UserOnce.ps1 kills explorer.exe on first logon → blank/gray desktop (no shell)

[earlyXbirdNG]

Hi,

first of all: thanks a lot for providing the unattended generator – it’s a really useful tool.

Summary

When using a generated unattend.xml on Windows 11, the first automatic logon ends in a blank/gray screen (wallpaper only, no taskbar, no desktop icons). The underlying issue seems to be that the generated UserOnce.ps1 script kills explorer.exe in the current session but does not restart it.

After the next reboot/logon the problem no longer occurs – it only affects the very first logon where UserOnce.ps1 runs.

Environment

• Windows 11 25H2 (in my case running in a VirtualBox EFI VM, but this should not be VM-specific)
• unattend.xml generated via https://schneegans.de/windows/unattend-generator/
• Auto-logon user configured (AutoLogon for a local admin)
• First logon customization via the generated DefaultUser.ps1 / UserOnce.ps1

Steps to reproduce

1. Generate an unattend.xml with the generator (including the default user customization / UserOnce scripts).
2. Use it for an unattended Windows 11 installation.
3. Let setup finish, then let the machine boot into the first automatic logon of the configured local admin.
4. A PowerShell window appears briefly with the message
   “Running scripts to configure this user account. Do not close this window.”
5. After the script finishes, the screen remains gray / just shows a gray screen:
   • No taskbar
   • No desktop icons
   • No shell

Actual behavior

• After the first automatic logon, the user is left with a gray/blank screen because explorer.exe has been terminated and not restarted.

Expected behavior

• After the first logon and completion of UserOnce.ps1, the user should see a normal desktop (explorer shell running), without having to start explorer.exe manually.

Analysis

In the generated C:\Windows\Setup\Scripts\UserOnce.ps1 the last script block looks like this:

{
    Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\SetColorTheme.ps1' -Raw | Invoke-Expression;
};
{
    Get-Process -Name 'explorer' -ErrorAction 'SilentlyContinue' | Where-Object -FilterScript {
        $_.SessionId -eq ( Get-Process -Id $PID ).SessionId;
    } | Stop-Process -Force;
};

[cschneegans]

UserOnce.ps1 indeed kills all explorer.exe processes that belong to the current user. This is to ensure that changes to certain settings take effect immediately – otherwise, the user would have to log off and on again.

Windows should automatically start a new explorer.exe process, and this process is then responsible for displaying start menu, taskbar and desktop. I have never seen this automatic restart to fail. Does the %TEMP%\UserOnce.log log file show any error messages?