Recover a black screen that begins after a Windows update when the cause is not yet isolated

Windows 10 or Windows 11 reached a usable desktop before an update, then produced a persistent black or blank screen on the first or a later restart after that update. The pointer may or may not move. The sign-in screen, Ctrl+Alt+Delete, Task Manager, or Windows sounds may still be available.

The timing makes the update relevant, but it does not identify the failed component. A Windows update can also deliver a display driver, expose an incompatible shell extension, change the behavior of a startup service, complete a feature-version transition, or reveal existing component-store damage. The repair therefore begins by separating display, shell, profile, third-party startup, update-package, and system-file paths.

Searchable Windows error codes and exact messages

A black screen after an update has no unique Windows error code. Search the exact black-screen stage together with every identifier that Windows actually recorded. Do not add a code found only in an unrelated search result.

Record the exact KB number, package name, display-driver version, faulting module, and time when available. An update code that describes a failed download does not explain a black screen after a different update installed successfully.

Use this procedure when the black screen began immediately or soon after a Windows quality update, feature update, or driver delivered through Windows Update, but no single component has yet been demonstrated as the cause. It applies when the Windows disk remains consistently available and Windows reaches at least the logo, sign-in, security screen, Safe Mode, or a recoverable post-loader state.

Do not use this procedure for a black screen before the Windows logo with a blinking text cursor, a display that is also blank in firmware and Windows Recovery Environment, a system disk that disappears, a specific Secure Boot violation, or an explicit blue-screen failure whose dump already names a different mechanism. A machine stuck on Working on updates, Undoing changes made to your computer, or a percentage that repeatedly restarts belongs in the pending-servicing or update-rollback workflow rather than this post-update black-screen triage.

If manually starting Explorer already proves a shell-only problem, use the dedicated Explorer/profile procedure. If Safe Mode plus display-driver rollback already proves a graphics-driver problem, use the dedicated graphics procedure. This article is for the still-unclassified stage and shows how to reach one of those conclusions without guessing.

The exact Windows build, exact KB, and original cause may remain unknown during the first non-destructive tests. A practical repair can still be good when one controlled branch restores the display and survives verification.

The following may not remain unknown before a permanent change:

• Whether the screen goes black before sign-in, after sign-in, or only when the desktop should appear
• Whether the pointer, Ctrl+Alt+Delete, Task Manager, and Windows sounds work
• Whether Safe Mode is visible
• Whether another user account is affected
• The display adapter and current driver provider/date/version before rollback or uninstall
• The exact update/package selected before uninstalling it
• The detected Windows volume when offline commands are used
• Whether DISM identifies the image as healthy, repairable, or non-repairable

• Windows Recovery Environment or a working Windows 10/11 installation USB if normal Windows is unusable
• Administrator access in Safe Mode, Task Manager, or a temporary working desktop
• A backup of important user files before uninstalling a feature update, repairing an offline image, or performing an in-place repair
• A single known-working display connection for the first tests
• Stable power
• Enough free space on the Windows volume for logs and servicing
• The exact computer or graphics-adapter model before installing a replacement driver
• Matching Windows installation media only if DISM specifically requires an external source

Disconnect docks, VR headsets, external GPUs, secondary displays, and unrelated USB devices. Leave one known-working monitor connected to the normal primary output. Do not change firmware settings, storage-controller mode, Secure Boot, BCD, or partition layout; none is justified by a post-update black screen alone.

Do not repeatedly force the machine off while Windows displays an update percentage or Working on updates. Proceed after Windows reaches a stable black screen, sign-in state, Automatic Repair, or WinRE.

Create an evidence folder before removing an update or driver whenever Windows or Safe Mode is usable. Use the detected live Windows paths rather than assuming the installation is on C::

echo %SystemDrive%
echo %SystemRoot%
md "%SystemDrive%\FixItEvidence"
dism /Online /Get-Packages /Format:Table > "%SystemDrive%\FixItEvidence\packages-before.txt"
pnputil /enum-drivers > "%SystemDrive%\FixItEvidence\third-party-drivers-before.txt"
driverquery /v /fo csv > "%SystemDrive%\FixItEvidence\driverquery-before.csv"
wevtutil epl System "%SystemDrive%\FixItEvidence\System-before.evtx" /ow:true
wevtutil epl Application "%SystemDrive%\FixItEvidence\Application-before.evtx" /ow:true
wevtutil epl Setup "%SystemDrive%\FixItEvidence\Setup-before.evtx" /ow:true
copy "%SystemRoot%\Logs\CBS\CBS.log" "%SystemDrive%\FixItEvidence\CBS-before.log"
copy "%SystemRoot%\Logs\DISM\dism.log" "%SystemDrive%\FixItEvidence\DISM-before.log"

A missing optional log can make one copy command fail; record that result and continue. Do not clear the event logs.

Perform the following tests in order. Stop as soon as a branch produces specific evidence.

1. Record the last visible stage: manufacturer logo, Windows logo, spinning dots, sign-in picture, password/PIN acceptance, pointer, desktop sounds, or recovery message.

2. At the black screen, press:

   Windows key + Ctrl + Shift + B
   

   A beep or flicker means Windows received the graphics-reset shortcut. If the display returns, Branch A is indicated, but the reset alone does not prove whether the driver, GPU, or display route caused the timeout.

3. Press Windows key + P, wait two seconds, press P once, and press Enter. Repeat slowly through the available projection modes. If one mode restores the display, record it and use Branch A. Do not keep cycling if the display is already correct.

4. Press Ctrl+Alt+Delete.

   • If the security screen is visible, select Task Manager.
   • If Task Manager opens, select Run new task, enter explorer.exe, and press Enter.
   • If the desktop and taskbar appear, Branch B is indicated.
   • If Explorer appears briefly and exits, note the time so Event ID 1000, 1001, or 1002 can be matched to that attempt.

5. Enter WinRE, then select Troubleshoot > Advanced options > Startup Settings > Restart > 4 or F4 — Enable Safe Mode.

   • If Safe Mode is visible but normal mode is black, Windows can load with its limited driver/service set. A normal-mode display driver, third-party service, startup item, or shell component remains likely.
   • If Safe Mode is also black but Ctrl+Alt+Delete and Task Manager work, test Explorer and another account before blaming graphics.
   • If Safe Mode, WinRE, and firmware are all blank, stop; this is no longer a Windows-update-only diagnosis.

6. In Safe Mode, open Device Manager > Display adapters. For every active adapter, record the device name, Device status, driver provider, driver date, driver version, and whether Roll Back Driver is available. On hybrid-graphics laptops, record both adapters and change only one at a time.

7. Open Update history when Settings is usable:

   • Windows 11: Settings > Windows Update > Update history
   • Windows 10: Settings > Update & Security > Windows Update > View update history

   Record the last successfully installed quality update, driver update, and feature update. Do not infer that the newest listed item caused the failure merely because its date is recent.

8. Open Reliability Monitor by running:

   perfmon /rel
   

   Match the first black-screen time to Windows failure, Hardware error, application failures, LiveKernelEvent, or a driver installation. Open each matching entry and record its code, bucket, application, and module.

9. In Event Viewer, inspect these logs at the first-failure time:

   • Windows Logs > System for Display 4101, driver-service failures, and device-start failures
   • Windows Logs > Application for Application Error 1000, Windows Error Reporting 1001, Application Hang 1002, and User Profile Service events
   • Windows Logs > Setup for the package or driver installation

10. Test whether the failure follows the user profile. First use an existing second account if one is available. If none exists and an administrator Command Prompt can be opened from Task Manager, create a temporary standard account without exposing its password on the command line:

    net user FixItTest * /add
    

    Enter a temporary password when prompted, sign out, and sign in as FixItTest.

    • If the new account gets a normal desktop, Branch C is indicated.
    • If every account fails identically, the cause is system-wide; remove the test account later and continue.

11. If Windows cannot reach Safe Mode, detect the offline Windows letter in WinRE. Never assume it is C::

    diskpart
    list volume
    select volume <Windows-volume-number>
    detail volume
    

    If the verified Windows volume has no letter, confirm that W: is unused, then run the following and record that W: is a temporary letter that must be removed before leaving WinRE:

    assign letter=W
    detail volume
    exit
    

    If it already has a letter, use that letter in place of W: and exit DiskPart. Confirm the installation:

    dir W:\Windows\System32\Config\SYSTEM
    dir W:\Users
    

12. Preserve offline evidence before servicing or uninstalling anything:

    md W:\FixItEvidence
    dism /Image:W:\ /Get-Packages /Format:Table > W:\FixItEvidence\packages-offline-before.txt
    dism /Image:W:\ /Get-Drivers /Format:Table > W:\FixItEvidence\drivers-offline-before.txt
    copy W:\Windows\System32\winevt\Logs\System.evtx W:\FixItEvidence\System-before.evtx
    copy W:\Windows\System32\winevt\Logs\Application.evtx W:\FixItEvidence\Application-before.evtx
    copy W:\Windows\System32\winevt\Logs\Setup.evtx W:\FixItEvidence\Setup-before.evtx
    copy W:\Windows\Logs\CBS\CBS.log W:\FixItEvidence\CBS-before.log
    copy W:\Windows\Logs\DISM\dism.log W:\FixItEvidence\DISM-before.log
    copy W:\Windows\System32\Logfiles\Srt\SrtTrail.txt W:\FixItEvidence\SrtTrail-before.txt
    

    Some files may not exist. Preserve what is present and record each missing file instead of creating a substitute.

Use the branch supported by section 7. Make one reversible change, restart, and record the result before proceeding.

Branch A — Display reset, projection change, or display-driver evidence restores the image

1. Keep only one display attached until two successful normal starts are complete.

2. In Safe Mode or the restored desktop, open Device Manager > Display adapters > <actual adapter> > Properties > Driver.

3. Record the current driver version again.

4. If Roll Back Driver is available and the recorded driver installation coincides with the first black screen:

   • Select Roll Back Driver.
   • Select the truthful reason.
   • Confirm and restart normally.

5. If rollback is unavailable, uninstall only the implicated display device:

   • Select Uninstall device.
   • On the first test, do not select an option to remove the driver package permanently.
   • Confirm, then restart so Windows can use a basic or previously staged driver.

6. On a hybrid-graphics computer, do not uninstall or disable both adapters at once. Test one adapter change, restart, and record the result.

7. If the basic or earlier driver restores the display, obtain the model-specific signed driver. Prefer the computer manufacturer's validated package for laptops and systems with switchable graphics.

8. Disconnect the network only during the controlled driver-version test if Windows Update immediately replaces the working driver. Reconnect it after the result is documented.

9. Install the selected compatible driver, restart twice, and verify Device Manager reports This device is working properly.

10. If the same black screen returns with every compatible driver or Device Manager repeatedly reports Code 43, stop and test the GPU, power, and display path rather than cycling driver packages indefinitely.

Branch B — Starting Explorer restores the desktop

1. Use the temporary desktop to preserve the evidence in section 6.

2. In Task Manager, identify recently updated taskbar, Start-menu, theme, Explorer, overlay, or shell-customization software.

3. Open an administrator Command Prompt and query the machine-wide Winlogon values:

   reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell
   reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit
   

4. Run echo %SystemRoot%. Expected machine-wide values are Shell = explorer.exe and Userinit = <the-displayed-SystemRoot>\system32\userinit.exe,. If they are correct, do not rewrite them.

5. If a recorded value points to a now-incompatible third-party shell, export the key before changing anything:

   reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" "%SystemDrive%\FixItEvidence\Winlogon-before.reg"
   

6. Uninstall or update only the evidenced shell customization from the applicable page—Windows 11: Settings > Apps > Installed apps; Windows 10: Settings > Apps > Apps & features. Restart and test before editing Winlogon.

7. Correct only a value that the query proves is wrong and only after the implicated third-party program has been removed:

   reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d explorer.exe /f
   reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "%SystemRoot%\system32\userinit.exe," /f
   

   Do not replace the whole key, and do not run either command when its queried value was already correct.

8. Restart and test. If Explorer still fails, continue to Branch E for a clean-boot isolation. If a second account works, use Branch C instead.

Branch C — A second account works

1. Do not overwrite or delete the original profile.
2. In the working account, export the Application log and inspect User Profile Service events for the failed account.
3. Disable or uninstall per-user shell extensions and startup items that were installed immediately before the failure.
4. Sign back into the original account and test.
5. If the original account remains black while the test account remains stable, create a permanent replacement account through Windows 11 Settings > Accounts > Other users or Windows 10 Settings > Accounts > Family & other users.
6. Copy personal documents, pictures, downloads, browser exports, and other known data selectively. Do not copy NTUSER.DAT, the entire hidden AppData tree, or the entire old profile over the new profile, because doing so can transfer the broken per-user state.
7. Keep the old profile until all required data and application settings have been verified.

Branch D — One exact quality or feature update remains the strongest evidence

1. Confirm the KB/package or feature version from Update history, the Setup log, or the saved DISM package list.

2. If Windows 11 reaches a usable desktop and Settings > System > Recovery > Fix problems using Windows Update > Reinstall now is available, use it before removing a security update. This reinstalls a repair version of the currently installed Windows version while preserving apps, files, and settings. Keep the computer connected to power and the internet until it finishes. This option is unavailable on Windows 10, managed devices, Windows 11 versions before 22H2, and systems that do not meet Microsoft's prerequisite-update requirements.

3. Restart and test. If the repair option is unavailable or the desktop cannot be used, enter WinRE.

4. Select Troubleshoot > Advanced options > Uninstall Updates.

5. Choose only the matching rollback:

   • Uninstall latest quality update for the most recent cumulative/quality update.
   • Uninstall latest feature update only when the failure began during a version upgrade and that option is offered. This is broader than uninstalling a quality update: it can remove apps and drivers installed after the upgrade and reverse settings changes. Personal files normally remain, but a verified backup is still required.

6. Select the verified Windows installation, confirm the uninstall, and let it complete without interruption.

7. Restart normally and test twice.

8. If Windows starts, open Update history and verify that the intended item—not an unrelated update—was removed.

9. Temporarily pause updates only long enough to preserve the working state, capture evidence, and check whether Microsoft or the device manufacturer has supplied a corrected update or driver. Do not permanently disable Windows Update.

10. If WinRE says it cannot uninstall the update, do not start manually deleting package files. Continue to Branch F or the dedicated pending-servicing procedure.

Branch E — Safe Mode works, but no single driver, profile, or update is proven

1. In Safe Mode, run msconfig.
2. On Services, select Hide all Microsoft services first.
3. Record the remaining enabled third-party services, then select Disable all and Apply.
4. Open Task Manager's Startup apps page in Windows 11 or the Startup tab in Windows 10. Record and disable nonessential startup items.
5. Restart normally.
6. If the desktop appears, re-enable half of the recorded third-party services, restart, and retest.
7. Continue by halves until one service group reproduces the black screen; then test that group one item at a time.
8. Repeat the same half-split process for startup apps.
9. When one component is isolated, leave only that component disabled and obtain an update or uninstall it. Restore every unrelated item.
10. If a clean boot makes no difference, restore the clean-boot settings and continue to Branch F.

Branch F — CBS, DISM, SFC, or repeated system-process failures indicate Windows component damage

1. When Safe Mode or a temporary desktop is stable, open an administrator Command Prompt.

2. Check the online image:

   DISM /Online /Cleanup-Image /ScanHealth
   

3. If DISM reports no component-store corruption, do not run repeated repair commands; run SFC once and continue diagnosis:

   sfc /scannow
   

4. If DISM reports that the image is repairable, run:

   DISM /Online /Cleanup-Image /RestoreHealth
   sfc /scannow
   

5. Record the complete final messages. Restart and test.

6. If normal and Safe Mode are unusable, use the detected WinRE letter from section 7:

   DISM /Image:W:\ /Cleanup-Image /ScanHealth
   

7. Continue only if DISM reports that the offline image is repairable:

   DISM /Image:W:\ /Cleanup-Image /RestoreHealth
   sfc /scannow /offbootdir=W:\ /offwindir=W:\Windows /offlogfile=W:\FixItEvidence\sfc-offline.txt
   

8. If DISM returns 0x800F081F, stop. Do not point it at arbitrary installation media. Obtain media compatible with the installed Windows version, architecture, language, edition, build, and servicing level. Record the target image version printed by DISM, its edition, and its language configuration, then inspect the media indexes:

   DISM /Image:W:\ /Get-CurrentEdition
   DISM /Image:W:\ /Get-Intl
   DISM /Get-WimInfo /WimFile:M:\sources\install.wim
   

   Substitute the detected installation-media letter for M:. For each candidate index, inspect its complete metadata:

   DISM /Get-WimInfo /WimFile:M:\sources\install.wim /Index:<candidate-index>
   

   Compare the target and source language, architecture, edition, Windows version/build, and servicing level. Reject a different language or architecture, a nonmatching edition/index, or a source older than the installed target. If the installed architecture was not previously recorded and cannot be proven, stop. If the media contains only install.esd, it may be inspected with /Get-WimInfo, but this article does not assume that an unvalidated Source:esd: form is an acceptable repair source; obtain a documented compatible WIM or other validated repair source.

9. After proving the matching WIM image index, use the documented WIM source form:

   DISM /Image:W:\ /Cleanup-Image /RestoreHealth /Source:wim:M:\sources\install.wim:<matching-index> /LimitAccess
   

10. Run the offline SFC command again only after DISM succeeds.

11. If DISM reports that the image is non-repairable, SFC reports a pending repair, or servicing logs show unfinished actions, stop. Do not use /RevertPendingActions merely because the black screen followed an update; it can discard servicing work and belongs only in a separately confirmed pending-action case.

12. If—and only if—you assigned W: temporarily in section 7, remove that letter before leaving WinRE. Reidentify the same volume by number and details; do not remove a pre-existing Windows letter:

    diskpart
    list volume
    select volume <same-Windows-volume-number>
    detail volume
    remove letter=W
    detail volume
    exit
    

• Graphics reset or projection change restores the display: The display path is implicated, but driver, topology, and hardware evidence still decide the permanent fix.
• Explorer starts the desktop: Treat the update as the trigger that exposed a shell or profile problem; do not uninstall display drivers without display evidence.
• Safe Mode works and the earlier/basic display driver fixes normal mode: The updated display package is strongly implicated.
• A second account works: The update affected per-user shell/profile state; replacing the whole Windows installation is disproportionate.
• Clean boot works: A third-party service or startup component is responsible. The half-split test must identify it before anything else remains disabled.
• Removing one exact update restores the desktop: The update is strongly correlated, but verify whether it included a driver and whether a fixed revision exists before permanently deferring security updates.
• DISM/SFC repairs files and the black screen stops: Component damage was real. Preserve the logs; the original reason for the corruption may still be unknown.
• No branch changes the symptom: Reassess the boot stage and hardware. The temporal association with Windows Update is no longer enough evidence for further update removal.

• Do not treat chronology alone as proof that the latest KB is defective.
• Do not uninstall every update, driver, or display adapter at once.
• Do not use third-party driver-updater or driver-cleaner packages.
• Do not delete or rename WinSxS, WindowsApps, SoftwareDistribution, pending.xml, or servicing registry keys to force a result.
• Do not permanently disable driver-signature enforcement, Secure Boot, Memory Integrity, Microsoft services, or Windows Update to make the screen appear.
• Do not disable both adapters on a hybrid-graphics computer in one test.
• Do not copy system files from another computer or an unmatched ISO.
• Do not run offline DISM against X:\; in WinRE, X: normally belongs to the recovery environment, not the installed Windows image.
• Do not assume the installed Windows volume is C: in WinRE.
• Do not use DISM /RevertPendingActions unless a separate servicing diagnosis proves a pending action is the failure mechanism.
• Do not reset or reinstall Windows before preserving update, driver, event, and profile evidence.

Rollback depends on the branch used:

• Display driver: Reinstall the recorded previous package or use Roll Back Driver if a test package worsens the result. Keep the driver provider/date/version for both states.

• Winlogon: Import %SystemDrive%\FixItEvidence\Winlogon-before.reg only if a backed-up Winlogon value was changed and the change made the result worse:

  reg import "%SystemDrive%\FixItEvidence\Winlogon-before.reg"
  

• Clean boot: In msconfig, restore Normal startup, re-enable the recorded services, and re-enable recorded startup apps. If one item is proven faulty, leave only that item disabled.

• Temporary account: After all comparisons and data checks are complete, remove it from an administrator Command Prompt:

  net user FixItTest /delete
  

• Uninstalled update: Reinstall it only after a corrected revision, compatible driver, or verified mitigation exists. Unpause Windows Update after the controlled test.

• DISM/SFC: These repairs have no file-by-file undo. Retain the pre-repair logs and rely on the verified backup if the image becomes less usable.

Do not use System Restore merely to reverse one clean-boot checkbox or temporary account. Use the branch-specific rollback first.

1. Start Windows normally twice without Safe Mode, a one-time projection shortcut, or Task Manager intervention.
2. Sign in to the original account and confirm that desktop, taskbar, Start, and Explorer remain available for at least one normal work session.
3. If a second account was used, confirm that its result is consistent with the original-account result.
4. Confirm Device Manager shows the intended display driver and This device is working properly, with no Code 10, 31, 39, 43, 48, or 52.
5. Reconnect displays and docks one at a time and verify each topology.
6. Review Reliability Monitor and Event Viewer for new display timeouts, shell crashes, profile errors, or servicing failures during the verification boots.
7. Verify Update history reflects the intended uninstall, reinstall, or repair operation.
8. Re-enable every unrelated service and startup item.
9. Test one sleep/resume cycle and one full shutdown/cold start.
10. Back up the final evidence folder, including the working display-driver version and update state.

Confidence is approximately 80% when the first failure closely follows an update and one independent comparison—Safe Mode, another account, an earlier display driver, a clean boot, or removal of one exact update—changes the result, with the repair surviving two normal starts. Confidence rises when the matching event, driver version, package, or faulting module is also recorded.

Confidence is materially lower when the update history is unavailable, several unrelated changes occurred, repeated forced shutdowns obscured the timeline, or the display also fails outside Windows.

Stop and escalate when the Windows volume cannot be identified, DISM declares the image non-repairable, a matching repair source cannot be obtained, the disk or GPU disappears, Code 43 persists with a basic known-good driver, firmware/WinRE is also blank, user data is not backed up, or every controlled branch leaves the symptom unchanged.