Windows 11 Black Screen After the September Update – explorer.exe Fails to Start

After installing the September Windows updates, I came across an interesting issue in a Windows 11 VDI environment.

User authentication completed successfully. The Citrix session was established and the Windows logon process appeared to complete normally.

But instead of the desktop, the user was left with a persistent black screen.

At first glance, this looked like a typical Citrix, HDX, or user profile issue. However, troubleshooting eventually pointed in a very different direction:

Windows Shell, AppX, and XAML initialization.

And there was another interesting observation:

Removing the Windows update did not resolve the issue.

Re-registering several Windows Shell/AppX components did.

Windows 11 Black Screen After Logon – The Symptoms

The affected systems were Windows 11 VDI machines.

The actual user logon succeeded:

User Authentication

Citrix Session Established

Windows Logon

explorer.exe Does Not Start

BLACK SCREEN

The important part was that the session itself was not dead or disconnected.

From Task Manager, I could manually start: explorer.exe

Immediately afterwards, the desktop, taskbar, and Start menu appeared and the session could be used normally.

This is an important distinction when troubleshooting the issue.

If manually starting explorer.exe results in a fully functional desktop, there is little reason to immediately assume that ICA/HDX, VDA registration, or the basic Citrix session establishment is the actual problem.

The more interesting question becomes:

Why isn’t the Windows Shell starting correctly during the normal logon process?

Initially, Everything Points to Citrix or the User Profile

With a black screen on a Citrix VDA, there are several obvious suspects:

  • Citrix VDA
  • HDX
  • Citrix Profile Management
  • FSLogix
  • Group Policies
  • AppX packages
  • Start menu
  • explorer.exe
  • Shell extensions

User profile management becomes particularly suspicious if existing users are affected while users with newly created profiles can log on successfully.

However, a similar behavior can also occur outside Citrix environments.

That makes a purely Citrix-specific problem much less likely.

The common denominator appears to be closer to:

Windows 11 + VDI + persistent user state + Windows Shell.

Removing the Windows Update Did Not Fix the Problem

Considering the timing of the issue, one of the obvious troubleshooting steps was to test the system without the recently installed Windows update.

The expectation was simple:

Update Installed

Black Screen

Update Removed

Problem Resolved

That, however, is not what happened.

Even after uninstalling the update, the black screen remained.

This is an important observation.

Apparently, returning the Windows binaries to their previous state was not sufficient.

If an inconsistent state had already been created within the user profile or Windows Shell registration during or after the update, that state could potentially remain even after uninstalling the update.

That would also explain why simply rolling back the Windows update did not repair the affected users.

The Important Test: Start explorer.exe Manually

A very simple test helped narrow down the issue significantly.

While the user was stuck on the black screen:

Task Manager → Run new task → explorer.exe

If the taskbar, Start menu, and desktop immediately appear afterwards, we already know quite a lot:

  • The Citrix session is working.
  • The user has successfully logged on.
  • The user profile is fundamentally available.
  • Windows can display the desktop.
  • explorer.exe itself can run.

The problem therefore appears to be specifically related to the initial launch or initialization of the Windows Shell during the logon sequence.

That changes the direction of troubleshooting considerably.

The Trail Leads to Windows AppX and the Shell

The workaround that eventually made the difference was to re-register three Windows components in the user context:

These components are associated with modern Windows Shell functionality and the XAML infrastructure.

For testing, they can be re-registered using PowerShell:

And this is where things became interesting:

After re-registering the AppX/Shell packages, the normal logon started working again in my test environment.

explorer.exe launched automatically and the desktop appeared as expected.

Why This Is Technically Interesting

This paints a very different picture from a traditional Citrix black-screen issue.

A simplified version of the failing sequence could look something like this:

User Logon

User Profile Loaded

Windows Shell Packages

AppX / XAML / Shell State

Initialization Fails

explorer.exe Does Not Start Correctly

BLACK SCREEN

After re-registering the affected components:

User Logon

Shell Packages Registered

Client.CBS
UI.Xaml.CBS
Client.Core

Shell State Initialized

explorer.exe

DESKTOP

This does not prove the exact Microsoft-side root cause.

However, the behavior provides a strong indication that the issue is located somewhere around Windows Shell/AppX/XAML initialization, rather than being a traditional Citrix HDX problem.

Why Profile Management Is Still Relevant

I would not completely remove Citrix Profile Management or FSLogix from the investigation.

Not necessarily because either product caused the issue, but because profile management may be responsible for persisting the problematic state.

This is particularly interesting in non-persistent VDI environments.

The machine itself may be reset during reboot or recompose:

Golden Image

MCS / PVS Machine

Clean Machine State

But the user’s profile returns:

User Logon

Existing UPM / FSLogix Profile

Persistent User State

Windows Shell

If the problematic state exists within the user context, recomposing the machine may not help at all.

This could also explain why removing the Windows update did not resolve the issue in my test.

The problematic state was potentially already present.

Test an Existing Profile Against a New Profile

Another useful troubleshooting step is comparing an affected user with a completely new user profile.

For example:

User A
Existing Profile
→ Black Screen

User B
New Profile
→ Desktop Works

If you see this pattern, I would not immediately delete User A’s profile.

That affected profile is potentially extremely valuable for further root-cause analysis.

Instead, I would first create a backup of the affected UPM profile or FSLogix container and use it to reproduce and investigate the issue.

Resetting the profile may remove the symptom, but it may also destroy exactly the state required to determine what actually happened.

How I Would Troubleshoot This Today

If a customer reported black screens on Windows 11 VDAs following Windows patching, reinstalling the VDA would definitely not be my first step.

My troubleshooting flow would look roughly like this:

Windows 11 VDI

Black Screen After Logon

Open Task Manager

Start explorer.exe Manually

Does the Desktop Appear?

├── NO
│ ↓
│ Investigate Other Causes

└── YES

Investigate Windows Shell

Compare Existing vs. New Profile

Check AppX / Shell Registration

Re-register Shell Packages

Test Logon Again

If explorer.exe works when launched manually and the normal logon starts working again after re-registering the Shell packages, I would not immediately start tearing apart ICA, HDX, or the VDA installation.

The evidence points somewhere else.

The Working Workaround

In my test environment, the successful workaround was re-registering the three Windows Shell packages during user logon.

For example, this can be implemented using a synchronously executed GPO user logon script:

Timing matters here.

The goal is not to re-register these components at some arbitrary point after the desktop has already initialized.

The required components should be correctly registered during the logon sequence before the Windows Shell completes its initialization.

I would also strongly recommend testing this workaround with a small pilot group first rather than deploying it immediately to every user.

A working workaround is useful, but it is not the same thing as a confirmed permanent fix.

What I Would Not Do

I would not immediately:

Delete all affected user profiles.

I would also not automatically:

Declare FSLogix or Citrix Profile Management to be the root cause.

And based on my testing, I would definitely not assume:

Windows Update removed = problem solved.

That was simply not the case here.

Removing the update did not change the behavior.

Only after re-registering the Windows Shell components did the normal logon start working again.

What This Tells Us About VDI Troubleshooting

This case is a good reminder that a black screen in a Citrix environment is not automatically a Citrix problem.

Citrix sits on top of a fairly complex Windows stack:

Citrix HDX

Windows Session

User Profile

AppX / XAML

Windows Shell

Explorer

A failure somewhere in that chain can present exactly the same symptom to the end user:

A black screen.

So the important troubleshooting question isn’t necessarily:

Why is Citrix showing a black screen?

It is:

Which part of the Windows logon sequence actually failed?

In this case, explorer.exe provided the critical clue.

Conclusion

Finding in the Wild: Following the September Windows updates, users in Windows 11 VDI environments may successfully log on but remain stuck on a persistent black screen because explorer.exe does not start correctly during the logon process.

Based on my testing, three observations were particularly important:

Removing the Windows update did not resolve the issue.

Manually starting explorer.exe immediately restored a functional desktop.

Re-registering MicrosoftWindows.Client.CBS, Microsoft.UI.Xaml.CBS, and MicrosoftWindows.Client.Core restored the normal logon behavior.

This does not yet establish the definitive root cause, but it provides a strong indication that the problem is related to Windows Shell/AppX/XAML initialization rather than the Citrix session itself.

Until a definitive root cause and permanent fix are available, I would test the workaround carefully, preserve affected profiles for further analysis, and retest the behavior after subsequent Windows updates.

Finding in the Wild – exactly the kind of issue where the black screen is only the visible symptom, while the actual problem is hiding several layers deeper.

NetScaler CVE Checklist: Updates, Security Assessment and Incident Response

Critical vulnerabilities in NetScaler ADC and NetScaler Gateway require a structured approach: assess exposure, select a secure target version, update affected systems, and then determine whether there are any indications of compromise.

This checklist summarizes the key steps for dealing with new NetScaler CVEs. The current vendor security bulletin, supported firmware builds, and the specifics of your own environment should always be considered authoritative. Do not assess only the current patch status. CVE-specific prerequisites, the period during which the appliance was publicly exposed, and potential indicators of an earlier compromise must also be taken into account.

Important: The commands listed in this article are intended to identify investigation leads. A match is not automatically an Indicator of Compromise (IOC) and must always be evaluated in the context of the affected CVE, the installed build, and your individual NetScaler configuration.

Assess the CVE and Prepare the Update

When assessing a NetScaler appliance, do not look exclusively at the currently installed firmware version. You also need to determine whether the appliance was publicly accessible during a vulnerable period and whether the configuration prerequisites for the respective vulnerability were present.

CVE-2026-19490 currently requires particular attention. This critical authentication bypass vulnerability (CVSS 9.3) affects, depending on the installed build, NetScaler systems configured with Gateway or AAA virtual servers and, in some cases, additionally requires a configured SAML Action. Exploitation attempts in the wild have since been reported, and a public Proof of Concept is available.

Affected systems must be updated to at least 14.1-73.32, 13.1-63.21, 14.1-FIPS 73.32, or 13.1-FIPS/NDcPP 37.277, respectively. Citrix does not provide a workaround.

In addition to the firmware version, check the relevant prerequisites in ns.conf:

Continue reading “NetScaler CVE Checklist: Updates, Security Assessment and Incident Response”

NetScaler ADC Firmware Upgrade

Regular firmware updates are one of the most important maintenance tasks in a NetScaler ADC infrastructure. In addition to new features, current firmware releases include important bug fixes and security-related patches. Especially in the case of security advisories or actively exploited vulnerabilities, firmware updates should be scheduled promptly.

Because a firmware upgrade can affect production services such as NetScaler Gateway, Load Balancing, Content Switching, AAA, GSLB, or SSL Offloading, it should never be performed without proper preparation. A structured approach reduces downtime and minimizes the risk of unexpected issues.

This article describes the recommended upgrade process for production NetScaler ADC environments.

Continue reading “NetScaler ADC Firmware Upgrade”

Install new Microsoft Teams (version 2) in Citrix

The new version of Microsoft Teams (often referred to as “Teams 2.0”) has been the new standard since July 1, 2024.

For VDI environments, this means:

  • October 1, 2024 → End of Support (Classic Teams in VDI)
  • July 1, 2025 → End of Availability

In short:
There is no way back.

Timeline VDI Clients
Continue reading “Install new Microsoft Teams (version 2) in Citrix”

Citrix License Activation Service (LAS): Goodbye License Files

If you’re a Citrix customer and thinking “next week…” right now — understandable. But starting April 15, 2026, file-based Citrix license files will no longer work. This is not a warning; it’s a hard shutdown date.

That means: if you haven’t migrated to LAS by then, you risk real outages (apps, desktops, or features depending on the component and version).

LAS is not a migration of your workloads to the cloud. Your site continues to run on-premises (DDCs, StoreFront, VDAs, etc.).
The only thing that changes is the activation and licensing mechanism.

Continue reading “Citrix License Activation Service (LAS): Goodbye License Files”