Nothing on task bar works or opens, runs WerFault.exe if anything is clicked

2

Windows 10, fully up to date - Version 1511 (OS Build 10586.0)

Cannot open Start Menu, Cortana, Volume Controls, Notifications - anything on the task bar.

This issue was caused by:

1) explorer.exe being terminated one time, yesterday

I have tried every fix available through standard searches. Everything included here has been tried.

I can see any time I click anything on the task bar, a WerFault.exe runs, which is "Windows Error Reporting", but this is only through watching Taskmanager, as nothing actually comes up when I click anything.

I can't even right-click non-Windows applications on the task bar, such as right-clicking a Chrome window to close it or whatever else.

If attempting to open Start Menu, Event Viewer generates 5 events:

1) Faulting application name: ShellExperienceHost.exe, version: 10.0.10586.0, time stamp: 0x5632d93d

2)

Fault bucket 133232457255, type 5
Event Name: MoAppCrash
Response: Not available
Cab Id: 0

3)

Faulting application name: SearchUI.exe, version: 10.0.10586.0, time stamp: 0x5632d66d

4)

Activation of app Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App failed with error: The app didn't start. See the Microsoft-Windows-TWinUI/Operational log for additional information.

5)

Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: The app didn't start. See the Microsoft-Windows-TWinUI/Operational log for additional information

pay

Posted 2016-04-20T13:47:47.567

Reputation: 254

Which update of Windows 10 do you have? – hxri – 2016-04-20T13:59:42.527

I presume you have tried to restart the machine? – Ramhound – 2016-04-20T14:02:39.797

As-is this is too broad, IMO; we need more information. Have you looked in the Event Logs yet? How about as the Problem Reports in the Control Panel? They should give you information that WerFault collected, hopefully pointing to the cause of your error. – Ƭᴇcʜιᴇ007 – 2016-04-20T14:03:11.770

Version 1511 (OS Build 10586.0). It generally wouldn't be possible to try every presently available troubleshooting method without several reboots. – pay – 2016-04-20T14:03:27.340

10586.0 IS NOT the current Windows 10 build. It is 10586.218 as of April 12th 2016. Which means your missing about 5-6 months of updates, basically every update, since Nov 2015. At the very least you should be at 10586.3 since that was the day 1 patch for that build. – Ramhound – 2016-04-20T14:03:51.413

I am not running preview builds. This seems to be what you're referring to. – pay – 2016-04-20T14:08:58.570

@user1438893 - I am not talking about Insider Preview builds. Take a look at my answers the last 15 months, almost all of them, have been about Windows 10. Your system if its running 10586.0 is missing updates, several months worth of updates, there is no other explanation. KB3147458 brought Windows 10 to build 10586.218 which was released last week.

– Ramhound – 2016-04-20T14:10:47.893

If you attempt to boot into safe mode do these errors still happen? Can you confirm when the last update was installed or does Windows Update also crash? – Ramhound – 2016-04-20T14:13:13.120

Booting in safe mode produces the same results. The last updates appear to have been installed on the 13th. The last check for updates was today (just now) – pay – 2016-04-20T14:33:30.577

Can you run winver that should provide you the actual build number. – Ramhound – 2016-04-20T15:09:25.683

That's where I obtained my build number originally – pay – 2016-04-20T15:11:39.550

create a crash dump: http://pastebin.com/tU3Agf5M and share the compressed dmp file.

– magicandre1981 – 2016-04-20T15:35:11.697

@user1438893 - Which means you are missing several dozen cumulative updates. – Ramhound – 2016-04-20T15:39:00.107

@magicandre1981 just for the record, the .reg file to stop creating local dumps doesn't work. I deleted the entry manually anyway. The dump file is located here: https://www.dropbox.com/s/7ixd9e69simadws/ShellExperienceHost.exe.7224.dmp.7z?dl=0

– pay – 2016-04-20T15:47:18.943

Also just manually downloaded an update, @Ramhound my build number is now 10586.218 – pay – 2016-04-20T15:59:15.013

See also here http://superuser.com/questions/1059411/windows-10-shellexperiencehost-crashes

– Matthew Lock – 2016-10-18T07:39:18.847

Answers

2

The dump shows an Access Denied error:

Stowed Exception Array @ 0x00000095c833dae0

Stowed Exception #1 @ 0x00000283e6810138
    0x80070005 (FACILITY_WIN32 - Win32 Undecorated Error Codes): E_ACCESSDENIED - General access denied error

    Stack    : 0x283e6815780
        7ff9d4c11734 combase!RoOriginateError+0x54
        7ff9cfd93f20 wincorlib!Platform::Details::ReCreateException+0x90
        7ff9cfdbcfb7 wincorlib!__abi_WinRTraiseAccessDeniedException+0x17
        7ff7f577b306 ShellExperienceHost!__abi_WinRTraiseException+0xca
        7ff7f5746374 ShellExperienceHost!Windows::UI::Xaml::Application::Start+0x94
        7ff7f57462d0 ShellExperienceHost!main+0x40
        7ff7f574a82e ShellExperienceHost!_main+0xa6
        7ff7f574a041 ShellExperienceHost!__mainCRTStartup+0x1ad
        7ff9d3cf8102 kernel32!BaseThreadInitThunk+0x22
        7ff9d4fec264 ntdll!RtlUserThreadStart+0x34

0:000> !PDE.dse 00000095c833dae0
Stowed Exception Array @ 0x00000095c833dae0

Stowed Exception #1 @ 0x00000283e6810138
    0x80070005 (FACILITY_WIN32 - Win32 Undecorated Error Codes): E_ACCESSDENIED - General access denied error

    Stack    : 0x283e6815780
        7ff9d4c11734 combase!RoOriginateError+0x54
        7ff9cfd93f20 wincorlib!Platform::Details::ReCreateException+0x90
        7ff9cfdbcfb7 wincorlib!__abi_WinRTraiseAccessDeniedException+0x17
        7ff7f577b306 ShellExperienceHost!__abi_WinRTraiseException+0xca
        7ff7f5746374 ShellExperienceHost!Windows::UI::Xaml::Application::Start+0x94
        7ff7f57462d0 ShellExperienceHost!main+0x40
        7ff7f574a82e ShellExperienceHost!_main+0xa6
        7ff7f574a041 ShellExperienceHost!__mainCRTStartup+0x1ad
        7ff9d3cf8102 kernel32!BaseThreadInitThunk+0x22
        7ff9d4fec264 ntdll!RtlUserThreadStart+0x34

0:000> !PDE.dse 00000095c833dae0
Stowed Exception Array @ 0x00000095c833dae0

Stowed Exception #1 @ 0x00000283e6810138
    0x80070005 (FACILITY_WIN32 - Win32 Undecorated Error Codes): E_ACCESSDENIED - General access denied error

    Stack    : 0x283e6815780
        7ff9d4c11734 combase!RoOriginateError+0x54
        7ff9cfd93f20 wincorlib!Platform::Details::ReCreateException+0x90
        7ff9cfdbcfb7 wincorlib!__abi_WinRTraiseAccessDeniedException+0x17
        7ff7f577b306 ShellExperienceHost!__abi_WinRTraiseException+0xca
        7ff7f5746374 ShellExperienceHost!Windows::UI::Xaml::Application::Start+0x94
        7ff7f57462d0 ShellExperienceHost!main+0x40
        7ff7f574a82e ShellExperienceHost!_main+0xa6
        7ff7f574a041 ShellExperienceHost!__mainCRTStartup+0x1ad
        7ff9d3cf8102 kernel32!BaseThreadInitThunk+0x22
        7ff9d4fec264 ntdll!RtlUserThreadStart+0x34

Run Process Monitor in background, while trying to open the startmenu or any other operation which causes the crash, and look in the Result column which operation fails with Access Denied error.

Also try to run this update which repairs the ACL which also can cause the errors.

magicandre1981

Posted 2016-04-20T13:47:47.567

Reputation: 86 560

If I clear the list, and filter by "Access Denied", I get A LOT of WerFault.exe, SearchUI,exe, ShellExperienceHost.exe - That is produced by attempting to open the Start Menu - The operation on ShellExperienceHost before the WerFaults is CreateFile – pay – 2016-04-20T16:10:16.480

Sorry I meant there is a lot of WerFault, but only a few of the other entries – pay – 2016-04-20T16:13:45.720

CreateFile is a good start. Now look at the details of the CreateFle operation to see more details – magicandre1981 – 2016-04-20T16:16:05.040

The path on those operations is also pointing to C:\Windows\System32\twinapi.appcore.dll for ShellExperienceHost – pay – 2016-04-20T16:23:58.553

share the unfiltered PML file and I'll take a look myself. I think this is easier. – magicandre1981 – 2016-04-20T16:25:12.170

open the properties of the twinapi.appcore.dll and look in the securtiy option if your account/all apppackages an read and read/run the file – magicandre1981 – 2016-04-20T16:47:41.403

Ya it looks like it has normal security, Full Control and everything else checked for Everyone and Administrators – pay – 2016-04-20T16:51:45.130

I wrote an email at Microsoft and tell you what my contacts says about the issue. – magicandre1981 – 2016-04-20T17:38:46.787

Ok, I was thinking maybe I should contact them, thanks for your help so far – pay – 2016-04-20T17:49:37.297

ok, my contact will look at it later this week. They think this is important so leave the files on dropbox – magicandre1981 – 2016-04-21T04:27:30.923

Alright, here's the Process monitor log again since I removed the last comment: https://www.dropbox.com/s/rph2l2nzgk9cnoc/Logfile.7z?dl=0

– pay – 2016-04-21T12:38:32.360

Probably no resolution to this? – pay – 2016-04-28T14:28:11.543

nope. I'll send a new email. – magicandre1981 – 2016-04-28T15:49:08.307

ok, Microsoft says it should come from AV suite. But this is strange, because you use Defender – magicandre1981 – 2016-04-28T16:57:47.300

Yes that is strange, as I don't have any third party AV/Firewall etc. installed. – pay – 2016-04-28T17:11:41.613

exclude the file in Defender options and look what happens – magicandre1981 – 2016-04-28T17:17:11.347

I'll try excluding explorer.exe, twinapi.appcore.dll, SearchUI.exe and ShellExperienceHost.exe and reboot and see what happens. I suspect the actual root of the issue is much more complex than that anyway. – pay – 2016-04-28T18:05:05.470

what happens? do you still get crashes? – magicandre1981 – 2016-04-29T04:11:49.207

No, the behaviour is exactly the same – pay – 2016-04-29T12:52:36.897

MS told me that you should install a clean Win10 VM and compare the security permissions for the DLL. Is there a diff between the good and the bad system? – magicandre1981 – 2016-04-29T15:49:53.047

The security on twinapi.appcore.dll specifically? – pay – 2016-04-29T15:56:13.910

yes. I guess so. – magicandre1981 – 2016-04-29T16:07:35.677

I guess I'll just have to reformat, as there's certainly no difference in the security rights of any of the exe's or dll's in question here from any other install of Windows 10. I'm sure an M$ engineer would have to look at this install directly to gather any meaningful information. Thanks very much for your help. – pay – 2016-04-29T20:36:00.553

try to run this update: https://support.microsoft.com/en-us/kb/3152599 this repairs the ACL

– magicandre1981 – 2016-05-12T18:15:00.543

I'll have to check if this works tomorrow – pay – 2016-05-16T20:58:27.517

No luck with that either! – pay – 2016-05-17T13:55:07.373

I'll forward this to Microsoft and look what they say. – magicandre1981 – 2016-05-17T15:59:19.823

My Microsoft contact is out of ideas. Phone the MS support for a deeper help. – magicandre1981 – 2016-06-16T04:28:53.963

2

One of our Windows 10 PCs exhibited this behaviour after the anniversary update was installed. Clicking on the start menu wouldn't work. When I looked in the Event Log it said:

Faulting application name: ShellExperienceHost.exe, version: 10.0.14393.187, time stamp: 0x57cf9d73
Faulting module name: nvumdshimx.dll, version: 21.21.13.6909, time stamp: 0x579f36b5
Exception code: 0xc0000005
Fault offset: 0x0000000000051979
Faulting process id: 0x1594
Faulting application start time: 0x01d2290588da8cb1

The faulting module nvumdshimx.dll turned out to be part of an Nvidia driver installation. Once I removed the Nvidia drivers the start menu worked again.

Matthew Lock

Posted 2016-04-20T13:47:47.567

Reputation: 4 254

2

Good info. AMD here, but the event entry posted at Microsoft Answers doesn't reveal anything about the cause.

– Laurie Stearn – 2017-12-19T14:05:09.210

Asked: 2016-04-20T13:47:47.567

Viewed: 1 558 times

Active: 2016-10-18T07:35:39.477