Nothing on task bar works or opens, runs WerFault.exe if anything is clicked

Question

Windows 10, fully up to date - Version 1511 (OS Build 10586.0)

Cannot open Start Menu, Cortana, Volume Controls, Notifications - anything on the task bar.

This issue was caused by:

1) explorer.exe being terminated one time, yesterday

I have tried every fix available through standard searches. Everything included here has been tried.

I can see any time I click anything on the task bar, a WerFault.exe runs, which is "Windows Error Reporting", but this is only through watching Taskmanager, as nothing actually comes up when I click anything.

I can't even right-click non-Windows applications on the task bar, such as right-clicking a Chrome window to close it or whatever else.

If attempting to open Start Menu, Event Viewer generates 5 events:

1) Faulting application name: ShellExperienceHost.exe, version: 10.0.10586.0, time stamp: 0x5632d93d

2)

Fault bucket 133232457255, type 5
Event Name: MoAppCrash
Response: Not available
Cab Id: 0

3)

Faulting application name: SearchUI.exe, version: 10.0.10586.0, time stamp: 0x5632d66d

4)

Activation of app Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App failed with error: The app didn't start. See the Microsoft-Windows-TWinUI/Operational log for additional information.

5)

Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: The app didn't start. See the Microsoft-Windows-TWinUI/Operational log for additional information

As-is this is too broad, IMO; we need more information. Have you looked in the Event Logs yet? How about as the Problem Reports in the Control Panel? They should give you information that WerFault collected, hopefully pointing to the cause of your error. — Ƭᴇcʜιᴇ007, Apr 20 '16 at 14:03
Version 1511 (OS Build 10586.0). It generally wouldn't be possible to try every presently available troubleshooting method without several reboots. — pay, Apr 20 '16 at 14:03
`10586.0` **IS NOT** the current Windows 10 build. It is `10586.218` as of April 12th 2016. Which means your missing about 5-6 months of updates, basically every update, since Nov 2015. At the very least you should be at 10586.3 since that was the day 1 patch for that build. — Ramhound, Apr 20 '16 at 14:03
I am not running preview builds. This seems to be what you're referring to. — pay, Apr 20 '16 at 14:08
@user1438893 - I am not talking about Insider Preview builds. Take a look at my answers the last 15 months, almost all of them, have been about Windows 10. Your system if its running 10586.0 is missing updates, several months worth of updates, there is no other explanation. [KB3147458](https://support.microsoft.com/en-us/kb/3147458) brought Windows 10 to build [10586.218](http://www.neowin.net/news/microsoft-releases-windows-10-for-pcs-build-10586218) which was released last week. — Ramhound, Apr 20 '16 at 14:10
If you attempt to boot into safe mode do these errors still happen? Can you confirm when the last update was installed or does Windows Update also crash? — Ramhound, Apr 20 '16 at 14:13
Booting in safe mode produces the same results. The last updates appear to have been installed on the 13th. The last check for updates was today (just now) — pay, Apr 20 '16 at 14:33
Can you run `winver` that should provide you the actual build number. — Ramhound, Apr 20 '16 at 15:09
create a crash dump: http://pastebin.com/tU3Agf5M and share the compressed dmp file. — magicandre1981, Apr 20 '16 at 15:35
@user1438893 - Which means you are missing several dozen cumulative updates. — Ramhound, Apr 20 '16 at 15:39
@magicandre1981 just for the record, the .reg file to stop creating local dumps doesn't work. I deleted the entry manually anyway. The dump file is located here: https://www.dropbox.com/s/7ixd9e69simadws/ShellExperienceHost.exe.7224.dmp.7z?dl=0 — pay, Apr 20 '16 at 15:47
Also just manually downloaded an update, @Ramhound my build number is now **10586.218** — pay, Apr 20 '16 at 15:59
See also here http://superuser.com/questions/1059411/windows-10-shellexperiencehost-crashes — Matthew Lock, Oct 18 '16 at 07:39

magicandre1981 · Answer 1 · 2016-05-13T14:52:55.693

2

The dump shows an Access Denied error:

Stowed Exception Array @ 0x00000095c833dae0

Stowed Exception #1 @ 0x00000283e6810138
    0x80070005 (FACILITY_WIN32 - Win32 Undecorated Error Codes): E_ACCESSDENIED - General access denied error

    Stack    : 0x283e6815780
        7ff9d4c11734 combase!RoOriginateError+0x54
        7ff9cfd93f20 wincorlib!Platform::Details::ReCreateException+0x90
        7ff9cfdbcfb7 wincorlib!__abi_WinRTraiseAccessDeniedException+0x17
        7ff7f577b306 ShellExperienceHost!__abi_WinRTraiseException+0xca
        7ff7f5746374 ShellExperienceHost!Windows::UI::Xaml::Application::Start+0x94
        7ff7f57462d0 ShellExperienceHost!main+0x40
        7ff7f574a82e ShellExperienceHost!_main+0xa6
        7ff7f574a041 ShellExperienceHost!__mainCRTStartup+0x1ad
        7ff9d3cf8102 kernel32!BaseThreadInitThunk+0x22
        7ff9d4fec264 ntdll!RtlUserThreadStart+0x34

0:000> !PDE.dse 00000095c833dae0
Stowed Exception Array @ 0x00000095c833dae0

Stowed Exception #1 @ 0x00000283e6810138
    0x80070005 (FACILITY_WIN32 - Win32 Undecorated Error Codes): E_ACCESSDENIED - General access denied error

    Stack    : 0x283e6815780
        7ff9d4c11734 combase!RoOriginateError+0x54
        7ff9cfd93f20 wincorlib!Platform::Details::ReCreateException+0x90
        7ff9cfdbcfb7 wincorlib!__abi_WinRTraiseAccessDeniedException+0x17
        7ff7f577b306 ShellExperienceHost!__abi_WinRTraiseException+0xca
        7ff7f5746374 ShellExperienceHost!Windows::UI::Xaml::Application::Start+0x94
        7ff7f57462d0 ShellExperienceHost!main+0x40
        7ff7f574a82e ShellExperienceHost!_main+0xa6
        7ff7f574a041 ShellExperienceHost!__mainCRTStartup+0x1ad
        7ff9d3cf8102 kernel32!BaseThreadInitThunk+0x22
        7ff9d4fec264 ntdll!RtlUserThreadStart+0x34

0:000> !PDE.dse 00000095c833dae0
Stowed Exception Array @ 0x00000095c833dae0

Stowed Exception #1 @ 0x00000283e6810138
    0x80070005 (FACILITY_WIN32 - Win32 Undecorated Error Codes): E_ACCESSDENIED - General access denied error

    Stack    : 0x283e6815780
        7ff9d4c11734 combase!RoOriginateError+0x54
        7ff9cfd93f20 wincorlib!Platform::Details::ReCreateException+0x90
        7ff9cfdbcfb7 wincorlib!__abi_WinRTraiseAccessDeniedException+0x17
        7ff7f577b306 ShellExperienceHost!__abi_WinRTraiseException+0xca
        7ff7f5746374 ShellExperienceHost!Windows::UI::Xaml::Application::Start+0x94
        7ff7f57462d0 ShellExperienceHost!main+0x40
        7ff7f574a82e ShellExperienceHost!_main+0xa6
        7ff7f574a041 ShellExperienceHost!__mainCRTStartup+0x1ad
        7ff9d3cf8102 kernel32!BaseThreadInitThunk+0x22
        7ff9d4fec264 ntdll!RtlUserThreadStart+0x34

Run Process Monitor in background, while trying to open the startmenu or any other operation which causes the crash, and look in the Result column which operation fails with Access Denied error.

Also try to run this update which repairs the ACL which also can cause the errors.

edited May 13 '16 at 14:52

answered Apr 20 '16 at 15:54

magicandre1981

97,301
30
179
245

If I clear the list, and filter by "Access Denied", I get A LOT of `WerFault.exe`, `SearchUI,exe`, `ShellExperienceHost.exe` - That is produced by attempting to open the Start Menu - The operation on `ShellExperienceHost` before the `WerFaults` is `CreateFile` – pay Apr 20 '16 at 16:10
Sorry I meant there is a lot of `WerFault`, but only a few of the other entries – pay Apr 20 '16 at 16:13
CreateFile is a good start. Now look at the details of the CreateFle operation to see more details – magicandre1981 Apr 20 '16 at 16:16
The path on those operations is also pointing to `C:\Windows\System32\twinapi.appcore.dll` for `ShellExperienceHost` – pay Apr 20 '16 at 16:23
share the unfiltered PML file and I'll take a look myself. I think this is easier. – magicandre1981 Apr 20 '16 at 16:25
open the properties of the twinapi.appcore.dll and look in the securtiy option if your account/all apppackages an **read** and **read/run** the file – magicandre1981 Apr 20 '16 at 16:47
Ya it looks like it has normal security, Full Control and everything else checked for `Everyone` and `Administrators` – pay Apr 20 '16 at 16:51
I wrote an email at Microsoft and tell you what my contacts says about the issue. – magicandre1981 Apr 20 '16 at 17:38
Ok, I was thinking maybe I should contact them, thanks for your help so far – pay Apr 20 '16 at 17:49
ok, my contact will look at it later this week. They think this is important so leave the files on dropbox – magicandre1981 Apr 21 '16 at 04:27
Alright, here's the Process monitor log again since I removed the last comment: https://www.dropbox.com/s/rph2l2nzgk9cnoc/Logfile.7z?dl=0 – pay Apr 21 '16 at 12:38
Probably no resolution to this? – pay Apr 28 '16 at 14:28
nope. I'll send a new email. – magicandre1981 Apr 28 '16 at 15:49
ok, Microsoft says it should come from AV suite. But this is strange, because you use Defender – magicandre1981 Apr 28 '16 at 16:57
Yes that is strange, as I don't have any third party AV/Firewall etc. installed. – pay Apr 28 '16 at 17:11
exclude the file in Defender options and look what happens – magicandre1981 Apr 28 '16 at 17:17
I'll try excluding `explorer.exe`, `twinapi.appcore.dll`, `SearchUI.exe` and `ShellExperienceHost.exe` and reboot and see what happens. I suspect the actual root of the issue is much more complex than that anyway. – pay Apr 28 '16 at 18:05
what happens? do you still get crashes? – magicandre1981 Apr 29 '16 at 04:11
No, the behaviour is exactly the same – pay Apr 29 '16 at 12:52
MS told me that you should install a clean Win10 VM and compare the security permissions for the DLL. Is there a diff between the good and the bad system? – magicandre1981 Apr 29 '16 at 15:49
The security on `twinapi.appcore.dll` specifically? – pay Apr 29 '16 at 15:56
yes. I guess so. – magicandre1981 Apr 29 '16 at 16:07
I guess I'll just have to reformat, as there's certainly no difference in the security rights of any of the exe's or dll's in question here from any other install of Windows 10. I'm sure an M$ engineer would have to look at this install directly to gather any meaningful information. Thanks very much for your help. – pay Apr 29 '16 at 20:36
try to run this update: https://support.microsoft.com/en-us/kb/3152599 this repairs the ACL – magicandre1981 May 12 '16 at 18:15
I'll have to check if this works tomorrow – pay May 16 '16 at 20:58
No luck with that either! – pay May 17 '16 at 13:55
I'll forward this to Microsoft and look what they say. – magicandre1981 May 17 '16 at 15:59
My Microsoft contact is out of ideas. Phone the MS support for a deeper help. – magicandre1981 Jun 16 '16 at 04:28

score 2 · Answer 2 · answered Oct 18 '16 at 07:35

One of our Windows 10 PCs exhibited this behaviour after the anniversary update was installed. Clicking on the start menu wouldn't work. When I looked in the Event Log it said:

Faulting application name: ShellExperienceHost.exe, version: 10.0.14393.187, time stamp: 0x57cf9d73
Faulting module name: nvumdshimx.dll, version: 21.21.13.6909, time stamp: 0x579f36b5
Exception code: 0xc0000005
Fault offset: 0x0000000000051979
Faulting process id: 0x1594
Faulting application start time: 0x01d2290588da8cb1

The faulting module nvumdshimx.dll turned out to be part of an Nvidia driver installation. Once I removed the Nvidia drivers the start menu worked again.

Good info. AMD here, but the event entry posted at [Microsoft Answers](https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/start-menu-search-windows-and-action-center-dont/0a11d509-edae-4123-8f6f-d9a37c1fb477?rtAction=1513679660718) doesn't reveal anything about the cause. — Laurie Stearn, Dec 19 '17 at 14:05

Nothing on task bar works or opens, runs WerFault.exe if anything is clicked

2 Answers2

Linked