Windows Server 2025 DC User Logon Problems

Hi Jeff, what you’re describing is a known post‑promotion issue where the server services continue to run but the interactive logon shell fails to load. On Windows Server 2022/2025 this is most often tied to the “black screen with cursor” condition caused by either a corrupted profile initialization, a stuck explorer.exe launch, or a GPU/display driver conflict after the role change. Since AD, DNS, and replication are functioning, the OS kernel and services are fine; the problem is isolated to the Winlogon/UI stack.

The first thing to try is booting into Safe Mode with Networking and checking whether the desktop loads. If it does, disable or update the display adapter driver and confirm that explorer.exe is set correctly under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell. Also check that the Userinit value points to C:\Windows\system32\userinit.exe,. If Safe Mode shows the same black screen, you’ll need to enable RDP with administrative credentials and run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to repair system files.

If none of these steps restore the shell, the issue is likely tied to the promotion process itself. In that case, you should open a case with Microsoft Support, as there are documented instances where post‑promotion registry corruption or lingering GPO settings prevent the interactive shell from loading on Server 2025 DCs. Until resolved, the server will continue to function as a DC, but interactive logon will remain broken.

If it's helpful to you, please give it a thump up or Accept the answer, appreciate it :)

Harry.

Windows Server 2025 domain controllers can show symptoms where core DC services work (AD, DNS, replication, file shares) but interactive logon and some remote management tools fail or hang. One known, recently fixed issue affects Windows Server 2025 DCs after restart: the wrong firewall profile is applied, which can break or partially block RDP and management connectivity.

On Windows Server 2025 domain controllers, after a restart the server can incorrectly use the standard firewall profile instead of the domain firewall profile. This can cause:

• Remote Desktop to connect but hang or appear unusable
• Remote management tools (like Event Viewer or Server Manager) to fail to connect
• Services on the DC to be reachable in unexpected ways, or blocked when they should be allowed

In this state, AD DS and DNS can still function, so the DC appears healthy from a directory perspective, but interactive logon and management are impaired.

To restore expected behavior on an affected DC:

1. Restart the network adapter on the Windows Server 2025 DC. For example, from an elevated PowerShell session on that server (locally or via remote PowerShell):

      Restart-NetAdapter *
   

   This forces the correct domain firewall profile to be applied and typically restores normal connectivity and management behavior.
2. Because the issue reoccurs every time the DC is restarted on affected builds, configure an automated workaround until the permanent fix is installed. For example, create a scheduled task that runs at startup to execute Restart-NetAdapter * so the adapter is restarted automatically after each reboot.
3. Install the June 2025 Windows security update or later on the Windows Server 2025 DC. The issue is fully resolved in:
   • KB5060842 (OS Build 26100.4349) and later updates.
   After installing KB5060842 or a newer cumulative update and rebooting, the DC will correctly apply the domain firewall profile on startup and the workaround (adapter restart) is no longer required.

Summary of recommended actions for the described symptoms:

• On the affected Windows Server 2025 DC, restart the NIC (Restart-NetAdapter *) to immediately restore proper behavior.
• Implement a startup scheduled task to restart the NIC after each reboot if running a pre‑KB5060842 build.
• Patch the server to at least the June 2025 security update (KB5060842) so the problem is permanently fixed.

References:

• Resolved issues in Windows Server 2025