My 3 monitors go black & then the Taskbar is moved to center monitor

Topic

New Reply

[saturn2233]

I have a weird situation with my Windows 11 (23H2) computer that just started a couple of days ago. I did not install any new software, nor did I do a March Windows Update. I have no idea what is going on or why.

Every once in a while my 3 monitors go black for 4 to 5 seconds, as if something is being updated, like something associated with the displays. When my center monitor was set to be my main display and my Taskbar was on my left monitor only, Windows would move the Taskbar to the center monitor, even though I have “Lock the Taskbar” set. So, in the meantime, I have set my left monitor to be my main display, with the Taskbar on that left monitor, and at least the Taskbat stays put.

Using “LastActivityView.exe from NirSoft, I have gathered some information:

Screens go blank, then taskbar is moved and icons are all rearranged.

02 Apr 2025 at 12:06:14 svchost.exe or WUDFHOST.EXE
02 Apr 2025 at 12:09:53 svchost.exe or WUDFHOST.EXE

I disabled the Service called “SysMain”.

02 Apr 2025 at 12:36:21 InstallServiceTasks.dll

ScanForUpdates, \Microsoft\Windows\InstallService\ScanForUpdates
ScanForUpdatesAsUser, \Microsoft\Windows\InstallService\ScanForUpdatesAsUser
RestoreDevice, \Microsoft\Windows\InstallService\RestoreDevice

02 Apr 2025 at 13:18:10 InstallServiceTasks.dll
02 Apr 2025 at 15:24:26 InstallServiceTasks.dll –

Does anyone know what is happening and how to fix it? Thank you.

UPDATE: I see from the Event Log that this is happening because “An account was successfully logged on.” More info:

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.

– Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.

– Transited services indicate which intermediate services have participated in this logon request.

– Package name indicates which sub-protocol was used among the NTLM protocols.

– Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

But why is this happening? I am not logging off and on. What is doing this?

• This topic was modified 2 days, 4 hours ago by saturn2233.

Reply | Quote

Replies

UPDATE 2: But I see there are many entries like this in the past. So what is causing these recent operations to mess up my Taskbar? And it’s not every time a
Special Logon” happens.

See:

Audit Success, 04/02/2025 3:36:03 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 3:36:05 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 3:36:05 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 3:36:06 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 3:57:24 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 4:20:16 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 5:04:40 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 5:04:40 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 5:04:41 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 5:06:45 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 5:06:45 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 5:07:24 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 5:22:37 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 5:29:21 PM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 8:47:25 AM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 8:47:34 AM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 8:47:34 AM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 8:47:40 AM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 8:51:26 AM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 8:53:47 AM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 9:29:01 AM, Microsoft Windows security auditing., 4672, Special Logon
Audit Success, 04/02/2025 9:33:00 AM, Microsoft Windows security auditing., 4672, Special Logon

These messed up my taskbar and my icons:

02 Apr 2025 at 13:18:10
02 Apr 2025 at 15:24:26
02 Apr 2025 at 16:20:14
02 Apr 2025 at 17:22:37

But many others did not.

Reply | Quote