A few users connecting to a Windows Server 2025 Citrix server through RDP receive a black screen with a movable cursor, and the desktop never appears. Other accounts can connect normally, and logging in through the vSphere console works.
I have already deleted the affected profiles, removed related registry keys and leftovers, terminated their sessions and processes, rebooted the server, disabled UDP, WDDM, and network detection through local policy, changed the display resolution, and disabled persistent bitmap caching. None of these steps resolved the problem.
Ctrl+Alt+End works and displays the security screen, so the user can log off, but Task Manager will not open. Event Viewer shows Event ID 1000, where ctfmon.exe crashes in InputService.dll with error 0xc0000409, followed by Event ID 29 indicating that access to spell-checking settings is denied. It also appears that explorer.exe never starts for the affected accounts.
The problem seems limited to a small group of users who previously connected successfully. I suspect a stale or damaged session left behind by an improper RDP logout, but terminating the visible processes has not helped. What else should I check or repair?
3 Answers
This could still be a ghost or hung session that is not being cleared by simply killing the user processes. Check the server for disconnected sessions and terminate them explicitly with the session ID using commands such as query session and logoff. A stuck application can also keep the session from completing its cleanup; Adobe Reader and the Print Spooler have both caused similar behavior in some environments.
Because the event log shows ctfmon.exe crashing inside InputService.dll, the operating system component files may be damaged. Run sfc /scannow, followed by DISM /Online /Cleanup-Image /RestoreHealth, then reboot the server and test again. A similar black-screen-after-RDP-login problem was resolved by repairing the system image this way.
I saw the same pattern after a recent Windows update. Repairing the component store with DISM and then running SFC fixed the affected machine, so it is worth trying before rebuilding profiles again.
Since the failure appears to follow particular user accounts and explorer.exe does not launch, the per-user profile or shell configuration may still be damaged even after deleting the profile. Compare the affected accounts with a working account and check the user shell and logon-related registry values. Also confirm that no policy, profile-management setting, or logon script is preventing explorer.exe from starting. The spell-checking error may be a side effect rather than the root cause.
That matches what I am seeing: Ctrl+Alt+End works, but the desktop shell never starts. I will compare the affected users' shell and logon settings with an unaffected account.
I had already killed the obvious processes and rebooted, but I will check for disconnected sessions by ID rather than relying only on process termination. The issue is limited to a few accounts that previously worked.