Last night, we were patching our Windows Servers and had some strange behavior on one of the servers. The server would boot up fine, but when you arrived at the log in screen most of the screen was black. The cursor was visible, but foreground and background of text and field names were all black. Many attempts were made to log in and they all failed. The Event log on the server did not provide any clues as to what was causing the problem.
At first, I suspected the hard drive was full. Servers with IIS seem to be somewhat notorious for this happening if they are not watched closely. In this case, the server runs an application that uses IIS for management and client application connectivity. Since the server was on the network, I was able to connect to the local hard drive and cleaned up several GB of IIS and Application logs. I rebooted the server, fully expecting the issue to be gone. No luck there.
When all else fails, Google is your friend…
I did a few searches on “windows login screen black” and immediately realized what I was looking at. The default color settings had been lost. I read through a few of the search results and saw a common theme: Hard drive fills up, default colors settings go away. Fortunately, these threads also talked about a fix. One of the threads linked to a Microsoft Support document, which always lends credibility to the response (no really!). The Support Document referenced was KB906510.
Important Note: This article contains steps that tell you how to modify the registry. Serious problems might occur if you modify the registry incorrectly. Check your facts, process and steps before you do any editing of the registry (look at the MS KBs). It is always a good idea to backup your registry before you make changes.
To summarize the problem, the default color settings in the registry have been changed or wiped out. These settings are contained in the registry:
HKU → .Default → Control Panel → Colors
When I went to check the settings I fond that the entire Colors subkey was gone.
Microsoft is nice enough to include a table of what they should be, however the list is long and I was not looking forward to typing them all in manually. A quick way to get around this, is to have a Windows box running the same OS and Service Pack level as the one you are working on, export that registry subkey (and ONLY that key) from it and then import into the “broken” server. Since I have over 100 Windows Servers, I was quickly able to find a suitable candidate and did just that. Once the server rebooted, everything came back up correctly. It is worth noting as well, that trying a different version of the OS, will probably not work. I tried a Windows 7 subkey first and the server locked up completely.
If you do not have a Windows box that you can export the subkey from, here is the table of keys you need to create in HKEY_USERS\.DEFAULT\Control Panel\Colors
|ActiveBorder||212 208 200|
|ActiveTitle||10 36 106|
|AppWorkSpace||128 128 128|
|Background||102 111 116|
|ButtonAlternateFace||181 181 181|
|ButtonDkShadow||64 64 64|
|ButtonFace||212 208 200|
|ButtonHilight||255 255 255|
|ButtonLight||212 208 200|
|ButtonShadow||128 128 128|
|ButtonText||0 0 0|
|GradientActiveTitle||166 202 240|
|GradientInactiveTitle||192 192 192|
|GrayText||128 128 128|
|Hilight||10 36 106|
|HilightText||255 255 255|
|HotTrackingColor||0 0 128|
|InactiveBorder||212 208 200|
|InactiveTitle||128 128 128|
|InactiveTitleText||212 208 200|
|InfoText||0 0 0|
|InfoWindow||255 255 225|
|Menu||212 208 200|
|Menubar||212 208 200|
|MenuHilight||210 210 255|
|MenuText||0 0 0|
|Scrollbar||212 208 200|
|TitleText||255 255 255|
|Window||255 255 255|
|WindowFrame||0 0 0|
|WindowText||0 0 0|
The 3 numbers i.e. 212 208 200 represent the RGB color code for that setting.
I am still a little stumped as to what circumstances would cause a full hard drive scenario to wipe out default settings. If someone happens to know the answer to that one, I would be very happy to hear.
Microsoft Support Website KB906510