KB5124008 leaves Windows 11 at a black screen when Explorer.exe fails (September 12, 2026)
Chapters
TL;DR
Some Windows 11 PCs sign in to a black screen after September's KB5124008 because Explorer.exe either does not start or crashes almost immediately, according to Windows Latest on September 12, 2026. The reports cluster on virtual desktop environments whose user profiles live in containers: Citrix UPM, FSLogix, VMware Horizon and ProfileUnity ProfileDisks, on both 24H2 and 25H2. Microsoft is collecting memory dumps and says it needs more data to root cause the failure, so as of September 12, 2026 there is no known-issue entry and no fix.
- Explorer.exe runs the desktop, the taskbar and the Start menu, so when it fails there is nothing on screen to click.
- The reported workaround is restarting Explorer.exe from Task Manager, every session, or creating a fresh user profile.
- A Microsoft engineer, Jason Parker, asked affected users for memory dumps, and Microsoft said it needs more data to understand and root cause the problem.
- It concentrates in virtual desktops with containerized profiles, Citrix UPM, FSLogix, Horizon and ProfileUnity ProfileDisks, on Windows 11 24H2 and 25H2.
- KB5124008 now carries a long list of separate complaints, including AMD graphics driver timeouts, USB audio failures, Hyper-V host share failures, Remote Desktop instability and BitLocker recovery loops.
What broke
You sign in, authentication succeeds, and the screen stays black. Explorer.exe, the process that draws the desktop, the taskbar and the Start menu, either fails to start or crashes within seconds of starting. Nothing is wrong with the display and nothing is wrong with the account. There is simply no shell.
That failure mode is worse than it sounds for the people it hits, because the usual recovery, opening something and fixing it, needs a taskbar. The only route back is Task Manager, which most people do not reach without being told the keyboard shortcut.
Why it lands on virtual desktops
Windows Latest reports the failures concentrating in virtual desktop environments where user profiles live in containers, naming Citrix UPM, FSLogix, VMware Horizon and ProfileUnity ProfileDisks, and it says both 24H2 and 25H2 are affected. That is a useful boundary: a home PC with a local profile is far less likely to see this than a pooled desktop that mounts a profile disk at sign-in.
What is not published is why. No mechanism has been described, no component in KB5124008 has been named, and Microsoft's position, per Windows Latest, is that it needs more data to understand and root cause the failure. A Microsoft engineer, Jason Parker, asked for memory dumps. Until that work produces something, anyone claiming to know the cause is guessing.
The rest of KB5124008's record
This update is accumulating complaints. NinjaOne keeps a catalog entry for KB5124008, dated September 8, 2026, which marks the update Caution with a 30 percent success probability and lists AMD GPU driver corruption causing amdxx64.dll faults and system timeouts, USB Audio Class 1.0 devices failing to start, Hyper-V Plan9 host share failures, RDS instability and BitLocker recovery loops requiring rollback. It also notes that systems without AMD graphics or specialized features remain stable, and records the AI components moving to version 1.2608.951.0.
Windows Latest adds an unconfirmed File History backup failure, which I wrote up in the September 8 post, and AMD graphics driver timeouts reported on the RX 6600, RX 7700 XT, RX 7800 XT, RX 7900 GRE, RX 7900 XTX and RX 9070 XT. The Remote Desktop side is in the September 11 post.
| What the NinjaOne entry lists | Detail |
|---|---|
| Verdict | Caution, 30 percent success probability |
| AMD graphics | Driver corruption causing amdxx64.dll faults and system timeouts |
| USB audio | USB Audio Class 1.0 devices failing to start |
| Hyper-V | Plan9 host share failures |
| Remote Desktop | RDS instability |
| BitLocker | Recovery loops requiring rollback |
| Reported stable | Systems without AMD graphics or specialized features |
The workarounds, and what they cost
Restarting Explorer.exe from Task Manager brings the desktop back. It has to be repeated, potentially at every sign-in, and it is not something you can ask a non-technical user to do reliably when there is no taskbar to guide them.
Creating a fresh user profile is the other reported route, and it costs the settings and layout inside the old container: the pinned applications, the mapped locations, the desktop arrangement people build up over years. Rolling back KB5124008 removes the problem and removes September's security fixes with it. None of the three is a fix, and Microsoft has published no remedy as of September 12, 2026.
What you can do today
1. Get a desktop back now. Press Ctrl, Shift and Escape together to open Task Manager, choose Run new task, type explorer.exe and press Enter. On a virtual desktop, do it from the console session.
2. Find out whether the profile is in a container. If the machine uses Citrix UPM, FSLogix, Horizon or ProfileUnity ProfileDisks, treat a black sign-in as this problem until proven otherwise, and expect it again at the next sign-in.
3. Capture a memory dump of the Explorer.exe crash before you reimage anything. That is the evidence Microsoft has asked for, and a reimaged machine tells nobody anything.
4. Test one fresh profile on one machine to confirm the container is the difference. Do it as a diagnostic, not as a rollout, because a new profile loses what was in the old one.
5. Hold KB5124008 on your remaining pooled desktops in WSUS or Intune while this is open, with a date to revisit it. Those machines stay without September's security fixes until you release the hold.
6. If you own AMD graphics and you are seeing timeouts or freezes rather than a black shell, treat it as a separate complaint against the same update rather than the same fault.
Frequently asked questions
Is the Explorer.exe crash an acknowledged Windows 11 bug?
Not as a release health entry. As of September 12, 2026 Microsoft is collecting memory dumps and says it needs more data to root cause it, which is an acknowledgement that it is looking, not a published known issue with a fix date.