Black Screen after Windows login + Services with event 7000+7009 (2024)

My system has been experiencing random issues login into Windows. After entering my PIN the screen will go black while the cursor is still displayed and can be moved/click. Alt+Crtl+Del works but I cannot see the task manager if I try to open it nor can I tab to it. I do not know if it actually opens. The screen background remains black during crtl+alt+del while the default background is normally a windows blue for the login and light theme for the desktop. If I try to sign-out the cursor disappears and ctrl-alt-delete doesnt bring the menu back. This is forcing me to hard reset (case button). I can restart the PC from the power button on the bottom right of the screen after hitting Alt+Crtl+Del provided I do not sign out. After restarting by either method I can login as normal with no issue or related errors in the logs. The PC runs fine be it playing games or watching a stream/video. I can not reproduce the issue in any reliable way. It only occurs in 1 out of maybe 30-50 start-restart. I restarted the PC a number of times in an attempt to trigger the errors after different uses; browsing, games, watching steams/YT, 3dmark stress tests/benchmarks. The dates for the 3 instances of the issue are May 13, 17 and 31. Otherwise I rarely restart unless required by updates. Normally I just start-shutdown.

The issue has occurred 3 times. Once, and the 1st time with the issue, after watching Twitch for a few hours with no gamin and restarting. The issue has occurred after playing Crusader Kings 3 for hours then start-restart within 30s-60s of closing the game and steam. The 3rd time was today after playing CK3 for 3 hours trying to trigger the issue with the same 30-60s start-restart. I did a clean install of Windows after the Twitch coincidence. I reset Windows in Recovery (start- holdshift+restart) after the first CK3 related start-restart. I have left everything as it is after the issue today with CK3 start-restart.

I do not have spare parts to use for testing. I do have enough knowledge and confidence to swap ram for tests, GPU installation and maybe PSU wiring, I have no knowledge nor am willing to mess around with my CPU, Motherboard or cooler physically. Outside of that provided with simple explanation I should be able to follow any instruction provided. I have all the updates from Windows Update besides the optional downloads. These are 3 downloads. 1 related to Asus firmware and 2 are related to Intel. I do not know what these actually are. I have the latest drivers and bios as per Asus for the motherboard. I have the latest Nvidia driver. Razer software is providing drivers for my other devices. Both SSDs have the latest firmware. I did not build this PC I just picked parts from a selection of parts. It was assembled and tests for me but this was back in May 2022.

The event viewer has a number of services failing to start or connect when the issue occurs. Each service has two logs event 7000 and 7009. The services are listed by timestamp. I do not have the previous logs as per the above I have clean installed and reset already. These errors are over a minute but seem to be in clumps rather than even gaps between timestamps.

IPsec Policy Agent
Web Threat Defense
CDPUserSvc_f45bf
SSDP Discovery
UPnP Device Host
DCOM (error "1068" attempting to start the service upnphost. Related to UPnP error is my guess.)
Diagnostic System Host
BitLocker Drive Encryption (there is no options in settings for me to control Bitlocker. It's not something I turned on or can access.)
webthreatdefusersvc_f45bf
(31 second time gap)
WpnUserService_f45bf
VSSrv
Device Setup Manager
Razer Synapse Service

Examples:

There are TPM log oddities I noticed comparing a successful logins and the failed login. The errors occur right after this event.

Successful login this log is followed within 1 second with two TPM-WMI logs. These logs are completely absent during the login issue. Granted I restart the PC once I lose the cursor if I sign out. That is about 1 minute or so.

I'm no hardware expert, but maybe I can give you a place to start until one of the others jump in with more specific steps...
Are you overclocking? If so start there. Turn off all overclocking during troubleshooting.

Set power plan to balanced or recommended.

Update your mobo

and

directly from ASUS.

Check EVGA support for new graphics driver. (good luck on that. EVGA download center is acting squirrely for me. I can't get to drivers for the 3070ti) If you can't get to EVGA, check for updated drivers directly from Nvidia)If a new driver is found, I strongly suggest your use DDU to remove the old driver before installing the new one. Display Driver Uninstaller (DDU) download version 18.0.7.6

Make sure you have no corrupt system files that is causing this problem. Open a command prompt as administrator and type sfc /scannow
Pay attention to the scan results to see if SFC found anything it could not repair.

followup with this command (note the spaces)
dism /online /cleanup-image /restorehealth
Restart computer

The only overclocking I know of is the provided by two parts. The 12600k has its normal turbo as per the tech specs on Intel's site; Intel® Core™ i5-12600K Processor (20M Cache, up to 4.90 GHz) - Product Specifications | Intel The 3070 Ti has its switch for silent or boost on the GPU itself. That is set to boost and has been since I bought the GPU. I have not set any manual overlocking be it software or bios settings. XMP is set to Corsairs default settings for the RAM. Should I try to turn off the EVGA Boost switch and see if I can turn off Intel's automatic boost?

Windows 11 installation set the power plan to Balanced by default which I have left as is.

Asus Bios and drivers are up to date with the latest provided by Asus. Sadly most of these are dated to 2023 with the Realtek Lan and audio dating back to 2022. The Bios is from April 2024.

I have the latest Nvidia drivers for the GPU and PhysX from May 21, 2024. I used DDU to remove old drivers as per DDU instructions. I skipped the Nvidia audio drivers as I do not use it for sound. Although I had the audio drivers with the first 2 encounters with this issue. EVGA's download page just links right to Nvidia's website when I looked at the download button path.

The SFC command repaired C:\WINDOWS\System32\drivers\bthmodem.sys. From testing and google the Nvidia drivers or DDU always causes this to become corrupt. I have seen this in CBS report for years on two different system. I do not think this file is the cause as it would be corrupted every new GPU driver installed until I run SFC. I do not use Bluetooth at all to my knowledge. Everything I use is wired and connected directly from the source to the PC. The Windows 11 Bluetooth's troubleshooter say "Device does not have Bluetooth". I cannot find anything searching Windows search and settings related to specific Bluetooth devices.

Let me commend you on your troubleshooting thus far. You have been very thorough.

You are correct about the bthmodem.sys. It is very common for SFC to throw it out as corrupted. It's been happening for a long time and MS or bluetooth manufacturer (intel in my case) has not addressed it. One can repair it all day long but it always comes back.

I would normally say since this happens at login,you might try creating a new local account to test with but you say you've clean installed windows.

I would also normally say to do a repair install to make sure it wasn't a windows issue, but again you've already clean installed without solving the problem so I truly think it is hardware related.

Although you say no errors in logs are being generated, it might behoove you to upload what you have to a cloud provider using the instructions here. @zbook or one of the others experienced in analyzing log files might see something in the data. BSOD - Posting Instructions

Sorry I can't help more. As I said, I'm not a hardware expert nor a log file analyzer. I wish I was. Best of luck to you.

I ran into the issue again. I turned off my Bit Defender Firewall to let Windows Defender take over. I thought maybe the failed to connect errors were related to firewall issues at boot. It didnt make a difference.

I am using my MS account to login. The MS account itself is years old crossing two PCs. Should I try a local account?

I have two new errors I found in Windows 11 Maintenance. I can not link those errors with Event Viewer errors. The first picture has this error occur twice. The second picture occurred once. This was during the issue this morning. I didnt hard reset as per the previous post. I just left the system for a few minutes to see if it would recover during the black screen. The only thing I can add is I tried shift+crtl+Win+B as it resets the GPU driver and unplugged/plugged the DP cable I have running to my monitor. Those were two "solutions" I had found browsing this issue before I made this thread. Neither work.