Windows 11 Start Menu/Search hangs and Windows Hello for Business will not provision

7s aljohni 20 Reputation points
2026-06-17T10:50:21.75+00:00

Subject: Windows 11 Start Menu/Search hangs, AppX errors for Workspace ONE, and Windows Hello for Business will not provision

Hello Microsoft Support,

I need assistance with a Windows 11 device where the Start Menu and Windows Search freeze or stop responding intermittently.

Device information:

  • Device name: DESKTOP-TBHCQSB
  • Affected user profile: the currently signed-in user
  • Device join state: Not domain joined
  • Expected management state: MDM-managed through Workspace ONE / AirWatch
  • Date issue observed in Event Viewer: June 16, 2026

Issue 1: Start Menu and Windows Search hang

From Event Viewer, I found multiple Application Hang / Windows Error Reporting events related to Explorer and Search:

Application log:

Event ID 1002 - Application Hang

The program explorer.exe version 10.0.26100.8457 stopped interacting with Windows and was closed.

Observed around:

  • June 16, 2026 12:44 PM
  • June 16, 2026 1:44 PM

Event ID 1002 - Application Hang

The program SearchHost.exe version 2126.8901.20.0 stopped interacting with Windows and was closed.

Observed around:

  • June 16, 2026 1:47 PM
  • June 16, 2026 3:02 PM

Windows Error Reporting also showed events such as:

  • AppHangB1 - explorer.exe
  • AppHangXProcB1 - explorer.exe
  • MoAppHang / MoAppHangXProc - MicrosoftWindows.Client.CBS / CortanaUI
  • WindowsBlackScreenDiagnosticsV1 - DWM

Issue 2: AppX deployment errors related to Workspace ONE / AirWatch

In Event Viewer under Microsoft-Windows-AppXDeploymentServer/Operational, I found errors related to Workspace ONE Intelligent Hub:

Package:

AirWatchLLC.WorkspaceONEIntelligentHubWinUI_24.4.13.0_x86__htcwkw4rx2gx4

Errors:

  • Event ID 712
  • Event ID 404
  • Error 0x80073CF1

Message:

Windows cannot perform the RegisterByPackageFullName operation because it could not find AirWatchLLC.WorkspaceONEIntelligentHubWinUI_24.4.13.0_x86__htcwkw4rx2gx4 in the repository. Make sure the package has been staged or was installed by another user.

There were also warnings such as:

  • Event ID 9660
  • Unable to notify BrokerInfrastructure service for some packages

Issue 3: Windows Hello for Business provisioning will not start

Windows Hello for Business provisioning is not launching. The diagnostic output indicates that the prerequisite check fails because the device and user are not detected as Entra joined / Workplace joined:

dsregcmd /status output summary:

Device State:

AzureAdJoined : NO

EnterpriseJoined : NO

DomainJoined : NO

Device Name : DESKTOP-TBHCQSB

User State:

NgcSet : NO

WorkplaceJoined : NO

WamDefaultSet : YES

WamDefaultAuthority : consumers

WamDefaultGUID : MicrosoftAccount

SSO State:

AzureAdPrt : NO

EnterprisePrt : NO

Ngc Prerequisite Check:

IsDeviceJoined : NO

IsUserAzureAD : NO

PolicyEnabled : NO

PostLogonEnabled : YES

DeviceEligible : YES

SessionIsNotRemote: YES

CertEnrollment : none

PreReqResult : WillNotProvision

Questions for Microsoft Support:

  1. Are the Start Menu and Windows Search hangs likely related to MicrosoftWindows.Client.CBS / CortanaUI / SearchHost package registration or corruption?
  2. Could the AppX deployment errors for Workspace ONE Intelligent Hub affect shell, search, or Start Menu behavior?
  3. For a non-domain-joined device that is expected to be MDM-managed through Workspace ONE, should dsregcmd show WorkplaceJoined = YES or AzureAdJoined = YES for Windows Hello for Business to provision?
  4. What is the recommended repair path for:
    • explorer.exe / SearchHost.exe hangs
    • MicrosoftWindows.Client.CBS / CortanaUI package issues
    • Workspace ONE Intelligent Hub AppX registration errors
    • Windows Hello for Business PreReqResult = WillNotProvision

Troubleshooting already performed:

  • Checked Event Viewer Application log
  • Checked Microsoft-Windows-AppXDeploymentServer/Operational log
  • Confirmed explorer.exe and SearchHost.exe Application Hang events
  • Confirmed AppX registration errors for Workspace ONE Intelligent Hub
  • Ran dsregcmd /status and confirmed the device is not AzureAdJoined, not DomainJoined, and not WorkplaceJoined

Please advise the safest steps to repair the Windows shell/search components and confirm whether the MDM/Workspace ONE enrollment state needs to be repaired or re-enrolled.

Thank you.

Windows for business | Windows Client for IT Pros | Performance | Windows desktop and shell experience
0 comments
Answer accepted by question author
VPHAN 42,485 Reputation points Independent Advisor
2026-06-17T11:36:30.72+00:00

Hello 7s aljohni,

The Event ID 712 and error code 0x80073CF1 explicitly indicate that the operating system cannot locate or write to the required application deployment database. Because Windows 11 heavily relies on this modern infrastructure for core shell components, this database corruption directly causes the explorer.exe and SearchHost.exe application hangs. Furthermore, because the Workspace ONE Intelligent Hub fails to install due to these exact repository errors, the device remains isolated from your organization. This directly causes the Windows Hello for Business failure, as your diagnostic output confirms the device lacks the Azure Active Directory or Workplace join state required to negotiate cryptographic identity keys.

To repair the shell components without destroying user profiles, you must forcefully rebuild the local AppX registrations using an elevated PowerShell session. By executing the Add-AppxPackage command targeted specifically at the core UI manifest file located at C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppxManifest.xml, you instruct the operating system to cleanly rewrite the localized registry keys and file pathways responsible for the Start Menu and Search functionality. After re-registering this framework, you should run the standard Deployment Image Servicing and Management cleanup commands, followed immediately by the System File Checker, to ensure no underlying system binaries are actively damaged.

Once the Windows shell is fully responsive, you must resolve the device management state by completely clearing the broken MDM configuration. Disconnect any residual work or school accounts from the core Windows settings, entirely remove the failing Workspace ONE instance, and initiate a completely fresh enrollment. A successful authentication will transition your WorkplaceJoined status to yes, apply the necessary enterprise security policies, and natively trigger the Windows Hello for Business setup. If the localized PowerShell repairs fail to resolve the core repository corruption, the safest and most compliant remediation path is to reimage the device, as profound structural damage to the AppX database often permanently breaks modern application deployments.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN

Was this answer helpful?

1 person found this answer helpful.
0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-17T10:50:51.25+00:00
    1. The Start menu and Windows Search hangs are consistent with issues in XAML-dependent shell components such as Explorer, Start, and Search that depend on packages like MicrosoftWindows.Client.CBS and related XAML packages. Known issues on Windows 11 24H2/25H2 describe black screens, Start not opening, and XAML-dependent apps failing when these dependency packages are not correctly registered after updates.
    2. AppX deployment or registration problems can affect modern shell and inbox apps. Modern, inbox, and Microsoft Store apps share common AppX infrastructure and permissions. If package registration or permissions are incorrect, modern apps and XAML-based components can hang or fail to start. If the Workspace ONE Intelligent Hub package is failing to register, it indicates broader AppX servicing or permission issues that can also impact shell and Start/Search behavior.
    3. For Windows Hello for Business provisioning, the prerequisite checks require the device and user to be correctly joined and policy-enabled. The dsregcmd output shows:
      • AzureAdJoined: NO
      • WorkplaceJoined: NO
      • PolicyEnabled: NO
      • PreReqResult: WillNotProvision
      In this state, Windows Hello for Business will not provision. For WHfB to provision, the device must be joined and configured by policy (for example, via Microsoft Entra ID or other supported management with the appropriate Windows Hello for Business policies enabled). With both AzureAdJoined and WorkplaceJoined reported as NO and PolicyEnabled as NO, the current join/enrollment state is not sufficient for WHfB provisioning.
    4. Recommended repair path based on the provided information and related guidance: a. Explorer.exe / SearchHost.exe hangs and XAML shell components
      • Treat this as a shell/XAML-dependent app issue. Known scenarios on Windows 11 24H2/25H2 show Start, Explorer, Taskbar, and other XAML-dependent apps failing when XAML dependency packages (for example, MicrosoftWindows.Client.CBS, Microsoft.UI.Xaml.CBS, MicrosoftWindows.Client.Core) are not correctly registered after updates.
      • If only a few machines are affected and the underlying permission or registration issue cannot be located, recovering the machine and refreshing it to a clean image is an accepted remediation path for modern/inbox app and shell issues.
      • For deeper troubleshooting of Start menu behavior and policies, review Start menu-related configuration and CSP/policy settings and collect logs as needed:
        • Use Start menu policy and layout documentation to verify that no Start layout or lockdown policy is misconfigured.
        • Use logs such as Microsoft-Windows-ShellCommon-StartLayoutPopulation* and tools like gpresult or MDM reports to confirm applied policies.
      b. MicrosoftWindows.Client.CBS / CortanaUI / other XAML package issues
      • These components are listed as typical XAML dependency packages whose update/registration issues can cause Start, Explorer, and XAML-dependent apps to fail or hang.
      • If package registration or permissions cannot be corrected and only a small number of devices are impacted, reimaging or refreshing to a clean image is a supported way to restore correct package state.
      • If the issue appears after specific cumulative updates in an enterprise or managed scenario, track the relevant servicing article for updates and resolution guidance.
      c. Workspace ONE Intelligent Hub AppX registration errors
      • The AppX errors for the Workspace ONE Intelligent Hub indicate that the package is not found in the repository when registration is attempted.
      • Because modern/inbox apps and MDM agent apps share the same AppX infrastructure and permissions, underlying permission or registration problems can affect both.
      • If the permission issue cannot be located and only this device or a small set of devices is affected, recovering or refreshing the device to a clean image is a valid remediation to restore a healthy AppX repository and then re-enroll the device in Workspace ONE.
      • For persistent or widespread issues, collect modern/inbox app troubleshooting data (for example, using the TSSv2 toolset with the PRF_UWP and PRF_AppX scenarios) and engage support with the collected logs.
      d. Windows Hello for Business PreReqResult = WillNotProvision
      • The dsregcmd output shows that the device is not Azure AD joined, not Workplace joined, and that Windows Hello for Business policy is not enabled (PolicyEnabled: NO). In this state, Windows Hello for Business will not provision.
      • To enable WHfB provisioning, ensure that:
        • The device is correctly joined (for example, Azure AD joined or otherwise appropriately enrolled) and
        • Windows Hello for Business policies are configured to allow provisioning.
      • Windows Hello for Business behavior and provisioning are controlled by policy settings such as “Use Windows Hello for Business,” “Use cloud trust for on-premises authentication,” “Use certificate for on-premises authentication,” and related feature settings. These must be configured via GPO or CSP (for example, PassportForWork CSP) for the tenant and devices.
      • If Windows Hello for Business has previously been provisioned and needs to be reset on a device, the Windows Hello for Business container can be deleted using certutil.exe -deleteHelloContainer. On current Windows 11 versions, this also clears any passkeys stored on the device, so an alternative sign-in method must be prepared in advance and passkeys reviewed under Start > Settings > Accounts > Passkeys before running this command.
      e. Data collection and escalation
      • For modern/inbox app, shell, and AppX issues that cannot be resolved by local repair or reimaging, collect diagnostic data before contacting support:
        • Use the TSSv2 toolset and run the PRF_UWP and PRF_AppX scenarios to gather traces and event logs.
        • Attach the resulting compressed logs to a support request for detailed analysis.
      • For device join and Windows Hello for Business issues in an Entra-connected environment, the Microsoft Entra device troubleshooter can be used to analyze device logs and provide recommended next steps, including documentation or support escalation.

    In summary, the hangs in Start/Search and the AppX errors indicate issues in the modern app and XAML shell infrastructure. If permissions or package registration cannot be reliably repaired, a clean image and re-enrollment is the safest remediation. Windows Hello for Business will not provision until the device is correctly joined and WHfB policies are enabled; the current dsregcmd state explains the PreReqResult = WillNotProvision.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    1 person found this answer helpful.
  2. VPHAN 42,485 Reputation points Independent Advisor
    2026-06-20T05:31:58.26+00:00

    Hi 7s aljohni,

    Has your issue been resolved yet? If it has, please consider accepting the answer as it helps others sharing the same problem benefit too. Thank you :)

    VPHAN

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.