Windows 11 AVD Black Screen After Sign-In: FSLogix Workaround and KIR Fix

What Microsoft has confirmed​

Microsoft's Windows release-health dashboard lists the issue as "Devices might experience a black screen or desktop loading issues after sign-in." It affects three Windows 11 client releases, each tied to its August 27, 2026 non-security preview update:

Microsoft says the problem can appear after installing those preview updates and later updates, so skipping the optional preview doesn't necessarily keep you safe. BleepingComputer, which first reported the issue, says the affected updates include this month's Patch Tuesday updates (KB5124008 and KB5122880), along with the August previews.

Microsoft opened the entry on September 24, 2026, at 18:47 PT and marked it Mitigated at 19:41 PT that day. The dashboard lists no Windows Server platforms as affected. The reports involve Windows 11 client builds, including when they run as AVD session hosts.

Section summary: This is a confirmed, cross-version Windows 11 issue that has been mitigated but not fixed. It comes from the August 27 previews and carries into later cumulative updates.

Who is actually affected​

Microsoft says the issue has mostly been seen on AVD hosts using FSLogix, and that it shows up more often with some existing user profiles. That qualifier matters. It doesn't mean every AVD deployment is broken, every FSLogix profile is affected, or every home PC with the August preview will lose its desktop.

FSLogix is Microsoft's profile-container technology. BleepingComputer describes it as a software solution that speeds up user profile loading in virtual desktop environments. It's common in pooled and non-persistent virtual desktop farms, where a user's profile is stored separately and attached at sign-in. The detail about existing profiles is an important distinction for organisations operating pooled or non-persistent virtual desktop deployments where profiles are stored separately and reattached when users sign in, 1Arabia noted.

The problem may reach beyond Microsoft's own VDI stack. According to 1Arabia, Citrix has separately acknowledged black-screen failures on desktop operating-system Virtual Delivery Agents after installation of KB5124008 or KB5120998. Citrix shops using Citrix User Profile Management or FSLogix should therefore watch this closely even if they don't run AVD.

Most home users can simply keep an eye on this one. For an AVD administrator, a bug that hits at sign-in can mean dozens of identical helpdesk tickets before the first coffee.

The symptoms​

Microsoft lists three symptoms:

• A black screen appears after sign-in, and the desktop session doesn't load automatically.
• Users can't reach their desktop until someone starts the session manually.
• The Application event log may show Windows Explorer crashes.

That last one is the useful clue. Explorer.exe is the Windows shell: it draws the taskbar, the Start menu, the desktop icons and File Explorer. If it crashes or doesn't start at logon, the session can still be running while the screen shows nothing. The display works and the session exists; the shell just isn't there.

Microsoft hasn't published a technical root cause beyond linking the reports to the update and describing the Explorer crashes. Any theory about exactly how FSLogix, specific profiles and Explorer interact is guesswork for now.

Don't confuse it with the black-wallpaper bug​

Windows 11 had another black-screen-looking problem recently. On the 25H2 dashboard, Microsoft documents a separate, now-resolved issue in which KB5120998 caused some desktop settings to fail to load, so wallpapers showed as solid black. That bug was fixed by the September 8 security update, KB5124008. WindowsForum's earlier coverage made the same point: the black-wallpaper and mouse-cursor bugs from KB5120998 are separate issues that KB5124008 already fixed, so check which symptom you're seeing before choosing a fix.

A quick way to tell them apart:

• Black wallpaper, but the taskbar and Start menu work: probably the older, resolved settings bug. Install the latest cumulative update.
• No taskbar, no Start menu, nothing but black, and Explorer crashes in the event log: probably this issue.

Fix 1: Start Explorer manually (for users)​

Microsoft's immediate workaround doesn't need a reboot, an uninstall or any profile changes:

1. Press Ctrl+Shift+Esc to open Task Manager.
2. Select Run new task.
3. Type explorer.exe.
4. Select OK.

If it works, the taskbar, Start menu and desktop come back in that session. Microsoft calls this temporary. It fixes the symptom for the current session, and the problem may return at the next sign-in.

If Task Manager won't open, or Explorer crashes again right away, the user needs IT to apply the enterprise mitigation below.

Fix 2: Deploy the Known Issue Rollback (for IT admins)​

Microsoft has mitigated the issue with Known Issue Rollback (KIR). Microsoft's KIR documentation explains that it reverts only the specific non-security change behind a problem, while the rest of the cumulative update, including its security fixes, stays in place. You don't need to uninstall the whole update and leave machines unpatched.

On retail and consumer devices that get updates straight from Windows Update, Microsoft switches on KIRs through its cloud service with no action from the user. On enterprise-managed devices, where IT controls updates, administrators have to deploy a Group Policy themselves.

There are two packages, one for each release family:

• Windows 11, version 26H1: KB5124006 260924_20071 Known Issue Rollback
• Windows 11, versions 25H2 and 24H2: KB5124010 260924_20021 Known Issue Rollback

The daily.dev summary confirms the same mapping, describing KB5124006 for 26H1, KB5124010 for 24H2/25H2.

Deployment steps​

1. Inventory your hosts by release. Record which session hosts and images run 26H1, 25H2 or 24H2. Microsoft's KIR guidance says the policy settings often differ between Windows versions, so check the version in each template's file name.
2. Download and install the matching KIR policy package for each release.
3. Configure the policy. It appears under Computer Configuration > Administrative Templates, followed by the policy name listed in the package.
4. Refresh Group Policy. Wait for the normal background refresh, or run gpupdate /force on a single device.
5. Restart the affected devices. Microsoft says the setting doesn't apply until you restart.
6. Validate. Sign in with the profiles that were failing before and check that Explorer loads without crashing.

If the problem continues after deployment, Microsoft's KIR FAQ lists these checks: confirm the template matches the device's Windows version, open Group Policy Editor to make sure the setting is in the correct state, restart again if you changed anything, and escalate to Microsoft Support if it still doesn't work.

For AVD and other VDI teams, Cryptika's advice is sensible: identify hosts running the affected Windows 11 builds, correlate sign-in failures with Explorer crash events, test the correct KIR against representative FSLogix profiles, and monitor session recovery after reboot. Also update your golden images. If you only apply the policy to running hosts, freshly built ones can still pick up the problem.

Section summary: Users can start explorer.exe to get back into the current session. Admins should deploy the version-matched KIR, restart, and test with the profiles that failed.

What not to do​

• Don't jump straight to uninstalling the cumulative update. Newer updates such as KB5124008 carry security fixes. KIR exists so you don't have to choose between security and a working desktop.
• Don't delete or rebuild user profiles on reflex. The Panstag guide puts it this way: first establish whether the problem follows the user, the profile, the host or the Windows update.
• Don't treat "Mitigated" as "Resolved." The KIR only turns off the change that causes the problem. Microsoft says the permanent fix will come in a future Windows update and hasn't named a KB number or date.

Microsoft's KIR guidance also covers what happens later. Once the proper fix ships in a subsequent update, the old KIR policy stops doing anything and no longer matters. Keeping a record of which hosts got the policy will still make cleanup easier.

Why 26H1 is part of this​

Windows 11 version 26H1 is unusual. Microsoft describes it as a hardware-optimized release that comes preinstalled only on select new devices built on next-generation silicon. It isn't offered to existing PCs through Windows Update. Microsoft still recommends 25H2 and 24H2 for broad enterprise deployment. Organizations testing new hardware may adopt 26H1 on a selective basis.

26H1 appears here because it receives quality updates alongside the mainstream releases, and the same fault reached it. None of Microsoft's published material suggests 26H1 is affected more often than 25H2 or 24H2. Any organization piloting 26H1 hardware in a virtual desktop setup should include AVD and FSLogix profile testing in its validation before rolling out more widely.

The bigger picture​

This is a familiar kind of Windows problem: a non-security change in an optional preview hits an uncommon but important configuration, then carries into Patch Tuesday because cumulative updates bundle everything. KIR has limited the damage. Microsoft could turn off the offending change without asking anyone to give up their security patches, which is much better than the old choice between uninstalling or waiting.

The case also shows why VDI administrators need a ring for preview updates. Pooled desktops with profile containers stress sign-in, profile loading and the shell far more than a single laptop does. A bug that only affects some existing profiles can easily slip past a lab full of fresh test accounts.

Action checklist​

• Home users: You're most likely not affected. If you see a black screen after sign-in, try the Task Manager and explorer.exe workaround, and keep Windows up to date.
• AVD/FSLogix admins: Inventory your Windows 11 versions, deploy KB5124006 (26H1) or KB5124010 (25H2/24H2), restart, test with the profiles that were failing, and update your golden images.
• Citrix environments: Watch both Microsoft's and Citrix's guidance, since Citrix has reported similar symptoms on its desktop VDAs.
• Everyone: Check the release-health dashboard for the permanent fix, and remember that "Mitigated" is not the same as "Resolved."