Windows 10 ShellExperienceHost crashes

Question

I recently cloned my Windows 10 partition from HDD to SSD.

I cannot open the Start Menu, Notifications, or anything that uses ShellExperienceHost. This includes things like the Calculator app, Edge browser and the metro style right click menu when you right click on an app in the taskbar.

Every time I try to open one of these, I get an error in the event log:

Faulting application name: ShellExperienceHost.exe, version: 10.0.10240.16515, time stamp: 0x55fa599a
Faulting module name: Windows.UI.Xaml.dll, version: 10.0.10240.16548, time stamp: 0x56133a14
Exception code: 0xc0000409
Fault offset: 0x0000000000533ad2
Faulting process id: 0x39ac
Faulting application start time: 0x01d18ad380a6bb12
Faulting application path: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Faulting module path: C:\Windows\System32\Windows.UI.Xaml.dll
Report Id: 61c0dd6c-b61f-42e5-9130-ecfa1fa87cac
Faulting package full name: 
Faulting package-relative application ID: 

If I open ShellExperienceHost.exe using WinDbg, I get the following output:

CommandLine: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*c:\symbols*https://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*https://msdl.microsoft.com/download/symbols
Executable search path is: 
ModLoad: 00007ff7`70830000 00007ff7`70a03000   ShellExperienceHost.exe
ModLoad: 00007ff9`b66f0000 00007ff9`b68b2000   ntdll.dll
ModLoad: 00007ff9`b4800000 00007ff9`b48ad000   C:\Windows\system32\KERNEL32.DLL
ModLoad: 00007ff9`b3bc0000 00007ff9`b3d9d000   C:\Windows\system32\KERNELBASE.dll
ModLoad: 00007ff9`b44b0000 00007ff9`b472c000   C:\Windows\system32\combase.dll
ModLoad: 00007ff9`b48b0000 00007ff9`b494d000   C:\Windows\system32\msvcrt.dll
ModLoad: 00007ff9`b4370000 00007ff9`b4496000   C:\Windows\system32\RPCRT4.dll
ModLoad: 00007ff9`b4220000 00007ff9`b4361000   C:\Windows\system32\ole32.dll
ModLoad: 00007ff9`b3f90000 00007ff9`b3feb000   C:\Windows\system32\sechost.dll
ModLoad: 00007ff9`93300000 00007ff9`9336a000   C:\Windows\SYSTEM32\wincorlib.DLL
ModLoad: 00007ff9`b6330000 00007ff9`b63ee000   C:\Windows\system32\OLEAUT32.dll
ModLoad: 00007ff9`b61a0000 00007ff9`b6326000   C:\Windows\system32\GDI32.dll
ModLoad: 00007ff9`b3ff0000 00007ff9`b413e000   C:\Windows\system32\USER32.dll
(4910.46c8): Break instruction exception - code 80000003 (first chance)
ntdll!LdrpDoDebuggerBreak+0x30:
00007ff9`b67ae510 cc              int     3
0:000> gn
ModLoad: 00007ff9`b4730000 00007ff9`b4766000   C:\Windows\system32\IMM32.DLL
ModLoad: 00007ff9`b4b10000 00007ff9`b4c6c000   C:\Windows\system32\MSCTF.dll
ModLoad: 00007ff9`b2ff0000 00007ff9`b3021000   C:\Windows\system32\nvinitx.dll
ModLoad: 00007ff9`b63f0000 00007ff9`b6496000   C:\Windows\system32\ADVAPI32.dll
ModLoad: 00007ff9`b2fe0000 00007ff9`b2fea000   C:\Windows\SYSTEM32\VERSION.dll
ModLoad: 00007ff9`b3170000 00007ff9`b317f000   C:\Windows\system32\kernel.appcore.dll
ModLoad: 00007ff9`b2ed0000 00007ff9`b2f3b000   C:\Windows\SYSTEM32\bcryptPrimitives.dll
ModLoad: 00007ff9`b6570000 00007ff9`b6615000   C:\Windows\system32\clbcatq.dll
ModLoad: 00007ff9`75130000 00007ff9`76126000   C:\Windows\System32\Windows.UI.Xaml.dll
ModLoad: 00007ff9`aeaa0000 00007ff9`aebd1000   C:\Windows\SYSTEM32\wintypes.dll
ModLoad: 00007ff9`b0b30000 00007ff9`b0bf8000   C:\Windows\System32\CoreMessaging.dll
ModLoad: 00007ff9`92ba0000 00007ff9`92c06000   C:\Windows\System32\Bcp47Langs.dll
ModLoad: 00007ff9`a8c10000 00007ff9`a8f86000   C:\Windows\System32\iertutil.dll
ModLoad: 00007ff9`b32a0000 00007ff9`b3353000   C:\Windows\system32\shcore.dll
ModLoad: 00007ff9`b0ad0000 00007ff9`b0b2c000   C:\Windows\System32\NInput.dll
windows\dxaml\xcp\dxaml\lib\frameworkapplication_partial.cpp(136)\Windows.UI.Xaml.dll!00007FF97563E864: (caller: 00007FF770885394) FailFast(1) tid(46c8) 8000FFFF Catastrophic failure
(4910.46c8): Security check failure or stack buffer overrun - code c0000409 (!!! second chance !!!)
Windows_UI_Xaml!wil::details::ReportFailure+0x1dee4a:
00007ff9`75663ad2 cd29            int     29h

I have already tried:

• Dism /Online /Cleanup-Image /ScanHealth

• Dism /Online /Cleanup-Image /CheckHealth

• Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

• Deleting %LOCALAPPDATA%\TileDataLayer\Database and rebooting

• Creating a new user

Short of refreshing Windows 10 and losing all my installed programs (I have a dev environment installed that would take a long time to replace), is there anything else I can try?

I am getting by with replacing the Windows Start Menu with Classic Shell, but it is quite annoying not being able to see the notifications area.

Solution 1

After months of trying to fix this, I was finally able to by downloading a .img (like a .iso) file for Windows 10 for the exact build number that I had installed (Build 10240).

Once I had the right .img file, I was able to use it to do an in-place upgrade to the same version. Trying to do the same in-place upgrade to the latest version kept failing at 40% with error 0xC1900101-0x30018.

My start menu, notification center and Edge are all functional again.

Thanks to @magicandre1981 for all your help.

Solution 2

I've been struggling with this for days and went through hundreds of pages of solutions. Nothing worked, until I hit this page, where at page 22 user PaulSturm recommended to run a repair using Tweaking.com - Windows Repair Free/Pro.

I was obviously very suspicious of this, but quite a few people said it worked for them and I was willing to try anything after spending so much time with this, thanks to Microsoft's despicable support.

You will need to install it, start the application, restart in safe boot mode when it asks and then run the default selected repairs. No need for the pre-scan, sfc scan or anything outside the repairs section (other than the strongly recommended backup and system restore point). It took about 20 minutes for me but everything was back to normal after a restart following the repairs. I don't know exactly which fix did it, but it's the ONLY thing that worked for me.

Again, I don't expect you to trust me on this, but there are quite a few people on that Microsoft page that vouch for it. Make sure you're comfortable with using this and do make a backup and a system restore when asked.

Solution 3

Looking deeper at the problem, I was getting this error in the event log every time I clicked on the start menu

Faulting application name: ShellExperienceHost.exe, version: 10.0.10586.306, time stamp: 0x571afaa5
Faulting module name: Windows.UI.Xaml.dll, version: 10.0.10586.306, time stamp: 0x571af9f6

This event would appear after every time I clicked the Start Menu. I ran Process Monitor from SysInternals, clicked the Start Menu, and saw that ACCESS DENIED was showing for the User Accounts Package settings.dat for ShellExperienceHost. This file is located under:

%localappdata%\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\

(localappdata is the environmental variable for C:\Users\USERNAME\AppData\Local\)

I deleted the settings.dat file, clicked on Start Button, and it still wouldn't open due to settings.dat being deleted. So I renamed Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy (the entire folder) to .old and reinstalled the ShellExperienceHost UI App using the following PowerShell Command from an elevated PowerShell Window:

Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\AppXManifest.xml"}

This then reinstalled the Local Package for my user profile, putting settings.dat back in place. Now no more errors and start menu is now working.

Solution 4

From the dump I can see that you get an Access denied error:

Stowed Exception Array @ 0x00000047c99904e0

Stowed Exception #1 @ 0x00000047c9999868
    0x80070005 (FACILITY_WIN32 - Win32 Undecorated Error Codes): E_ACCESSDENIED - General access denied error

    Stack    : 0x47c9998058
        7ffd96e11dd4 Windows_UI_Xaml!DirectUI::ActivationAPI::ActivateInstance+0x2cf304
        7ffd96c5a4c3 Windows_UI_Xaml!DirectUI::NavigationCache::LoadContent+0x6b
        7ffd96c5a045 Windows_UI_Xaml!DirectUI::NavigationCache::GetContent+0xa1
        7ffd96c5ab4f Windows_UI_Xaml!DirectUI::Frame::PerformNavigation+0xcf
        7ffd96c59e89 Windows_UI_Xaml!DirectUI::Frame::StartNavigation+0x29
        7ffd96c5aa24 Windows_UI_Xaml!DirectUI::Frame::NavigateImpl+0x15c
        7ffd96c5a889 Windows_UI_Xaml!DirectUI::FrameGenerated::Navigate+0x89
        7ffd96c58f4b Windows_UI_Xaml!DirectUI::Frame::NavigateImpl+0x4b
        7ffd96c58ec5 Windows_UI_Xaml!DirectUI::FrameGenerated::Navigate+0x75
        7ffd96c58ced Windows_UI_Xaml!DirectUI::Frame::NavigateImpl+0x41
        7ffd96c58c71 Windows_UI_Xaml!DirectUI::FrameGenerated::Navigate+0x71
        7ffd9677349d Windows_UI_ActionCenter!ActionCenter::App::StaticInitialize+0x55d
        7ffd96772dd3 Windows_UI_ActionCenter!ActionCenter::App::StaticOnLaunched+0x3f
        7ffd96772d7b Windows_UI_ActionCenter!?Invoke@?$__abi_FunctorCapture@V<lambda_237858d95a404202aa0a218454e40d6e>@@X$$$V@Details@Platform@@UEAAXXZ+0x4b
        7ffd967712e9 Windows_UI_ActionCenter!?__abi_Windows_UI_Core_DispatchedHandler___abi_IDelegate____abi_Invoke@?Q__abi_IDelegate@DispatchedHandler@Core@UI@Windows@@2345@UE$AAAJXZ+0x2d
        7ffdaaab3e6c Windows_UI!Windows::UI::Core::CDispatcher::ProcessInvokeItem+0x23c
        7ffdaaab5a54 Windows_UI!Windows::UI::Core::CDispatcher::ProcessMessage+0x1a4
        7ffdaaab57c2 Windows_UI!Windows::UI::Core::CDispatcher::WaitAndProcessMessages+0x1a2
        7ffdaaab5598 Windows_UI!Windows::UI::Core::CDispatcher::ProcessEvents+0xa8
        7ffd96d403bd Windows_UI_Xaml!CJupiterWindow::RunCoreWindowMessageLoop+0x65
        7ffd96d40343 Windows_UI_Xaml!DirectUI::DXamlCore::RunMessageLoop+0x47
        7ffdc64ba306 twinapi_appcore!Windows::ApplicationModel::Core::CoreApplicationView::Run+0x46
        7ffdc64d6490 twinapi_appcore!Microsoft::WRL::Details::MakeAndInitialize<Windows::ApplicationModel::Core::CoreApplicationViewAgileContainer,Windows::ApplicationModel::Core::CoreApplicationViewAgileContainer,enum Windows::ApplicationModel::Core::CoreApplicationViewAgileContainer::WindowType,Windows::ApplicationModel::Core::IFrameworkViewSource * __ptr64 & __ptr64,HSTRING__ * __ptr64>+0x1a4
        7ffdc7cb80c0 SHCore!CSimpleHashTable<unsigned long,Microsoft::WRL::ComPtr<CStreamWriterTimeoutManager::CTimerIdAndWriters>,CDefaultHashPolicy<unsigned long>,CDefaultKeyCompare<unsigned long>,CDefaultResizePolicy,CDefaultRehashPolicy>::RemoveAll+0x128
        7ffdc9582d92 kernel32!BaseThreadInitThunk+0x22
        7ffdcb119f64 ntdll!RtlUserThreadStart+0x34

To see which file/registry key can't be accessed, run ProcessMonitor, filter for ShellExperienceHost.exe and look in the Result column which operation fails with an Access denied error.

Also try to run this update which repairs the ACL which also can cause the errors.

View more solutions

Comments

[Moab]

Sometimes waiting for the next build of windows via windows update cures issues, you might struggle with it until then, see if the next build corrects the issue. I consider W10 Beta software and is not stable on all hardware configurations.

[Ramhound]

What build are you know precisely?

[Ramhound]

I suggest just try cloning the HDD again

[cybernard]

This might work. In the APPDATA folder is a folder that starts with the name Tiled something. Delete it and reboot, and see if that helps.

[Eddie Fletcher]

@cybernard Oh sorry I forgot that I had already tried deleting the AppData\Local\TileDataLayer folder.

[cybernard]

I just created a new user, and copied over the important files, deleted the old user, and renamed the new user. You could go folder by folder to figure it out, but its a time sink.

[Eddie Fletcher]

I just tried creating a new user but they have the same issue.

[magicandre1981]

share the dmp file (compressed as zip on OneDrive) and I'll ask my Microsoft contacts.

[Eddie Fletcher]

@magicandre1981 oh thank you! Here it is, hopefully I've done this right: onedrive.live.com/…

[magicandre1981]

this is a mindump which doesn't really help.the only thing I see is that you still use the July 2015 version. Try the November Version 1511. If you also get issues here, capture a full dump msdn.microsoft.com/en-us/library/bb787181%28VS.85%29.aspx

[Eddie Fletcher]

@magicandre1981 I have been unable to upgrade my windows 10 version. It keeps running in to this error, tried all suggestions but still no luck: bit.ly/267Zm5C. Anyway, I managed to get it producing full dumps. Here's the link to the dump produced when trying to open the Wireless Networks list from tray icon: onedrive.live.com/…

[magicandre1981]

Error 0xC1900101 - 0x30018 = Means that the Windows upgrade failed after the first restart. Some of the drivers in the driver set of the image are incompatible during the PNP Specialization phase. Resolution Update the drivers and firmware on the computer to the latest versions. If you have any device installed that you're not regularly using, we recommend that you remove the device drivers from the computer. To do this, open Program and Features, find the entries that are related to the driver, and uninstall them. support.microsoft.com/en-us/kb/3107983

[magicandre1981]

were you able to see which operation fails with access denied?

[Eddie Fletcher]

@magicandre1981 no I wasn't able to see any access denied messages. Tried a blanket windows permissions reset tool but that didn't help. Here's the Procmon log if it helps: onedrive.live.com/…

[magicandre1981]

please share the unfiltered trace where I can see the activity of the whole system

[Eddie Fletcher]

@magicandre1981 sure thing: onedrive.live.com/…

[magicandre1981]

Microsoft was never able to see anything in the files. try the version 1607 (Build 14393) and look if it works now

[tvt173]

See also here superuser.com/questions/1067681/…

[Eddie Fletcher]

That ACL update sounded promising but did not fix the issue. Thank you though.

[StingyJack]

I had to muck a bit with these steps but I have a start menu again. (The creators update was required for VS UWP, which is what broke this for me)

[Joel Coehoorn]

If I run the first part of that (before the pipe), assign the results to a variable, and then look at the returned packages. ShellExperienceHost is not one of them.

[Dan M.]

+1. For me NO approach really worked. Even this. BUT, doing windows upgrade-repair via MCT restores shell* functionality partially: Cortana and ShellExp* still were reported as broken by troubleshoot manager and search didn't work, but at least the start menu showed up. At this point the windows repair tool worked and fixed the problem. It didn't work before I did repair-upgrade.

[Laurie Stearn]

Also an issue with explorer and system handles on the folder. Restarting Explorer isn't best practice. This looks like a potential Mr Fixit script for M$S. :Hollers: Mr.Fixit! Why have you abandoned us?!

[Laurie Stearn]

But it worked after a reboot without the folder rename at any rate! Thanks

[Laurie Stearn]

The error came in with one of the post 1709 updates. From this thread it's an issue not update version specific, but something likely wrong with the configuration of the current user.

[tukan]

This fixed both shellexperence host and action center and some minor issues. Still working today.

[Abdalrhman Hussin]

Begrudgingly (shared same suspicions), this program fixed the problem for me. I ran it without safe mode, as safe mode was also broken (blurred image on login screen, no password box). The problem was fixed immediately without restarting, after it had completed the first 5 repairs. For me, the issue initially occurred after a RAM stick went bad, and it was isolated to the Action Center (notifications popout thing) not working, I did not have the issue with start menu, calculator etc described by the original poster.