UAC Prompt Results In Black Screen After Entering Credentials (seemingly VPN related)

Posted by planedrop@reddit | sysadmin | View on Reddit | 19 comments

Hoping I can get a bit of insight here, as everything I've found on Google hasn't helped much (other than one post saying this may be GPO related but I haven't had a chance to dig on that much).  This only started happening recently, like within the last few months, but for some of my remote users that are connected via site-to-site VPNs, if they get a UAC prompt for admin to say install something, once the admin credentials are entered, the system hangs with an entire black display and then eventually times out.  It seems that things work fine shortly after a reboot and then the issue comes back, which is interesting. Also, using even a local account that has admin will not work, which in theory shouldn't even be trying to contact the DC.  Ctrl+alt+del also will bring Windows out of this stuck state but the app requesting this won't execute.  Also been seeing a few issues with users seeing errors about not being able to access redirected app data on our DC, which makes me think all of this is DC connection related BUT whenever that happens I can navigate to the UNC path just fine.  To be sure I also opened up our stricter rules for the DC to allow all ports and protocols just to troubleshoot but no dice.  gpupdate seems to work fine and DNS queries all work (and I've validated the machines are using the right DNS server), so it's almost like they both do and don't have DC connectivity?

Reply to Post

19 Comments

[-]

SenZelMyth@reddit

Just had this happen and unfortunately the user I am working with is out to lunch so locking the computer or restarting wouldn't work. I did type in my Admin password incorrect just to see if it was connecting to AD correctly. Got the "Incorrect Password" error in the UAC window then tried the correct password again and it started working with no issue. Not sure why that worked but throwing this here incase it helps someone else.

[-]

planedrop@reddit (OP)

Interesting, this is good info to have, I actually just had this issue happen on a machine again today and rebooting/relogging didn't fix it, had to actually use local admin on the device which I hate doing (as in login as local admin, not domain admin but still). I'll try doing the wrong password next time and see how it goes. I've had a few devices where the screen will go black after UAC for like 5 seconds and then work, but this one today was definitely one where it sat there for over a minute and just never did anything. "Glad" others are seeing it, sad that it doesn't seem widespread enough for MS to care.

[-]

SenZelMyth@reddit

Yeah for me it sat there and didn’t do anything. Then if I hit Ctrl+Alt+Del the process just disappeared.

[-]

planedrop@reddit (OP)

Yeah that is the exact same thing I've been seeing with my environment, nothing in logs or anything either, so bizarre.

[-]

themaxiac@reddit

Have you been able to fix this by any chance? Running into a very similar issue with one of my clients. For me the device also gets stuck on "Please wait" while trying to switch users. I've been trying to figure it out for weeks now.

[-]

planedrop@reddit (OP)

Sadly I haven't found any fix for it, though I don't think we've ever had an issue with logging in/switching users. Enable verbose login prompts (or whatever it's called) so you can see what stage it's actually stuck on.

[-]

vitabissj@reddit

did you find out what it was? We have the same issue here last few weeks

[-]

planedrop@reddit (OP)

I have not been able to get to the bottom of it yet, I thought it was maybe a DNS issue but doesn't appear to be the case.  What I can say is that it seems if I reboot a machine, I can then do admin UAC prompts for a little while without the issue appearing (sometimes as long as an entire day).

[-]

idriveacar@reddit

Any luck yet? I get the same thing even on on-prem machines.

[-]

planedrop@reddit (OP)

Still haven't been able to get to the bottom of it, it's very odd TBH. Rebooting basically always fixes it but only for a little while, then it comes back. But it also seems to be super random, I've had some devices that were doing it for a bit (months) that now haven't done it for over a month. Super sporadic so hard to troubleshoot.

[-]

idriveacar@reddit

I’m having that same sporadic issue. A buggy part is that it’ll happen, I’ll lock the computer, come back a few hours later and it doesn’t happen.

[-]

planedrop@reddit (OP)

I haven't directly tested that but wonder if I'd see the same thing.  I'll admit it's been maybe a month or so since I ran across this issue, but that's mostly because I've needed to do far less elevations recently.

[-]

idriveacar@reddit

Just for an update. The hung UAC screen happened again. Locked/Unlock, tried it again and no hang.

[-]

planedrop@reddit (OP)

OK yeah having the same issue still, completely random when it happens and sometimes a reboot solves it other times it does not. This is such frustrating behavior.

[-]

idriveacar@reddit

I want want to write it off as Microsoft doing Microsoft things but Jumping Jesus does it come up at the worst times Having the user lock and then unlock still works for me, but it’s still a band aid. I’ve experienced the same thing with rebooting not working. Even with the same user

[-]

planedrop@reddit (OP)

Yeah it's very frustrating, most of the time the lock/unlock or reboot solves it for me, this was the first time I've come across it where neither of those options worked. Maybe we'll eventually get a fix but not until people make enough noise about it. If there were logs or something that could point me to the issue that'd be nice but so far I haven't seen anything.

[-]

planedrop@reddit (OP)

Weird, if I see it again I will give that a try, that's interesting.  Gotta love Windows and it's bugs, it's so capable, but nothing ever works right lol.

[-]

Jameson21@reddit

I would do a packet capture during the problem event and see what's happening. Sounds like issues communicating with your DCs to me.

[-]

planedrop@reddit (OP)

Sounds the same to me, I'll do that and see if I find anything.  What's odd though is that gpupdate works fine, pings are exactly as expected, and SMB shares all show (from this server) just fine.  Might as well do a pcap and take a look though, good idea.