The start menu is not responding | Broken Store Apps | 0xc000027b (2023)

Last updated on September 23, 2022 byRudyooms

This blog will be, again, about someUnpleasant problems with apps from the store🇧🇷 At the conclusion of my last blog, I already mentioned that I was investigating some problems with the start menu and OneDrive/Outlook connection that I was experiencing.

I will divide this blog into several parts.

1. The question
2. fixing the old fashioned way
3. Problems solution
4. Fixing it the new way
5. If you don't want to fix it manually
6. To main cause
7. The possible first “trigger”?
8. Microsoft ProfApi.dll

I don't think I need to mention how disgusting2022-05 update again,who broke down the facilities ofMS Storebut when looking for the first time, I noticed this problem from the store(15-02-2022) This issue has been around longer than the May 2022-05 Update.

Let me explain what stops working.

• Outlook can no longer connect
• OneDrive stops syncing because it can no longer connect (0x8004de44)/Trava no login
• Start menu does not respond to left click (right click still works)

For you to have a good idea of ​​what's going on, I also record it so you can show exactly what was going on!

Looking at all the things that are breaking I think we could justbreak the deviceand that's it... but I think we have to fix it, otherwise we wouldn't be doing our jobs.

Now we know and we've seen what breaks, and if we didn't break our device, we need to see what events we'd get if this whole thing did break! open yourApplication event logand start looking out for all those big yellow notices!

Event identifier: 20

Fix triggered because LocalSettings operation against package Microsoft.AAD.BrokerPlugin_cw5n1h2txyeyy failed-2147024891.

Event ID: 21

Fix for LocalSettings operation in package Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy with error -2147024891 Error code returned:-2147024891.

Event ID: 23

Fix status locations triggered due to Failure of SettingsInitialize operation against package Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy:2147024891.

Event ID: 24

Fix state locations for SettingsInitialize operation against package failure Microsoft.AAD.BrokerPlugin_cw5n1h2txyeyy-2147024891returned error code: 0

It is quite obvious what we are dealing with2147024891 | 8007005 | Access deniederrors. But I'm not done yet because another mistake caught my attention! As shown below, he mentions the0xc000027bmistake.

The application event log isn't the only event log we need to look at, so let's take a look at the system event log. This event log shows us theKernel-General event 16mentioning app history in componentAppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.datIt has been deleted

Damn... I almost forgot an event log! As stated above, when you have trouble signing in with Onedrive and Outlook, it's always a good practice to check theAAD event log🇧🇷 As below, even AAD login record gives us the same0x80070005access denied error

When this strange issue started to occur, we didn't know exactly what was going on. at first, alonedeleted the corrupted profileto ensure that a beautiful and shiny new profile is created

To do this, we restart the device and log in with a local administrator user. After logging in, we start to remove thec:\users\%username%folder and removing theuser your profile key in the registry

With himold corrupted profile missingwe could start logging in with the user again so that the profile is recreated. Once signed in, open OneDrive and Outlook to ensure your Microsoft account is connected and working again.

Have in mind: With the release of the June update, we have also installed the June 2022-06 update which includes the store fix.

If we don't want to recreate the profile and go through all theproblems resyncing OneDriveetc. we also have another option to fix it. As always, I also looked to see if there was anything useful in theMS-Docs.

Microsoft Store Apps Won't Launch: Windows Client | Microsoft documents

Looking at the link above they mention something about howresolve potential store app issues.

This is definitely a bug (0xc000027b) that we noticed before, right? I think we're missing some permissions for“ALL APPLICATION PACKAGES” | Also known as S-1-15-2-1on some registry keys…. But which ones? because we have so many of them!

When you wonder what's going on in the registry, there's alwaysprocmon🇧🇷 Open Procmon and define the filter first as shown below

Looking at the error we got earlier2147024891–>Access denied.I'll just add the filter."Include"the value"ACCESS DENIED"

As shown above, you are mentioning "Access denied" about itHKU\S-1-12-1-2370815533-1185198546-48193434-4181760345\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorerit's himUser shell foldersregistry keys. I think these are the registry keys we need!

First, make sure your device has theUpdate 2022-06 installed🇧🇷 Why can the May update break it again?

When we are 100% sure that the device is up to date, open the registry (if you have permissions to do so, otherwise run Regedit as administrator and look for the correct user in the HKEY_USERS key) and validate the permissions on the following registry entries .

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

As mentioned earlier, these registry keys must have the extension "All app packagesuser” configured in the permissions and you also need to have the"File"checked box.

If he "ALL APPLICATION PACKAGES”the user doesn't have read permissions, you must add them manually!

Of course, you can also automate the fix using PowerShell. When looking at the following script which needs to be run as an administrator, it will first look for the SID of the Azure AD user. After getting the correct SID it will create anew-psdriveto ensure that we can connect to theHKEY_USERSWrench.

After PSDrive is created it will be addedread keypermits for missing personsALL APPLICATION PACKAGES” to the registry key

please changea$packagesto your own language

$Paquetes = "Todos os PAQUETES DE APLICAÇÃO"$key = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-12-1-*'$profiles = (Get-Item $key)New- PSDrive - Registro PSProvider -Nombre HKU -Root HKEY_USERSForeach ($perfil en $perfiles) {$sids = $perfil$sids = Ruta dividida -ruta $sids -hoja$usuario = "HKU:\$sids\"$prueba = rota de prueba $userif ($test -eq $true){ $Folder = "HKU:\$sids\Software\Microsoft\windows\currentversion\explorer\"$Acl = Get-ACL $folder$AccessRule= New-Object System.Security . AccessControl.RegistryAccessRule($Packages,"Readkey","ContainerInherit","None","Allow")$Acl.SetAccessRule($AccessRule)Set-Acl $pasta $Acl$Pasta = "HKU:\$sids\Software\ Microsoft\windows\currentversion\explorer\user shell folders"$Acl = Get-ACL $folder$AccessRule= New-Object System.Security.AccessControl.RegistryAccessRule($Packages,"Readkey","ContainerInherit","Ninguno"," Permitir")$Acl.SetAccessRule($AccessRule)Set-Acl $carpeta $Acl} }Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

After making sure that all the permissions are ok, let's first have a look if maybe we got some luck because changing the registry permissions solved it for75%of the devices

If the problem persists, make sure to log in to the device withUSER NAMEyou are having this problem (NOT ADMIN, the user's session! )

Once logged in, open 1Elevated PowerShellsession and an unraised 1 on the user's session. First, kill theexplorer.exeusing the task manager.

Have in mind:When you don't close explorer you may end up with some errors mentioningthe feature is currently in use!

To fix this problem I also added the-Force close the appto ensure that resources currently in use are forced off

NoHIGH(EXECUTE AS ADMINISTRATOR) PowerShell session:

Get-AppXPackage -Todos os usuários | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

Wait until you're ready! and just ignore the errors if you have any

NoNORMALPowerShell session (inuser session)

Get-AppXPackage *Microsoft.Windows.Search* |ForEach-Object {Add-AppxPackage -DisableDevelopmentMode -ForceApplicationShutdown -Register "$($_.InstallLocation)\AppXManifest.xml"}Get-AppXPackage *MicrosoftWindows.Client.CBS* |ForEach -Object {Add-AppxPackage -DisableDevelopmentMode -ForceApplicationShutdown -Register "$($_.InstallLocation)\AppXManifest.xml"}Get-AppXPackage *Microsoft.Windows.ShellExperienceHost* |ForEach-Object {Add-AppxPackage -DisableDevelopmentMode -ForceApplicationShutdown -Register "$($_.InstallLocation)\AppXManifest.xml"}Get-AppXPackage *Microsoft.AAD.BrokerPlugin* |ForEach-Object {Add-AppxPackage -DisableDevelopmentMode -ForceApplicationShutdown -Register "$($_.InstallLocation)\AppXManifest.xml "}Get-AppXPackage *Microsoft.AccountsControl* |ForEach-Object {Add-AppxPackage -DisableDevelopmentMode -ForceApplicationShutdown -Register "$($_.InstallLocation)\AppXManifest.xml"}Get-AppXPackage *Microsoft.Windows.CloudExperienceHost* |ForEach -Objeto {Add-AppxPackage -Des ativar eDevelopmentMode -ForceApplicationShutdown -Registrar "$($_.InstallLocation)\AppXManifest.xml"}

After running this PowerShell script, pleasereset deviceOr juststart explorer.exewith the use of Taskmanager and you will notice that everything is working again.

I guess we're all lazy admins sometimes! When you don't want to go through all the trouble of fixing it manually, you can always run a"New beginning"

But be careful, it will take more time before the user can use their device again becauseyou need to go through all device and ESP user again to install required apps🇧🇷 It is up to you to choose the solution you are satisfied with.

After comparing all devices with some people, we noticed that1 specific applicationhas been installed on these devices.

It seems that somehowClickShare appbroke at some point and at that time was responsible for messing up theALL APPLICATION PACKAGESpermissions on these registry keys.

Fortunately, Barco (ClickShare) is also confirming this issue and fixing it with the latest update. So make sure that when implementing the permissions fix you also make sure the ClickShare app is up to date.

Shall I tell you a little secret? Microsoft has their own PowerShell Script to fix it! Comparing this script with my own version, this script should run onuser session!where my script needs to run atsystem context.

It pretty much does the same thing 🙂... fixes missing permissions.

$acl1 = Get-Acl "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\"#$person = [System.Security.Principal.NTAccount]"todos os pacotes de aplicativos" ##S-1 -15 -2-1$sid = Novo objeto System.Security.Principal.SecurityIdentifier ("S-1-15-2-1")$person_temp = $sid.Translate( [System.Security.Principal.NTAccount]) $persona = $person_temp.Value.Split("\")[1]$access = [System.Security.AccessControl.RegistryRights]"ReadKey"$heritance = [System.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit"$ propagação = [System.Security.AccessControl.PropagationFlags]"Ninguno"$type = [System.Security.AccessControl.AccessControlType]"Allow"$rule = New-Object System.Security.AccessControl.RegistryAccessRule($persona,$acceso,$ herencia, $propagación,$tipo)$acl1.AddAccessRule($regla)$acl1 | Set-Aclif (-no (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown } Get-AppxPackage Microsoft .AAD.BrokerPlugin

ClickShare app is one of the apps that can mess up our start menu and break our Office365 apps connection, butWhat could have triggered this?I already had some ideas about what could have triggered this, but after seeing this post on Reddit, I was sure.

Intune: Mobile device management (reddit.com)

Looking at the Reddit post, the trigger could definitely be aself-service passwordredefined by the user himself! After asking some more, many answers were the same:

“The user reset the password a few days before the problem started."

UPDATE 2022-09-23 Official answer from Microsoft

Although this initially appeared to be a problem with thethird party app, now appears to be Microsoft code(profapi.dll)whatbreak permissionsthinking they need to be recovered. This can happen when a third party x32 process (such as ClickShare)use Office APIson a machine where Office is deployed using Office ClickToRun, due to aerror in AppvIsvSubsystem32.dllrecording hooks. In this case,profapi.etcwill start to recoverACL, but after a second failure,will not write the ACLs of all app packages,causing problems (crashes and registration failures) with packaged applications.

Error 41322218 registration error:_RecoverUserShellFolderKeys cannot restore default permissions

So it's related to a Click-to-run version of Office. And it makes sense, as the issues have been occurring since moving to the MS Apps 2202 Enterprise channel

All of these store app issues we've been experiencing for the last few months are horrible. Fortunately, most issues can be resolved. This blog will explain howcould solve problems with the Start menu, Onedrive and Outlook.

Have in mind: I'm still looking for the "why"! If I have more information, I will share it with you all!

If you are interested in troubleshooting your offline company portal app, check out this blog

Company portal not working after wipe/reset (call4cloud.nl)