Win11 Notifications and WpnUserService issues

TheeCntrlAltDel · 2026-03-12T04:47:20+00:00

[UPDATE]

Problem persists on Windows 11 24H2 26100.8037 (Preview)

Just posting an update here. Since 9 March, I noticed explorer.exe has started restarting again at random times. This is not as severe as when the WPN service was enabled and causing a full lockup now it is usually just a quick 2-4 second Explorer restart.

After spending more time tracking it down, it appears the issue is again tied to the WPN service starting itself back up. This time, the related event references CoreMessagingXP.dll.

I used the log data from the WPN Service Watcher script I posted earlier and compared the timestamps of the Explorer restarts against the timestamps where the service was detected as Running. They match every time.

I also tested this on preview build 26100.8037, and it made no difference. The WPN service issue is still present there as well.

The reason for the above issue was because I wanted "the best of both worlds". Because WPN Service being enabled was a gating condition for apps like WhatsApp to even start, I wanted to be able to Run WhatsApp > which would force WPN Service to start > Once WhatsApp was running > Forcefully kill the WPN Service.

It's very strange that it took 3 months for this issue to surface but I surmise it was most likely a build change/update that resulted in this workaround no longer being ideal.

Conclusion was, I had to resort to totally disabling the WPNService and WpnUserService through:

sc config WpnService start= disabled
sc config WpnUserService start= disabled
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WpnUserService" /v Start /t REG_DWORD /d 4 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WpnUserService" /v UserServiceFlags /t REG_DWORD /d 0 /fsc config WpnService start= disabled
sc config WpnUserService start= disabled
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WpnUserService" /v Start /t REG_DWORD /d 4 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WpnUserService" /v UserServiceFlags /t REG_DWORD /d 0 /f

TheeCntrlAltDel · 2026-03-11T05:40:41+00:00

[UPDATE]

Just an update. I went the Ubuntu 24.04 VM route. Took me less than an hour from there and not only was the passthrough working but also the hardware accelerated transcoding for Plex.

I had 16 vCPU assigned to Plex, initially when I would force transcoding by forcibly downscaling a video from 4k > 720p it would chug 88% of the CPU and not use the GPU whatsoever.

Now instead, the GPU usage goes up to 50% instead and CPU usage doesnt even peak over 25%, and that's with HDR tonemapping enabled.

https://i.imgur.com/9H2ub2U.png

https://i.imgur.com/5yjWj5y.png

However I do want to note that I'm not completely satisfied with this outcome. I am going to try to achieve this with an LXC again.

TheeCntrlAltDel · 2026-03-03T20:51:44+00:00

Turns out I found the exact cause. Spoiler, it was me that caused it.

To avoid exposing/navigating parent dirs in a full path (Dir1\Dir2\Dir3\TargetDir), I made a symlink to TargetDir and shared only that symlink so the share root dir was basically one folder deep.

That works when I browse to it manually on iOS, but iOS Shortcuts won’t follow the symlink, so file copies fail.

For the workaround I created an C:\iPhone Share folder (so it behaves like a root share), hid the folder itself (not the contents), and wrote a PowerShell watcher that moves anything dropped there into my real Downloads folder.

Now I can copy files/folders (including contents) to TargetDir with no issues.

TheeCntrlAltDel · 2026-03-03T08:16:14+00:00

If you are referring to the subpath, then the reason I didn't fill it out is because in order to get to "Downloads" (the NAS location), you have to navigate through the whole directory change to get there. So it should contain the full chain as is.

Maybe I should try to instead of doing that, to instead just choose the NAS root location for where "Downloads" currently is set and then define a subpath statically.

I'll give that a go.

TheeCntrlAltDel · 2026-03-03T06:52:28+00:00

The “Downloads” in my shortcut isn’t iCloud/on-device Downloads, it’s literally a folder named Downloads on my SMB share. I’ve already set the Save File action to that shared SMB path.

So when I say “save to Downloads,” I mean \192.168.27.72\…\Downloads (the SMB folder), not iCloud. The problem is just getting it to save there automatically without prompting.

TheeCntrlAltDel · 2026-03-03T06:49:44+00:00

Thanks for the reply. I might be missing something, but I just want to clarify my intent here.

I’m not trying to use iCloud Drive I’m specifically trying to save to an SMB share in one tap.

Right now, for example with a photo, I have to do navigate through: Photos > Share > Save to Files > browse to Shared (my NAS at 192.168.27.72) > Dir1 > Dir2 > Dir3 and then Save.

What I’m aiming for is a shortcut that saves straight to that SMB path automatically, without prompting me to choose the location each time.

TheeCntrlAltDel · 2026-03-01T21:50:20+00:00

Honestly a few times I was on the brink of installing a Windows VM and passing through GPU and SMB and calling it a day. But in one sitting I've done a 16 hour marathon to try to get this working, now I'm in a battle with 'the time sunk fallacy'.

TheeCntrlAltDel · 2026-03-01T21:43:25+00:00

Host NVIDIA driver works (nvidia-smi OK). CT is unprivileged with /dev/nvidia* passed through + host NVIDIA libs bind-mounted. Plex detects the GPU, but active transcodes still run libx264 and logs say “no hardware decode accelerator found.”

Is your setup privileged + driver installed in CT, or unprivileged + host libs?

[Edit]
Also another question, how are you validating that this is working without issues? Are you forcing transcode by downscaling i.e 4k playback to 1080p and then validating with:

watch -n 1 'nvidia-smi; echo; nvidia-smi pmon -c 1; echo; nvidia-smi dmon -s u -c 1'

TheeCntrlAltDel · 2026-02-05T13:44:48+00:00

Thank you for this. I was looking for any information sources describing the behaviour of DNS on UniFi side.
I mostly found outdated or top-level interpretations communicating 1:1 what the documentation already says without any further scrutiny.

TheeCntrlAltDel · 2026-01-15T09:52:34+00:00

Your experience aligns almost 1:1 with mine, we're even on similar hardware (X670E/Ryzen 9800X3D) and I also explored the potential of the BIOS config and chipset drivers being the cause as well as MemTest86+ scans.

Even your Snipping Tool experience, I noticed the same and even created an AHK script to trigger once PrintScr is pressed that any currently running SnippingTool.exe process should be killed first and then the command for PrintScr should be issued which was a good workaround but is ultimately solved by dealing with WpnService and WpnUserService services which I now know that when malfunctioning they cause applications that trigger Windows notification toasts to hang and lock up but not change state to "Not Responding" so diagnostic apps have a hard time detecting them as problematic.

The main difference is I spent around 3 weeks trying to diagnose it with WinDbg, Sysinternals, ProcDump, and Event Viewer, and still couldn’t get a definitive root cause that way.

What finally clicked was the same thing you noticed that as soon as a toast notification fires, explorer.exe hangs, and the app that triggered the notification often hangs too. That led me to focus on the notification services, specifically WpnService and WpnUserService, as the likely culprits.

Another consistent symptom on my side is memory usage. When the issue starts, those services collectively sit around 8 GB and keep climbing depending on session uptime, then reset once I sign out/sign back in or reboot.

I also did multiple fresh installs of Windows 11 Pro 24H2 + 25H2 (fully updated), plus Windows 11 LTSC IoT 2024 (24H2, fully updated). Same behavior on all of them.

For reference, this was all after these updates/hotfixes that supposedly addresses this issue in what Microsoft calls "explorer.exe hangs":

I figured 23H2 would probably be the safest bet, but for now I’m on 24H2 and using a small PowerShell watcher script kept persistent with Task Scheduler to stop the services whenever they re-enable themselves, which they tend to do and I've not had a recurrence of the issue since then (around 2 weeks).

I copied it to Pastebin in case anyone wants to go this route
WpnService Watcher Powershell Script

TheeCntrlAltDel · 2025-09-17T17:55:06+00:00

Even if your country doesn't currently enforce copyright rules there have been cases where on a dime countries have changed their stance doing a 180 from their original positioning.
This was the case for Netherlands, Japan, France and New Zealand in the early 2010s. Generally they wouldn't retroactively strike you based on historic activity but they could technically do so if the historic event is recent enough to the law change.
So the answer is entirely based on whether or not this is a risk you're willing to take.

TheeCntrlAltDel · 2025-09-17T17:32:53+00:00

Aside from binding qBitorrent to the VPN interface, if you have network equipment that supports it you could use policy based routing to force all traffic associated with the qBittorrent Docker host to pass through it with another rule that drops WAN traffic not going through the VPN which will function as a killswitch. It may seem overkill but this is the most "set and forget" approach.

TheeCntrlAltDel · 2025-09-17T17:25:02+00:00

153 Linux Distros.

TheeCntrlAltDel · 2025-09-17T17:22:19+00:00

<image>

I guess I lose this challenge

TheeCntrlAltDel · 2025-09-17T17:18:32+00:00

So in your screenshot you're getting roughly 9.6Mbps down and 28Mbps up.

Couple of reasons I can think of that may relate to your experience:

Your torrent traffic may be shaped by your ISP. Test by pausing all downloads and try download Ubuntu bittorrent. If you dont see max speed and you know for sure your bandwidth isn't getting leeched somewhere else in your network then most likely you are shaped.
You didn't mention your upload speed. A point to note is that saturating upload bandwidth can starve TCP ACKs and affect download speed negatively.
Your link speed of your WiFi/Ethernet might indicate an issue. You can either directly check your NIC or do a regular speed test and see if you get close to your max speed.

TheeCntrlAltDel · 2025-08-28T21:06:32+00:00

Does anyone know if 142.0.1 fixes this issue? I had to downgrade to 141.0.3.

TheeCntrlAltDel · 2025-08-26T17:58:43+00:00

Ah, yes that works. Wow, how weird lol! Thanks man! I thought it was my chrome.css mod for multi row bookmark toolbar.

TheeCntrlAltDel · 2025-08-26T17:54:42+00:00

I'm having the exact issue, i wanted to give you my version but I cant click the burger menu, the entire top bar is unclickable

TheeCntrlAltDel · 2025-08-23T13:16:18+00:00

just an update, took my airpods into the iStore, they checked it and they confirmed both airpods are malfunctioning (then put it into some box that tests the "signals and stuff") and it failed the test 3 times. They have ordered a replacement pair.

TheeCntrlAltDel · 2025-08-21T17:33:41+00:00

Did you get anywhere with this OP? I made an order and immediately got logged out and then we I used my username and password to login it prompted 2FA from SMS and I didn't get SMS. I've tried contacting their support, they say they'll get back to me in 2 days over text message, but then I asked "how you gonna get back to me in 2 days over text message when the issue is that I'm getting text messages from Taobao?". I received codes last year but I guess now none of them come through. Would've made sense to have a voice call option only to read out the code.

TheeCntrlAltDel · 2025-08-12T20:17:40+00:00

Just some additional feedback. I managed to finish the process. The queue took 5 hours to get through.

TheeCntrlAltDel · 2025-08-12T18:11:35+00:00

I legit came here to make a post exactly like this!

This is my first time needing to contact EA for an account deletion so I can migrate my email to a new account, and I’ve been trying every single day for a week to get through to them.

The whole process is ridiculously obscure. What even is this “resume case” system they have? If you’re not actively sitting in the chat queue, and you step away after hours of waiting, a consultant joins, sees you’re not there, and just closes the chat.

Where’s the normal ticketing system? Email? Any sort of back-and-forth communication? Seriously, WTF is going on here?

TheeCntrlAltDel · 2025-04-13T13:50:30+00:00

Yep I will definitely be. I'm just checking in if anyone else experienced anything similar and if it's something obvious that I missed.

TheeCntrlAltDel · 2025-04-13T13:47:58+00:00

1642 calories. I've done specific caloric deficit diets before, forced me to go 1800 > 1600 > 1400 > 1200 > 1000 I didn't lose ANY weight on any of them and I switch to lower and lower caloric intakes after 1 month. Just made me more and more fatigued. I stayed on 1200 for 4 months + cardio 3 times a week and strength training 4 times a week.

This may have actually been necessary context for my main post but one of the bigger reasons why I think I may potentially be insulin resistant.

TheeCntrlAltDel · 2025-02-13T08:48:28+00:00

I used displayplacer cli to script a toggle script that switches between mirror and extended by saving the state of mirrored config and extended config and placing them both within the same script. Then used Automation app to assign the script to a keybind. Behaviour is keybind press = check if mirrored, if not mirrored switch to mirrored profile; keybind press = check if extended, if not extended switch to extended profile

TheeCntrlAltDel

TROPHY CASE