Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Question

I changed the logonui.exe file, now I can't log in. Help!

Sep 7, 2015 11:13AM PDT

Hello,

I didn't like the logon screen in Windows 10, so I replaced logonui.exe with a Windows 7 version of it, and renamed the Windows 10 version of it as logonuiX.exe Now the screen is blank when my computer starts up, and I can't log in to even reverse the changes.

Can anybody please help me with this situation? I would greatly appreciate it. Thanks.

Michael Jones

Discussion is locked

- Collapse -
Answer
Boot from a Linux DVD or flash drive & rename back.
Sep 7, 2015 11:18AM PDT

You can download Mint Linux from here:
http://www.linuxmint.com/index.php . Make a bootable DVD or flash drive & boot from it. You don't have to install anything, and you'll be up and running after booting in about 3 minutes. The user interface looks enough like Windows that you shouldn't have much trouble with it.
`
Good luck.

- Collapse -
I can't use it.
Sep 7, 2015 11:21AM PDT

My drive is encrypted with Bitlocker so I cannot use it.

- Collapse -
Well then it's reinstall time if you don't have a backup.
Sep 7, 2015 11:28AM PDT
- Collapse -
All I need to do is change one file
Sep 7, 2015 11:34AM PDT

I have tons of data I can't lose, and I need it tomorrow.

I can boot into Windows with the TPM, as the encryption key is there. All I need to do is change one file and I'll be straight.

- Collapse -
Bitlocker is well a deep issue.
Sep 7, 2015 11:46AM PDT

I can't guess why folk do this but it's time to place calls to DriveSavers.com to get an idea if masters can recover files.

You are now fully aware why Windows is never run without backups. The first time this happens folk often lash out at everyone. The rename alone would have been trivial but since you bitlocked it, it's likely all gone.

That said, did you backup your bitlocker "key"? If you forgot about it that's par for the course. Without it, no easy way into this drive.
https://www.google.com/#q=backup+bitlocker+recovery+key

- Collapse -
I didn't save the recovery key...
Sep 7, 2015 11:50AM PDT

...but it's on the TPM. Again, I can boot into Windows, but not log on.

- Collapse -
So let's hear what you think of disk encryption now.
Sep 7, 2015 11:58AM PDT

You've first hand repeated the scenario that I've run into too many times.

Drivesavers is next since Microsoft has yet to assist with such recovery. In case you want to know why, ask them. My theory is they must maintain it's that good.

No recovery key, no recovery appears over and over.

Yes you wrote TPM but the TPM is designed to lock folk from copying it out. I'll stop here so you can flame all the PC world and makers.

- Collapse -
But I need the data tomorrow, NOT when DriveSavers gets it.
Sep 7, 2015 12:03PM PDT

I can't afford to lose this data, I have a report to present tomorrow. Are there any alternatives for accessing options while the computer is booted?

- Collapse -
Drivesavers has an expedite system.
Sep 7, 2015 12:08PM PDT

My take is that you are looking for a miracle. Such would be us making backups before the disaster as well as not using Bitlocker which made absolutely sure no one can easily recover.
Note: Edited to correct spelling.

Post was last edited on September 7, 2015 12:16 PM PDT

- Collapse -
there is an exploit that works
Sep 7, 2015 12:23PM PDT

but fairly involved and would need someone who is proficient in it. Not something I'd want to tackle on a first time basis. It's detailed in the wikipedia. Basically it's a part boot and then the RAM is dumped to a file so the encryption can be recaptured to allow access to the data. The more common approach is to use the rescue key, boot to it, but into a different system like Linux, have it do a memory dump into a file. From there someone proficient in encryption systems can extract what's needed to break the encryption on the volume.

You keep saying you boot into windows but to a black screen. Any reactions at all from mouse clicks, keyboard access, key combos, etc? Just a black screen with no reactions to input devices like keyboard and mouse?

- Collapse -
(NT) The Utility Manager opens when I press (Windows) + U
Sep 7, 2015 12:25PM PDT
- Collapse -
(NT) Got the onscreen keyboard show up?
Sep 7, 2015 12:35PM PDT
- Collapse -
(NT) Yeah, it opens up.
Sep 7, 2015 12:38PM PDT
- Collapse -
(NT) tried using it to enter password and press enter?
Sep 7, 2015 1:11PM PDT
- Collapse -
(NT) It's set up so that I have to put in a user name too.
Sep 7, 2015 1:13PM PDT
- Collapse -
OK
Sep 7, 2015 1:22PM PDT

start with the username, then TAB, then the password, press Enter.

- Collapse -
The school of hard knocks is a great teacher but...
Sep 7, 2015 12:02PM PDT

...it is also a painful one.
`
When you've gotten your system back like you want it, I urge you to get yourself an external hard drive and a good 3rd party backup program. You can set it up to do everything automagically at the time and frequency of your choice. 1 TB external hard drives are about $50 these days and a really good FREE backup program is the Easeus Todo Backup Free. That can save you a lot of time and frustration the next time something like this happens. Sooner or later it happens to all computers for one reason or another.

Good luck.

- Collapse -
BitLocker encrypts the entire volume
Sep 7, 2015 12:27PM PDT

which includes the operating system. Such as you are discovering are dangerous because it's not just encryption of a volume that holds your data, which would be easier to regain.

That's why in my Linux system I ONLY encrypt my personal data instead of allowing ecrypt to do the entire volume. Having the operating system not encrypted exposes clear files such as logs, but even that can be turned off if I want.

- Collapse -
what do you see then?
Sep 7, 2015 12:05PM PDT

Are you at the welcome screen?

- Collapse -
Yes, basically.
Sep 7, 2015 12:08PM PDT

Because logonui is changed to a wrong version, the screen is just plain black.

- Collapse -
did you make the USB "key" for emergency use?
Sep 7, 2015 12:03PM PDT

If so, then maybe you can use it to get into windows to change the file back, but if it's one of the files used to create the encryption "hash" that gets checked to see if the TPM will allow the volume to be unencrypted, then you may be completely out of luck. I notice in the wiki that BitLocker uses AES encryption? If so, you may be able to decrypt the volume with the AES encryption from True Crypt acting directly on the drive if you know the encryption passphrase or key used. I've never tried that, so can't say for certain it would work, but it does have AES encryption. That attempt is only worth it if there's data you need to recover. If this was a recent install and no data recover needed, just take the easier route and reload the system.

- Collapse -
(NT) can you boot Safe Mode?
Sep 7, 2015 11:28AM PDT
- Collapse -
No, I can't.
Sep 7, 2015 11:35AM PDT

I have no idea why Windows 10 disable the boot options menu be default, so I can't use that.

- Collapse -
boot option menu
Sep 7, 2015 12:06PM PDT

Is that one from Windows, or from Secure Boot in the UEFI-BIOS?

- Collapse -
(NT) And it's the one from Windows that's disabled by default.
Sep 7, 2015 12:10PM PDT
- Collapse -
what is the last screen you see
Sep 7, 2015 12:28PM PDT

before this blank screen appears?

- Collapse -
The last screen is the Windows Boot Screen, then the blank.
Sep 7, 2015 12:34PM PDT

I think the blank screen is caused by the wrong version of logonui being there, not a system crash. I can press Windows + U and I get the Accessibility menu to open Keyboard, Narrator, or Magnifier.

- Collapse -
Answer
If you want a nice user interface, you can install...
Sep 7, 2015 11:20AM PDT

...Classic Shell or Star10. Classic Shell is free and Start10 is $5.
`
Good luck.

- Collapse -
Thanks, but...
Sep 7, 2015 11:29AM PDT

I can't log into my computer at all. There is no mouse cursor, and the screen is black.

- Collapse -
Curious
Sep 7, 2015 12:09PM PDT

Is it possible to install the same system on a different drive, use the same process with same key and passphrase or whatever is used to set the encryption and then maybe use that working system to mount the previous volume?