Windows Vista Black Screen with Mouse Cursor Only Issue

December 22, 2008 – 5:21 pm

If you are one of the folks being affected during the past 45 days by the issue where Vista loads to a black screen with only a mouse cursor after reboot, this blog is for you.  I’m looking for two things.  I need existing Microsoft CSS support Case #’s related to this issue.  Also, here is a solution you can try.  If it works PLEASE comment back to this blog.

There apparently this a problem related to the Remote Procedure Call service (RPC) running under LocalSystem account instead of NT Authority\NetworkService account.  

1. On the affected machine, boot using the Vista Media and Select “Next” and then in the bottom left you will see “Repair your Computer”; select Next and then Select Command Prompt.

2. At the command prompt, launch regedit.exe and load the SYSTEM hive, follow the below steps.

a. Select HKEY_LOCAL_MACHINE

b. On the File menu, select Load Hive.

c. Browse to %WINDIR%\System32\Config Folder and select “SYSTEM”

d. Select Open.

e. In the Load Hive dialog box, type in “MySYSTEM” box for the registry hive that you want to edit.

3. After the hive is loaded, modify the following key value per the instructions below: You will need to know what ControlSet the machine is currently running on, this can be determined by going to HKEY_LOCAL_MACHINE\MySYSTEM\Select and find the “Current” value in the Right hand side. (Example: Current value is 1 then the ControlSet will be ControlSet001)

Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Services\RpcSs (X is the Number from the Current Key from above)

Value Name: ObjectName

Old Value: LocalSystem

New Value: NT AUTHORITY\NetworkService

4. Unload the SYSTEM hive by selecting the key “MySYSTEM” and then select File -> Unload Hive… menu item.

5. Exit regedit.exe

6. Reboot the system normally

  1. 49 Responses to “Windows Vista Black Screen with Mouse Cursor Only Issue”

  2. It shouldn’t be running under local system. The bigger $64,000 question is what is changing it to local system.

    I’m not seeing this in the consumer patching community more of the managed community is my big concern right now.

    Something is flipping the bit…but what?

    By Susan on Dec 22, 2008

  3. I’ve seen this three times internally, and couldn’t find the fix. I hope I don’t see it again, but if I do I’ll follow the potential fix and report back. Thanks, Mark!

    By Jason on Dec 24, 2008

  4. This fix just worked for me — on my main workstation too.

    By Ira Herman on Dec 25, 2008

  5. Mark,

    I haven’t seen this yet but I will remember your post in the event that I do see it. Thanks for the heads-up!

    By Tim Biden on Dec 26, 2008

  6. This just happened to me. On vacation and got the Black screen with just a cursor. Aargh. Downloading the ISO for Vista 64bit so I can try this fix. I will give it a shot later today. I let Susan know the same. She wanted an Email, but I don’t know hers. Hopefully she got my post on her blog.

    By Jamison West on Dec 26, 2008

  7. i have this issue on vista X64 ultimate FR.

    but unfortunately the ObjectName value was already “NT AUTHORITY\NetworkService” so, no change, and no fix for me.

    microsoft says that this bug is fixed with SP1 :
    http://support.microsoft.com/kb/946532/en-us

    it’s wrong, a REAL fix would be appreciate.

    By laurent PARIS on Dec 26, 2008

  8. Mark…this is why I switched to a MAC…no more Vista problems - Hooray!!!

    Stuart Crawford
    Calgary, AB
    http://blog.itsuccessmentor.com

    By Stuart Crawford on Dec 29, 2008

  9. Thanks for sharing the info.
    I got this problem last week and I thought it was because of the software that I installed. I happened to repair my computer by doing a system restore. And as I see it from your note above that what I did was not a perm solution. So far it is runing good and in case if it comes back I will try what you stated here.

    Reddy

    By Threenadha Bommareddy on Dec 29, 2008

  10. Mark,

    We have seen this on 7 computers now. On two of them we were able to get back to a working configuration either by using Windows Backup restore or Windows Home Server restore. (all PC’s had Home Server restore options, but it didn’t work on five of them).

    Six of the seven had Logmein and Zenith SaaS agent installed. A lot of time has gone down the rathole on this one. We ate all the time - Managed Service clients and we feel it’s “our” tool that caused the problem.

    (These “events” happened to us in October, November, and December)

    I will try your solution the next time one comes up!

    Aaron

    By Aaron Booker on Dec 29, 2008

  11. Please check out Susan’s blog on how to setup logging if you have Vista and are experiencing this issue at http://msmvps.com/blogs/bradley/archive/2008/12/26/enabling-auditing-for-the-vista-ksod.aspx

    By Mark on Dec 29, 2008

  12. Stuart - Oh Please… ;-)

    By Mark on Dec 29, 2008

  13. My Apple Mac needed to have the 10.5.6 update manually downloaded and installed. The auto update blew up on me and there are many in the Apple newsgroups reporting the same.

    For all the others having trouble with the 10.5.6 update, manually download it an install.

    By Susan on Dec 30, 2008

  14. I have the same problem black screen and mouse
    movement, that’s all. Nothing will work but the
    mouse. I am running Vista 32 bit. Just going
    through googles in hope of finding a fix.

    By Albert on Dec 31, 2008

  15. I have the same problem “laurent PARIS” has running my Windows Vista Home Premium 32Bit. The ObjectName value is already “NT AUTHORITY\NetworkService”. Should I try to switch to LocalSystem? ;)
    Did not find an adequate fix yet. Any other solutions to offer? But thanks for sharing the information above.

    By Valentin on Dec 31, 2008

  16. Mark,

    I’ve had this issue w/Vista Ultimate 32 bit on a laptop when resuming from hibernation. My fix was to use the system restore point since I knew what major changes had been made after that time and could re-create them. I wouldn’t suggest it for most folks, and even then I had to search my browser history to reopen tabs since they weren’t saved.

    I would also like to point out that I walked through your steps when this happened again and saw that mine was already set to Network Service (as laurent PARIS and Valentin reported above), so I simply unloaded the hive that was created and rebooted. The system booted normally, but I can’t explain why that should have resolved it….

    By Steve on Jan 5, 2009

  17. RE: Marks Comment: “so I simply unloaded the hive that was created and rebooted. The system booted normally, but I can’t explain why that should have resolved it….”

    I already have “Network Service” as well. Please explain how you “unloaded the hive that was created”
    I would like to give it a try.

    By Bill on Jan 6, 2009

  18. I have the same problem to and i already had the value “NT AUTHORITY\NetworkService”. Things like: Last Know Good, Repair from an older restore point. Taskmanager will not run after CTRL-Alt-Del, so i can’t start explorer.exe. This problem is on my laptop and i looks like that it happend after removing my internal DVD player. When iput another DVD player in it, Windows will regonize a new player (yes, now i can see a window asking me to update the driver) after making a choice in that dialog the screen becomes black again :-(

    I’am running out of solutions :-( What is Microsoft saying? I can see that i’m not the only one with this problem.

    By Martijn on Jan 8, 2009

  19. I also have the same problem.
    NO recent changes to the computer. NO software changes, no hardware changes, NOTHING.

    Running Windows Home Vista Premium on an HP Pavilion.

    The NT AUTHORITY\Network Service was all ready in the registry, but I tried removing the MySystem HIVE anyway.

    It did not work.

    Anxiously waiting a solution.

    Thanx,

    Jim

    By ulu on Jan 9, 2009

  20. Thank you for the well written instructions.

    However, my reg was already set to NT AUTHORITY\Network Service

    My trouble seemed to happen when I partitioned my hard drive to do in install of Win7 Beta (I never actually got past the partitioning). Rebooted and I got some error (”Replacing invalid security id with default security id for file…” for like 200,000 files). Now I cannot seem to get past the black screen.

    I ran CHKDSK a few times. No help.
    Repair from disk won’t work. It just tells me to uninstall any recently added hardware.
    Restore cannot find any saved restore points.
    Safe mode is the same.

    Looking to reinstall Vista … argh.

    By Eric on Jan 13, 2009

  21. I H8 VSTA that’s it!since june till now I re-install it 6 times,each time losing lots of my programs and time of course.I had no other solution to use vista as my laptop was equiped! by it when I bought it.

    By fOROUZAN on Jan 17, 2009

  22. Ive just today installed Windows 7 and just came across this very problem, It would appear to me that Windows 7 may well be a reskinned Vista. So far I liked it but the more errors im finding seem to have happend to Vista. Looks like another cheep ass money grab from microsoft :(

    By Richard on Jan 19, 2009

  23. I have the same problem, but if I disconnect the network cable it boots up fine….

    I’ve had this problem since I installed SP1 several months ago. I reinstalled the system once but it only worked for a day or two and then the blank screen was back.

    Only way to get the system up is to disable all network connections.

    By erressx on Jan 23, 2009

  24. Hey “erressx”,
    Is this computer (or was it) a domain member? Sounds like a policy dependent on networking is failing to load. If it was subject to GPOs then check out http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/91596.mspx?mfr=true

    The problem you describe is also indicative of bad DNS. Make sure all you DNS entries are accurate or set to dynamic.

    By Mark on Jan 23, 2009

  25. Same thing here, already had the right value in the registry, Ctrl-Alt-Del does nothing, Ctrl-Shift-Esc does nothing, chkdsk reports nothing.

    In my case, I got a desktop up by:

    - waiting several minutes at the KSOD, until hard drive activity stops
    - hitting the shift key 5 times, to bring up Sticky Keys
    - click ‘yes’ to turn on sticky keys
    - on the sticky keys config page, under the menu choose ‘Is this version of Windows legal’
    - IE is launched. In the address bar, C:\Windows\explorer.exe. Hey presto, there’s my start menu and desktop.

    By Scott on Jan 23, 2009

  26. This Solution is 100 % working Correctly. So Thanks All who consume those thread and give the better solution…

    By Dhanushka on Jan 27, 2009

  27. I first tried CTRL + ALT + DEL and my computer restarted. Pressing CTRL + ALT + ESC rapidly (out of frustration) fixed my problem temporarily. Restarting the computer returned to KSOD. The second time through, CTRL + ALT + ESC didn’t work.

    This is a pretty fresh install of Vista x64 (about one week old), on MSI DKA Platinum, 2x Seagate drives in RAID 0, Phenom II 940, GSkill 4xGB of RAM. I have the latest bios and returned everything to the fail safe defaults (then enabled RAID again). This did not work.

    I unplugged all peripheral devices, such as my printer and external hard drive. I also unplugged to internal SATA hard drives leaving only the SATA CD-ROM and the two SATA drives in RAID-0 and the machine booted right up. Unfortunately this was temporary again. When I rebooted, it was back to KSOD, but CTRL + ALT + ESC showed me a flash of the Windows Boot Manager (typically present for dual OS booting machines) and the login screen appeared.

    In the session before the KSOD I ran some malware detection software (MalwareBytes) that I have never run before, but I don’t think this is the cause, nor did the scan find any harmful results.

    Strange behavior, and I’ll reluctantly try the “Repair” option on the Vista disk, though I have never been a fan of any ‘repair and recover’ options offered by Windows.

    By HomburgPokes on Jan 29, 2009

  28. Defragging the registry with Tune-Up Utilities 2009 (not cleaning, but defragging) has allowed me to boot several times in a row without KSOD. As mentioned above, all of my extra hard drives and peripheral devices are not connected.

    Not saying this is the fix, but it is worth a shot.

    By HomburgPokes on Jan 29, 2009

  29. This may seem very simple but I have come across the blinking cursor and it was an external storage device, USB hard drive, Ipod, Flash drive, etc. Unplug, reboot and all is well. You can change bios so as not to boot from USB.

    By Joseph Tamburello on Jan 30, 2009

  30. heyy whats up i need in the “e” step

    i can’t understand what to do!!!

    please!!!!!!

    By george zamora on Feb 2, 2009

  31. After loading the hive, I couldn’t find the directory in step 2 c. I am using Vista Home Premium.
    Any suggestions?

    By Michael on Feb 28, 2009

  32. This solved our problem: Vista 32bit, blank / black screen with mouse cursor only. Same in safe mode and safe mode w/ cmd prompt. Unable to bring up task mgr. Multiple system restores did not resolve. The machine was running Zenith SAAZ & LMI. Thanks very much for your help!

    By Ed F on Mar 11, 2009

  33. I also have this issue and have tried everything above. I was told it’s some in compatibility with software that was installed. I didn’t have any data on the laptop so i reinstalled the os. I was able to reinstall the dell video drivers from safemode\cmd prompt and restart. This worked until I tried to restart again and back to the black screen with mouse. I wasn’t able to open device manager. I was able to ctrl+alt+del and switch user and windows desktop came up but was never able to fix it.

    By st on Mar 26, 2009

  34. Thanks for the tip about sticky keys Mark. Using that I was able to get explorer running and now I can at least see what’s going. My install seems to be totally SNAFU at the moment. The fix above didn’t help at all because the key was already the value mentioned. I’m praying that the RAID verify thats running now will magically resotre whatever system files are corrupted and i will be able to recover vista. This is the first serious Vista issue i have encountered and now i have lost a little faith in the OS.

    If this doesnt work looks like its rebuild time.

    By Royce on Mar 28, 2009

  35. Every client that we have that is using Vista with Dell computers has experienced this situation. All of our clients have the Zenith SaaZ agent / LMI installed. Since late last summer, every single computer with Vista / Zenith Saaz / LMI has experienced the KSOD at least once - 4 times has been the max. A previous system restore had been our solution - only about 50% success. This solution has worked every time.

    By Paul on Apr 1, 2009

  36. Mark,

    Today I experienced the same black screen with the mouse cursor. I was installing Word 6 when word 7 was already resident on the machine. I made a decision not to move forward with word 6 and tried to restore to the previous restore point and this is when the problem stareted. After many reboots and Windows Vista install saying everything was fine it finally acknowledged the problem and fixed, about 3-hours of hacking later.

    By Mike Rohde on Apr 5, 2009

  37. It didn’t work. When I was trying to change the old value to the new value i noticed that the old value was actually correct(nt auth…).
    Nothing changed.

    By Liviu on Apr 17, 2009

  38. This issue started with sound issues after updating my codec pack. I also installed a Windows Update.

    Service is already running as “NT AUTHORITY\NetworkService”. Must be a different but related issue.

    I need a fix :(

    By Chew on Jun 5, 2009

  39. I managed to stumble into the KSOD mystery myself three days ago and like many others I found that all of my settings were correct.

    However I later discovered that it wasn’t the user assigned to the service that was my problem.

    I’ve posted what I found and the solution to my problem in my blog in hopes that it might help others with KSOD.

    http://unattended-blog.blogspot.com/2009/06/black-screen-of-death-ksod-mystery.html

    By Alexander A on Jun 5, 2009

  40. hello, i’ve tried the fixes and nothing, however, i do get a message every now and then, not sure where i get it, as i’ve been rebooting and everything but i know it will come up again, it says, media device is running, remove media device and windows will restart normally, or something along that line. now my son did have a mp3 hooked up, and he may not of closed it, if u need to close them, but i always get the black screen and cannot unhook any media devices like the screen asks me too cause theres no media devices attached to the computer, and i already had the NT authority message installed on the computer by default and i still have the black screen any other suggestions???

    By mike d on Jun 9, 2009

  41. how do you boot using Vista Media?

    By Q on Jun 15, 2009

  1. 9 Trackback(s)

  2. Dec 25, 2008: How to fix the Vista KSOD (blacK Screen Of Death) | LogBlog
  3. Dec 26, 2008: Windows Vista Black Screen with Mouse Cursor Only | Biden PC's IT Blog
  4. Dec 30, 2008: Vista - Mysterious Black Screen of Death Solution - Harry Waldron - Corporate and Home Security
  5. Dec 30, 2008: Vista - Mysterious Black Screen of Death Solution - Harry Waldron - Corporate and Home Security
  6. Dec 30, 2008: SBSC & MSP Buzz » Blog Archive » Revised Fix for Vista Black Screen of Death
  7. Apr 20, 2009: black screen of death? - Page 2 - Overclock.net - Overclocking.net
  8. Apr 20, 2009: Black Screen Of Death "KSOD" - Overclock.net - Overclocking.net
  9. May 4, 2009: WindowsFixUp – Windows Vista Starts Up With a Black Screen and Cursor (KSOD): Fix
  10. May 15, 2009: Wat is er kapot ? - 9lives

Post a Comment

SBSC & MSP Buzz is proudly powered by WordPress Entries (RSS) and Comments (RSS). Designed by Bob