Microsoft has confirmed a Windows 11 issue that can leave users staring at a black screen after sign-in or prevent the desktop from loading automatically.
The problem is linked to the August 2026 non-security preview update for Windows 11 version 26H1, KB5120996, and may also affect devices that installed later cumulative updates.
Microsoft said the fault has been seen primarily in virtual desktop environments, particularly Azure Virtual Desktop (AVD) session hosts using FSLogix profile-management technology.
Microsoft Warns Windows 11 Update Causes Black Screen
Microsoft lists the issue as mitigated, but a permanent code fix is still expected in a future Windows update. Affected users may sign in successfully but encounter a blank black screen instead of a usable Windows desktop.
In other cases, the desktop session fails to start automatically, blocking access to the taskbar, Start menu, desktop icons, and normal shell functions.
Microsoft said Windows Explorer crashes can appear in the Application event logs on affected devices. Explorer is the Windows shell process responsible for rendering much of the interactive desktop experience, including the taskbar and File Explorer.
When it does not start correctly after logon, users can be left with an apparently unresponsive black display even though their session is running. The issue has been observed more frequently with certain existing user profiles in AVD deployments using FSLogix.
FSLogix is commonly used in enterprise virtual desktop environments to manage roaming user-profile containers, making the problem especially relevant for organizations that operate shared, persistent, or non-persistent Windows virtual desktops.
Microsoft traced the Windows 11 version 26H1 issue to OS Build 28000.2804, delivered through the August 27, 2026 preview update, KB5120996.
The company formally added the issue to its Windows release-health dashboard on September 24 and classified it as mitigated the same day.
The problem is not limited to Windows 11 26H1. Microsoft has published equivalent notifications for Windows 11 versions 25H2 and 24H2, where the relevant originating update is KB5120998.
This means administrators should assess their entire Windows virtual desktop estate rather than treating the problem solely as a 26H1-specific incident.
For affected users, Microsoft’s immediate workaround is to manually start the Windows shell. Users can press Ctrl+Shift+Esc to open Task Manager, choose “Run new task,” enter explorer.exe, and select OK. This can restore the desktop session without requiring a full restart.
Microsoft has also deployed a Known Issue Rollback (KIR) mitigation. KIR allows Microsoft to reverse a problematic non-security code change through Windows Update without requiring administrators to uninstall an entire cumulative update.
Enterprise administrators must download, install, and configure the applicable Group Policy for their Windows release, then restart affected devices. The policy disables the change responsible for the desktop-loading issue until Microsoft ships a permanent update.
Windows 11 version 26H1 is a hardware-optimized release intended for select new devices built around next-generation silicon. Microsoft does not plan to offer it as a conventional feature update through Windows Update for existing PCs.
For broad enterprise deployment, Microsoft continues to recommend Windows 11 versions 25H2 and 24H2. Organizations evaluating new hardware can selectively adopt 26H1, but should validate AVD and FSLogix configurations before large-scale rollout, particularly where profile containers are used.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
