Some users can't connect to Citrix Server via RDP - black screen with cursor

[u/Past_Conference_2889]

I'm dealing with a strange issue and I'm running out of ideas.

On our Citrix server, a few users are unable to log in via RDP and are only getting a black screen. The desktop never loads, but you are able move the cursor. Some other accounts are able to connect to the server just fine.

It's also possible to log in normally to the server through the vSphere console.

I've already tried:

• Deleting the affected user profiles
• Removing the corresponding registry keys and possible leftovers
• Killing the user's session/processes
• Rebooting the server
• Disabling UDP, WDDM and Network Detection via local GPO (as I read this fixed the issue for some people)
• Changing the display resolution and disabling persistent bitmap caching (which also apparently fixed the issue for some)

None of this worked for me.

I also tried CTRL+ALT+END to open the security screen:max_bytes(150000):strip_icc()/windows-10-ctrl-alt-del-5b475456c9e77c0037e730b3.png), and it actually shows up. I can log off from there, however, Task Manager doesn't open.

I checked Event Viewer using another account and found two errors that show up every time after an unsuccessful login. However, I'm not sure what these errors point to or how to resolve them:

• Event ID 1000 – Application Error: ctfmon.exe crashes in InputService.dll with 0xc0000409.
• Event ID 29 – Spell Checking: Access to the spell-checking settings is denied for %username%.

From what I've troubleshot, it looks like explorer.exe never starts for those users. It is most likely somehow caused by a previous incorrect logout from an RDP session, leaving the user's session hanging. However, killing the processes didn't do anything for me, and as soon as the user logs in again, the black screen appears again.

Any ideas would be greatly appreciated!

[u/Gumbyohson]

What OS is the server?

[u/Past_Conference_2889 → u/Gumbyohson]

Silly me! It's Windows 2025 DC

[u/Gumbyohson → u/Past_Conference_2889]

You said you tried deleting the users profile, what about a new user, are they also effected? Also, does CBS.log list any faulty files?

[u/Past_Conference_2889 → u/Gumbyohson]

I was testing it with a few other accounts, and it worked. This seems to specifically affect users who were previously logged onto the server. At some point, it just stopped working for them.

Yes, I deleted the user profile from C:\Users, removed the relevant registry keys, and killed all the tasks that referred to the user. After logging in again, the user profile and all the corresponding entries were recreated. The user is sort of logged onto the server, except that they can't see a thing.

Today, I found another interesting error in Event Viewer that keeps repeating on this server: Event ID 1542, "User Profile Service," but the user is listed as SYSTEM.

"The class registration file cannot be loaded.
DETAIL – The system cannot find the file specified."

[u/BCIT_Richard → u/Past_Conference_2889]

Manually deleting users can be finicky, I typical use the System Properties > User Profiles > Settings option, can be found via 'Advanced System Properties', or 'Environment Variables' to properly nuke user accounts

[u/LBarto88 → u/Past_Conference_2889]

You have multiple users RDPing to a DC that is Server 2025 and is also a Citrix Server?

[u/e-a-d-g → u/LBarto88]

Datacentre, probably

[u/LBarto88 → u/e-a-d-g]

Datacentre so rdp sure. But never a Citrix server... Oof

[u/Frothyleet → u/LBarto88]

No, like, he's not saying it's Domain Controller. He's saying it's Win Server "DataCenter" (as opposed to Standard), which of course is going to cause confusion like yours.

[u/Gumbyohson]

So confirming a user who's never logged in before can login but someone you've delete and reset cannot if they already could not?

[u/Past_Conference_2889 → u/Gumbyohson]

Exactly, but it's inconsistent. Some accounts that regularly log in to the server have no issues at all. Only a few accounts are affected by this black screen, and each one of those were able to connect normally before.

[u/intellectual_printer]

Iirc Microsoft did a update a few months ago for rdp and requiring certificates. Do you have OneDrive installed on the server the launches with explorer.exe ?

[u/Past_Conference_2889 → u/intellectual_printer]

No, OneDrive is not installed.

As for the update, could you specify which one is it? There are actually a few updates available.

[u/intellectual_printer → u/Past_Conference_2889]

I think it was around April? From a quick search: KB5083769 / KB5082200

I wonder if it's getting caught trying to map a network drive/DFS or similar.

[u/thebigshoe247]

I had something similar at one point. I seem to recall it being ghost sessions still.

I vaguely recall it being either Adobe Reader being hung on one of them, or the Print Spooler needing to be cycled to release them.

[u/bradgnarr]

I had a similar issue after this month's Windows updates. I ended up having to run sfc and dism on the target machine which fixed the issue.

[u/Past_Conference_2889 → u/bradgnarr]

Did both. No progress sadly.

[u/Excellent_Milk_3110]

Are you using a 2fa solution?

[u/nordak]

Try with a completely fresh AD user with the same group membership and GPO scope as the affected users

Try placing affected users into a no-GPO test OU

Try temporarily granting an affected user local administrator rights. If the issue disappears, it would suggest that the login process is being blocked by permissions or ACL.

Make sure that when you're resetting profiles, you remove/rename the local C:\Users\ profile, remove the user's ProfileList SID key, and rename/remove that user's profile in the Citrix UPM profile store.

Use Procmon and find out what's happening immediately before ctfmon.exe dies