Windows Explorer is crashing repeatedly across more than 30 computers, which causes the taskbar to disappear. The problem also appears on newly imaged machines. Event Viewer reports an Application Error, Event ID 1000, with Windows.UI.Xaml.dll listed as the faulting module and exception code 0xc000027b. All systems are running fully patched Windows 11. The issue can take days or weeks to return, making it difficult to reproduce or capture with Procmon. What should we investigate?
4 Answers
Check the machine identities as well. Duplicate SIDs have been associated with XAML-related Explorer crashes in some environments, so verify that imaging and generalization are being done correctly and that every deployed system receives a unique identity.
This may be related to a Windows update that is stuck or still processing in the background. Rebooting appeared to clear it temporarily in one environment, and that could also explain why freshly imaged systems are affected while updates finish installing. If the crashes return later, though, you may need to correlate them with update history and collect diagnostics for Microsoft.
I would check security software first. Review the EDR or antivirus logs for activity around the crashes, and if possible test a machine without the security agent installed. If that changes the behavior, involve the vendor. It is also worth building a barebones Windows installation and adding applications one at a time to identify a software conflict.
If the affected machines share a model or hardware configuration, investigate drivers and firmware. Run the manufacturer's update utility and compare graphics, chipset, and other system drivers between affected and unaffected devices. Systems upgraded from Windows 10 may also have leftover compatibility issues that do not appear on a completely clean installation.
That is the frustrating part—the reboot only seems to help temporarily. The crash can come back days or weeks later, and I haven't found a reliable action that triggers it, so collecting a Procmon trace has been difficult.