One works for a single session and the other covers a whole fleet. Neither is a permanent repair.
The per-session workaround for users
Any user who hits the black screen can start the shell themselves. Microsoft's instructions:
- Press Ctrl+Shift+Esc to open Task Manager.
- Select Run new task.
- Type
explorer.exe. - Select OK.
Users can temporarily mitigate this issue by opening Task Manager (Ctrl+Shift+Esc), selecting Run new task, entering explorer.exe, and selecting OK. If it works, the desktop, taskbar and Start menu appear and the session carries on normally. The fix applies only to that sign-in, so users should expect to repeat it next time. On AVD, the key combination has to reach the remote session rather than the local machine, which depends on how the client handles keyboard shortcuts. Helpdesk staff should check how their users connect before sending these steps out.
The Known Issue Rollback for managed fleets
KIR is Windows' way of switching off one specific non-security change that arrived in a cumulative update. The rest of the update stays installed, including its security fixes. Microsoft has published a separate KIR policy for each affected version:
| Windows version | KIR Group Policy |
|---|---|
| Windows 11, version 26H1 | KB5124006 260924_20071 Known Issue Rollback |
| Windows 11, versions 25H2 and 24H2 | KB5124010 260924_20021 Known Issue Rollback |
The full policy names with the numeric suffixes come from Mado no Mori's reporting and Microsoft's release health entry. The KIR is for managed devices only. For enterprise-managed devices where Windows updates are managed by IT departments, IT administrators can apply the KIR by installing and configuring the Group policy listed below. Once the policy definitions are installed, the setting shows up under Computer Configuration > Administrative Templates > <Group Policy name listed below>.
The rollout involves three steps, and skipping any one of them leaves hosts unprotected. "You will need to install and configure the Group Policy for your version of Windows to resolve this issue. You will also need to restart your device(s) to apply the group policy setting," Microsoft said. Installing the policy package only adds the definition to your Group Policy tooling. You still have to configure the setting and target it at the affected hosts, and the hosts must restart before the rollback takes effect. KIR policies don't behave the way most admins expect. In a Microsoft Tech Community thread about an earlier AVD black-screen rollback, one administrator warned that the policy just names the change to be disabled, and that setting it to enabled does nothing. The rollback happens when the policy is set to Disabled. Check the setting's state before assuming the rollback has deployed.
Watch the similar-looking KB numbers. Microsoft Learn lists KB5124010 as a September 10, 2026 Release Preview build (26100.9539/26200.9539/26300.9539) for Windows 11 24H2, 25H2 and 26H2. The policy that fixes this bug is the KB5124010 Known Issue Rollback package, not that cumulative update. Installing the Release Preview update is not the mitigation.
The KIR is meant to be temporary. "Note that this Group Policy will disable the change causing this issue until a resolution is released in a future Windows update." Once the permanent fix ships, the rollback is no longer needed. Admins should keep a record of where they deployed it so they can remove it cleanly later.
Where the Explorer rollback leaves Windows 11 unmanaged PCs and security patching
Microsoft's workaround guidance reaches different users in different ways. Unmanaged Windows 11 machines can use the manual Explorer step. The Group Policy KIR is documented for devices whose updates IT manages. Microsoft's current guidance doesn't say whether it will send the rollback automatically to consumer and unmanaged business PCs, as it has done for some earlier issues. Given that the bug appears mainly on AVD, most unmanaged PCs are unlikely to hit it anyway.
The most important thing Microsoft does not recommend is uninstalling updates. The August preview, the September security release and the rest of the chain aren't being withdrawn. The KIR exists so that organizations can keep September's security fixes and disable only the faulty change. A team that removes KB5124008 to get rid of the black screen gives up that month's security patches and gains nothing the KIR doesn't already provide.
Some inference from the servicing model is also useful. Microsoft says the issue follows the August 27 updates "and later." Windows cumulative updates include everything released before them. So the September 14 out-of-band update KB5129195, which fixed separate Remote Desktop Services and Hyper-V Plan9 regressions caused by KB5124008, probably carries the same change. Microsoft hasn't said this directly, but no update released so far has been named as the fix. Install the out-of-band update for the problems it does fix, and keep relying on the KIR for this one.
What AVD administrators should do about the KB5124008 Explorer crash
If you run Windows 11 24H2, 25H2 or 26H1 session hosts with FSLogix and see Explorer crashes at sign-in, deploy the matching KIR now. Everyone else can confirm they're not affected and wait for the permanent fix. First check the Application event log for Explorer crashes that line up with sign-ins. That separates this bug from AppReadiness delays and the other known causes of AVD black screens.
- Hosts on Windows 11 24H2 or 25H2 need the KB5124010 260924_20021 Known Issue Rollback policy, and 26H1 hosts need KB5124006 260924_20071. Each policy works only on its own version.
- A KIR deployment isn't finished until the policy is installed, configured in the correct state under Computer Configuration > Administrative Templates, and every targeted host has restarted.
- Give users and helpdesk staff the Task Manager steps (Ctrl+Shift+Esc, Run new task,
explorer.exe, OK) so they can recover a session while the policy rolls out. - Don't uninstall KB5124008 or later security updates for this bug, because the KIR disables only the faulty change and leaves the security fixes in place.
- The black-wallpaper and mouse-cursor bugs from KB5120998 are separate issues that KB5124008 already fixed, so check which symptom you're seeing before choosing a fix.
- Keep track of which hosts have the KIR so you can remove it after Microsoft releases the permanent fix in a future Windows update.
For most people this bug won't matter, but it's a real problem for anyone running pooled virtual desktops. Microsoft has found the change responsible, published rollback policies for every affected Windows 11 version, and promised a fix in a future update. The next monthly release is where admins should look for it. Until Microsoft says the issue is resolved, AVD hosts running the August preview or any later update need the KIR deployed and checked.