This has been bothering us for months. Every time one of our users went to use their Surface Pen on their Surface Pro 7 in OneNote, their screen would flash black. At times, it would disconnect them from Miracast. Sometimes the entire device would freeze requiring a forced reset. Other times, Teams would crash in the background and black out requiring a forced quit via task manager. All of these issues were caused by using the pen. We have over 100 Surface devices in our environment (school), all with this problem.
After weeks of digging and trial and error (with growing frustration amongst staff), I narrowed it down to a DWM.exe crash (as reported in event viewer):
Faulting application path: C:\WINDOWS\system32\dwm.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
As far as I can tell, this being caused by an incompatible Intel Iris Graphics driver that installed itself as part of the 2004 or 20H2 update.
This is the solution that has worked for us on our Surface devices (I'm not sure if this will work on other devices, but I would certainly recommend trying the removal of the Intel Iris Driver and reinstalling the driver on the support website of the device you are using):
On one device (I have scripts for SCCM below as we had to patch this issue in bulk):
Open control panel and uninstall any Surface Pro 7 Updates.
Navigate to the Surface Pro 7 drivers download page. Download the latest driver package but do not install yet.
Open device manager and locate Intel Iris Graphics under display adapters. Uninstall and delete the driver (the display will go black and everything will go tiny or huge, this is normal!).
When the driver uninstall is complete, install the driver package which was downloaded. It will take about 5 minutes and the screen will flash back and return to normal as the Intel Iris driver is reinstalled.
Reboot the machine.
In bulk (this was tricky to figure out):
The below batch file and powershell script will automate the above and so can be used with SCCM.
Save in a batch file:
msiexec /x {AA26C76B-D228-43FF-87FC-842F5345A910} /q
TIMEOUT 5 /nobreak
msiexec /x {5A867CF1-0AA2-4AA5-B424-11F49C66DB45} /q
TIMEOUT 5 /nobreak
msiexec /x {D4802CD5-4E1E-4FA5-BC63-DB99D5EC8DA3} /q
TIMEOUT 5 /nobreak
msiexec /x {5F97074F-E0DB-4DD5-BDC5-FBE3BADBF2AC} /q
TIMEOUT 5 /nobreak
powershell.exe Set-ExecutionPolicy RemoteSigned
powershell.exe -file "uninstalldriver.ps1"
TIMEOUT 20 /nobreak
msiexec /i "SurfacePro7_Win10_18362_20.101.8580.0.msi" /q /norestart
TIMETOUT 20 /nobreak
copy OneNote_Blackscreen_Patched C:\
shutdown.exe /f /r /t 60 /c "The patch is complete. Your Surface Pro will force restart in 60 seconds automatically. Please save any opened work or restart manually if nothing of importance is open." /d p:4:1
Ensure that in the path you run this script, you have a txt file called OneNote_Blackscreen_Patched.txt (I used this for the detection method for the SCCM application deployment). You should also have the latest Surface Pro 7 update package which in our case is SurfacePro7_Win10_18362_20.101.8580.0.msi. You must also have the below powershell .ps1 file:
$oemfiles = gci c:\windows\inf\oem*.inf
foreach($file in $oemfiles){
if(get-content $file | select-string -pattern 'igfx' -SimpleMatch)
{pnputil /uninstall /delete-driver $file.name /force}
}
Running the batch file automates the whole process.
I hope this helps other IT admins that have been dealing with this issue for as long as we have. Such relief to finally have a solution.