Surface Pro 2017, Win 10 Pro x64: Explorer crash (Windows.UI.XamlHost.dll)

Anonymous

Hi:

I have periodic explorer crashes on my Surface Pro 2017, Win Pro x64 (it is fully updated). The crash seems to occur periodically after a Hello Windows log-in (this occurs after the computer was sleeping rather than on a fresh boot). It seems to involve Windows.UI.XamlHost.dll based on the below.

When I look in the Event viewer I see errors like this:

Event ID 1000

Faulting application name: explorer.exe, version: 10.0.16299.125, time stamp: 0xfeba44fb

Faulting module name: Windows.UI.XamlHost.dll, version: 10.0.16299.15, time stamp: 0x00f27b8f

Exception code: 0xc0000409

Fault offset: 0x0000000000001db1

Faulting process id: 0x1880

Faulting application start time: 0x01d38282e4131af4

Faulting application path: C:\WINDOWS\explorer.exe

Faulting module path: C:\Windows\System32\Windows.UI.XamlHost.dll

Report Id: 6e835576-b35e-4d24-b6ce-331b05fa2c55

Faulting package full name:

Faulting package-relative application ID:

If I click on Start > type "view all" then click on "View all problem reports Control panel" the "Windows Explorer" "Stopped working" errors and then double click on one I would get something like this:

Source

Windows Explorer

Summary

Stopped working

Date

‎11/‎26/‎2017 10:53 AM

Status

Report sent

Description

Faulting Application Path: C:\Windows\explorer.exe

Problem signature

Problem Event Name: BEX64

Application Name: Explorer.EXE

Application Version: 10.0.16299.15

Application Timestamp: 66e02565

Fault Module Name: Windows.UI.XamlHost.dll

Fault Module Version: 10.0.16299.15

Fault Module Timestamp: 00f27b8f

Exception Offset: 0000000000001db1

Exception Code: c0000409

Exception Data: 0000000000000007

OS Version: 10.0.16299.2.0.0.256.48

Locale ID: 1033

Additional Information 1: 2eb9

Additional Information 2: 2eb9591f0e04c7cfea277e3f34d3348f

Additional Information 3: 9333

Additional Information 4: 9333781589f3ec46cd357f0fda06eea0

Extra information about the problem

Bucket ID: 15f01e3e317a50b7b6bb92d1b9fc4f7c (116455065336)

I am at a loss to understand what the problem is here. I am glad to disable Hello Windows if this would end the problem. Thanks in advance for any help on this!

[Moved from: Windows / Windows 10 / Windows Hello, lock screen & sign-in]

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

68 answers

Anonymous

2018-02-27T05:07:25+00:00

Sorry one more item:

It seems *every* time the Surface goes through the Hello Windows login I get an Event ID 10016 error in the event viewer: they are of the form listed below. I have 2000 of these (!) since November. No clue if this is related to my problem but this cannot be a good sign. Anyone know what these are?

Log Name: System

Source: Microsoft-Windows-DistributedCOM

Date: 2/27/2018 12:03:51 AM

Event ID: 10016

Task Category: None

Level: Error

Keywords: Classic

User: LOCAL SERVICE

Computer: DESKTOP-UHI1BND

Description:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />

<EventID Qualifiers="0">10016</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8080000000000000</Keywords>

<TimeCreated SystemTime="2018-02-27T05:03:51.565362000Z" />

<EventRecordID>11427</EventRecordID>

<Correlation />

<Execution ProcessID="876" ThreadID="8028" />

<Channel>System</Channel>

<Computer>DESKTOP-UHI1BND</Computer>

<Security UserID="S-1-5-19" />

</System>

<EventData>

<Data Name="param1">application-specific</Data>

<Data Name="param2">Local</Data>

<Data Name="param3">Activation</Data>

<Data Name="param4">{D63B10C5-BB46-4990-A94F-E40B9D520160}</Data>

<Data Name="param5">{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}</Data>

<Data Name="param6">NT AUTHORITY</Data>

<Data Name="param7">LOCAL SERVICE</Data>

<Data Name="param8">S-1-5-19</Data>

<Data Name="param9">LocalHost (Using LRPC)</Data>

<Data Name="param10">Unavailable</Data>

<Data Name="param11">Unavailable</Data>

</EventData>

</Event>
Was this answer helpful?

0 comments No comments
Anonymous

2018-02-27T03:48:11+00:00

Oh and sorry one other confusion:

if there is an issue with windows should this not come up with a system file check?

I just did it again and all is clean:

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.

Verification 100% complete.

Windows Resource Protection did not find any integrity violations
Was this answer helpful?

0 comments No comments

Anonymous

Guess it is not edge since I just got another explorer crash (I will note chrome does continue to work after the crash).

Crash dump: https://1drv.ms/u/s!AoMjGh2ERllBc8EKXkv6nN8BqYk

overview of crash dump below

I guess I have to repair Windows as auggy suggested. I assume refresh is what you mean from the link you provided? This very much sucks. It is basically reinstalling everything. I just cannot believe there is no way to understand what is the exact source of this problem. There must be some root cause.

overview of crashdump:

FAULTING_IP: 
Windows_UI_XamlHost!wil::details::ReportFailure+e5
00007ffa`c8cf1db1 cd29            int     29h

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00007ffac8cf1db1 (Windows_UI_XamlHost!wil::details::ReportFailure+0x00000000000000e5)
   ExceptionCode: c0000409 (Stack buffer overflow)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000007

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application.  This  overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application.  This  overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_PARAMETER1:  0000000000000007

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

FAULTING_THREAD:  00000000000001f4

BUGCHECK_STR:  APPLICATION_FAULT_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_SEHOP

PRIMARY_PROBLEM_CLASS:  STACK_BUFFER_OVERRUN_SEHOP

DEFAULT_BUCKET_ID:  STACK_BUFFER_OVERRUN_SEHOP

LAST_CONTROL_TRANSFER:  from 00007ffac8cf1e09 to 00007ffac8cf1db1

STACK_TEXT:  
00000000`61e5e740 00007ffa`c8cf1e09 : 0000e4e3`e46767ce 00000000`00000000 00000000`00000000 00007ffa`c8cf9fd8 : Windows_UI_XamlHost!wil::details::ReportFailure+0xe5
00000000`61e5fc80 00007ffa`c8d08d59 : 00000000`285c6a90 00000000`21105fa0 00000037`00000011 00000000`21197fc0 : Windows_UI_XamlHost!wil::details::ReportFailure_Hr+0x39
00000000`61e5fce0 00007ffa`c8d028fb : 00000000`00000000 00000000`21105ac0 00000000`21484750 00000000`0000c000 : Windows_UI_XamlHost!wil::details::in1diag3::_FailFast_Hr+0x29
00000000`61e5fd30 00007ffa`c8d0946c : 00000000`21198030 00000000`00000000 00000000`00000000 00000000`00000000 : Windows_UI_XamlHost!Microsoft::WRL::SimpleActivationFactory::ActivateInstance+0x34b
00000000`61e5fd60 00007ffa`d5a1d544 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : Windows_UI_XamlHost!ASTAThreadHost::s_ASTAThreadHostStartThreadProc+0x6c
00000000`61e5fd90 00007ffa`d5ad1fe4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : SHCore!_WrapperThreadProc+0xc4
00000000`61e5fe70 00007ffa`d633efc1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
00000000`61e5fea0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21

0 comments

Anonymous

2018-02-22T23:52:38+00:00

Thanks auggy.

Explorer just crashed again (or at least all folders closed) and yet there was no crashdump.

I have concluded this is due to Edge browser. I am installing Chrome and will stop using Edge. I am hopeful that will work. Honestly this is one of the worst computers I have ever owned. I so regret not buying a Dell or Lenovo.
Was this answer helpful?

0 comments No comments
Anonymous

2018-02-22T13:38:50+00:00

As the Windows.UI.XamlHost.dll appears to be at the latest version the issue may be with the Windows.UI.XamlHost.dll itself so I would suggest at this point to do a "repair" installation of Windows:

https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html

As a general precaution back up any critical files prior to attempting a repair.
Was this answer helpful?

0 comments No comments