Quick post for future reference and in case it helps other users.
Got to work this morning, and couldn’t login to my Windows 10 machine. Windows Updates had been installed overnight (oh dear).
The symptoms were slightly different to most of the other reports I’ve seen online (Google Windows 10 blank screen after login). I could login on one account all fine, but my primary account would just go to a black screen (with cursor). Waited quite some time (10 minutes or more) with no change. Rebooted. No change.
Pressing Ctrl+Alt+Del would bring up Windows Security, and from there I could switch user or go back to the lock screen, but attempting to log out would fail: the “wait for logout” spin appeared but never logged out. Other options from that screen had no effect.
I vaguely tried multi monitor options (Windows+P key combination), typing password into the blank screen, and other magic mummery without effect (and without expectation of success).
Eventually I logged in on the working account, turned off Windows firewall, enabled Remote Registry, and got to work with SysInternals tools. I logged back out of that account and used the command pslist \\machine -t from a working computer to see what processes were running.
pslist v1.3 - Sysinternals PsList
Copyright (C) 2000-2012 Mark Russinovich
Sysinternals - www.sysinternals.com
Process information for <machine>:
Name Pid Pri Thd Hnd VM WS Priv
Idle 0 0 4 0 64 4 0
System 4 8 141 1217 393012 271644 1560
smss 316 11 3 49 4864 592 376
csrss 428 13 11 415 163348 3240 1620
wininit 500 13 4 91 43984 2792 1232
services 572 9 9 294 35020 7900 4648
svchost 304 8 35 956 184400 23016 13240
svchost 356 8 17 321 82168 6432 3248
svchost 496 8 26 1043 204540 24268 20616
svchost 748 8 30 773 87432 16040 10172
ShellExperienceHost 7032 8 44 876 369236 35880 58392
WmiPrvSE 8876 8 6 144 33264 8172 1880
SearchUI 9820 8 27 900 362948 37788 48896
svchost 812 8 18 528 59364 11544 9764
svchost 936 8 52 1346 1417096 26592 22524
svchost 968 8 78 4722 1321944 71912 797808
taskhostw 3952 8 8 291 275572 10268 6492
svchost 1064 8 37 1130 719392 25880 12960
WUDFHost 1816 8 8 476 38964 3852 2212
dasHost 2084 8 13 302 37880 7968 3764
mvbtrcsvcx64 1108 8 3 107 58624 1608 1124
svchost 1344 8 14 527 217200 29352 56716
svchost 1348 8 29 605 167772 23016 18484
spoolsv 1792 8 24 576 91808 13972 11384
svchost 2156 8 48 485 1200004 19240 9308
MsMpEng 2268 8 45 1122 523848 127360 144964
svchost 2684 8 15 3980 303696 53068 95100
NisSrv 3084 8 10 287 71416 10276 23812
SearchIndexer 5800 8 50 1045 434516 77688 95752
SearchProtocolHost 9568 4 10 353 74552 12456 2240
SearchFilterHost 9856 4 4 114 35096 6560 1208
officeclicktorun 8500 8 18 3570 213028 27932 48116
svchost 11928 8 5 128 23372 6500 1276
lsass 580 9 14 1272 58540 17008 9876
csrss 3356 13 15 634 160220 16276 2520
winlogon 3396 13 6 229 65460 12380 2472
dwm 3520 13 12 332 282440 34416 62088
Nothing obviously wrong that I could see. I then ran pskill \\machine 3396 to kill winlogon, in the hope that at least that would cause the account to log out.
And of course it did.
The surprise was that after that I was able to login…
Unfortunately, I have not yet traced what caused the lock but at least this was an answer for me, which hopefully may help someone else one day.
Possibly related: I did find this in the Event Log:
Application pop-up: ShellExperienceHost.exe – Application Error : The instruction at 0x00007FFE569D50CB referenced memory at 0x0000000000000000. The memory could not be read.
And, an unhelpful error from win32k:
The description for Event ID 267 from source Win32k cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
The specified resource type cannot be found in the image file