Windows black screen after login? Diagnose the session first

Make sure this is the after-login scenario

This guide fits a specific sequence: Windows reaches the normal credential prompt, accepts the sign-in, and then fails to show the desktop or taskbar. A movable mouse cursor may remain visible. Microsoft treats that as a Windows profile and desktop-session problem distinct from a screen that is already blank before credentials.

• No logo, no sign-in screen, or no display at all: use a power, startup, cable, monitor, or hardware path instead.
• Blinking text cursor before Windows: this can be a boot-device or firmware path, not the desktop-session scenario.
• A stop-code message: record the code and follow the blue-screen diagnostic path.
• The desktop appears after a long wait: record the delay, startup load, disk activity, and recent changes; that differs from a session that never loads.

Capture the evidence card first

Keep these observations together before removing a driver, update, or startup item:

• The exact time the credential prompt appears and the time the screen goes black.
• Whether a mouse cursor is visible and moves.
• Whether the security screen opens with Ctrl + Alt + Del.
• Whether Task Manager opens and lists Windows Explorer.
• Whether the problem affects one account or every account you are authorized to test.
• Any display-driver, Windows update, app, security tool, dock, monitor, or startup change just before the symptom.
• Whether an external monitor or a different display mode changes the result.

Use the least disruptive checks first

1. Reset the graphics driver once. Press Windows + Ctrl + Shift + B. Record whether a tone sounds or the screen flashes and whether the desktop returns.
2. Check the display mode. Press Windows + P, then carefully cycle the supported modes. A dock or remembered external display can direct the desktop to a screen that is no longer available.
3. Open the security screen. Use Ctrl + Alt + Del. If it appears, the display path and part of the session are still responsive.
4. Open Task Manager. Select it from the security screen or use Ctrl + Shift + Esc. Note whether Windows Explorer is present and whether it is marked Not responding.
5. Restart Explorer once. If Windows Explorer is listed, select Restart. If it is absent, Task Manager's Run new task can start explorer.exe. Record whether the desktop and taskbar return and whether the result survives sign-out or restart.

An Explorer restart that restores the desktop narrows attention to the shell and startup path. It does not prove that Explorer itself is the root cause; a profile, third-party shell extension, startup program, policy, or driver can still be involved.

What each response means

The security screen appears, but Task Manager does not

The system is responding at the secure-attention layer, but the normal desktop tools are not fully available. Preserve this difference. Avoid blind keyboard sequences that could close unsaved work or change recovery settings.

Task Manager opens and Explorer is running

Record whether Explorer consumes unusual CPU, memory, or disk activity and whether Restart changes the screen. Microsoft’s administrator scenario guide also examines Explorer and userinit.exe state, but dump capture and detailed process analysis are advanced support tasks, not routine consumer fixes.

Explorer is absent and starting it restores the desktop

This strongly narrows the symptom to desktop-shell launch or survival. Keep the result, the affected account, and the recent-change timeline. Do not immediately edit the Winlogon registry values; Microsoft places explicit registry warnings around that path because incorrect changes can create serious problems.

Graphics reset or display mode restores the image

A display-output or graphics-driver path becomes more plausible. Record the adapter, provider, version, install date, dock or monitor state, and exact action that restored the image. Use Microsoft or the device maker's supported update or rollback source rather than a third-party driver updater.

Use Safe Mode or rollback only with a recovery plan

If the symptom began immediately after a display-driver or Windows update, preserve the update or driver identity before changing it. Safe Mode starts Windows with a limited set of drivers and services, which can show whether the normal driver and startup set is required for the black screen.

Before entering Windows Recovery Environment on an encrypted device, confirm that the BitLocker recovery key is available. Do not disable driver-signature enforcement, delete drivers manually, or remove multiple updates at once. If Safe Mode works, compare the display driver, startup items, and recent changes one at a time.

Use a clean boot for repeatable startup interference

A clean boot is appropriate only after the phase and recent changes point toward startup software or a service. Microsoft's process hides all Microsoft services before disabling the remaining services, records disabled startup items, tests the scenario, and restores Normal Startup afterward.

If the desktop loads in a clean boot environment, re-enable items systematically rather than leaving broad groups disabled. If the symptom remains, startup interference becomes less likely and the evidence should move toward the profile, driver, shell, update, or system-support path.

Compare another authorized account carefully

If another existing authorized account reaches the desktop normally, the affected profile or account-specific startup path becomes more plausible. Do not create, delete, rename, or reset accounts casually, and do not move profile folders or edit permissions. Preserve the affected user, exact behavior, and whether Explorer starts manually.

If every account shows the same black screen, a system-wide driver, shell, update, policy, or startup path becomes more likely. This comparison narrows scope; it does not identify the component.

Keep registry and process-dump work as a handoff

Microsoft's current scenario guide includes shell registry checks, permissions, event evidence, Process Monitor boot logging, and Explorer or userinit process dumps. Those steps can be valuable for an administrator who can preserve and analyze the evidence. They are not necessary for a general reader who has not backed up the registry, confirmed recovery access, or planned how to reverse the change.

For a consumer workflow, stop after the supported graphics reset, display-mode, Task Manager, Explorer, recent-change, Safe Mode, clean-boot, and account-scope evidence. Escalate with that record instead of copying an unverified registry recipe.

What to preserve before escalation

Keep the credential-to-black-screen timing, cursor behavior, security-screen result, Task Manager and Explorer state, graphics-reset result, display mode, affected accounts, driver and update details, Safe Mode or clean-boot comparison, and any exact error. Note whether the system can still save files and whether important data is backed up.

For nearby symptoms, see the guides to Windows 11 freezes, high CPU activity, and 100% disk activity. The OmniMend blog keeps each diagnostic phase separate.

If the phase, Explorer, display, update, and startup clues are difficult to keep together, OmniMend can help collect and organize those observations for review. It does not bypass sign-in, edit protected shell settings automatically, recover an unavailable BitLocker key, or guarantee that the desktop will return.