How to Troubleshoot Windows Errors
In This Tutorial
- You will learn about troubleshooting Windows boot problems
- You will learn about troubleshooting Windows GUI problems
- You will learn about troubleshooting Blue Screen Of Death (BSOD)
- You will learn about working with the Windows Registry
- You will learn about troubleshooting Tools in Windows
- You will learn about troubleshooting Windows application problems
- You will learn about researching Internet for solution to a problems
The Contents
- Failure to Boot
- NTLDR is Missing or BOOTMGR is missing
- Failure to Boot: Hardware or Configuration
- Failure to Boot: Windows XP
- Failure to Boot: Windows Vista/7/8/8.1/10
- Failure to Load the GUI
- Blue Screen Of Death (BSOD)
- Repair Install Windows OS
- Working with the Windows Registry
- Troubleshooting Tools in Windows
- Auto Loading Programs
- Application Problems
- System Files
- Using the Internet to Find Solutions to Problems
This tutorial looks at Windows problems from the ground up. It starts with catastrophic failure—a PC that won’t boot—and then discusses ways to get past that problem. The next section covers the causes and workarounds when the Windows GUI fails to load. Once you can access the Windows GUI, the many Windows diagnostic and troubleshooting tools that you’ve spent so much time learning about come to your fingertips.
Failure to Boot
When Windows fails to boot, you need to determine whether the problem relates to hardware or software.
Hard drive needs proper connectivity and power, and that CMOS must be configured correctly. If not, you’ll get an error like the one in below image.
If you see this screen, the problem could be with hardware. Windows hasn’t even started trying to
boot.
This issue may occur if one or more of the following conditions are true:
• The basic input/output system (BIOS) does not detect the hard disk.
• Booting from storage device or media that does not contain bootable operating system.
• The hard disk is damaged.
• Sector zero of the physical hard disk drive has an incorrect or malformed master boot record (MBR).
Note: Some third-party programs or disk corruption can damage an MBR.
• An incompatible partition is marked as Active.
• A partition that contains the MBR is no longer active.
Verify the BIOS Settings
Verify the computer's BIOS settings to make sure that BIOS lists and recognizes the hard disk.
See the computer documentation or contact the hardware manufacturer for information about how to verify the BIOS settings.
After you verify that the computer's BIOS detects the hard disk, restart the computer, and then test to determine whether the issue is resolved. If the issue is not resolved, or if the computer's BIOS cannot detect the hard disk, you may have issues with your hardware.
However, be aware that the damage to your hard disk may be serious. Sometimes this means that your only solution is to replace your hard disk.
Use Windows Recovery Environment
Use the fixmbr command in the Windows 2000 and XP Recovery Console to repair the Master Boot Record (MBR) of the hard disk drive.
Use the Bootrec /FixMbr command in the Windows Vista and later versions of Windows OS Command Prompt to repair the MBR of the hard disk drive.
Warning:These commands can damage your partition tables if a virus is present or if a hardware problem exists. If you use this command, you may create inaccessible partitions. I recommend that you run antivirus software before you use these commands. I also recommend that you backup your data before you use these commands.
NTLDR is Missing or BOOTMGR is missing
Entirely different set of errors such as NTLDR is Missing or BOOTMGR is missing.
You need a totally different set of tools from the ones used to troubleshoot Operating System not found error.
Windows XP and Windows Vista/7/8/8.1/10 boot differently, so to troubleshoot these failures to boot you need to know both processes and the tools available read my Overview of Microsoft Windows Operating Systems tutorial to learn more about how Windows XP and Windows Vista/7/8/8.1/10 boot differently.
To complete these steps, you must have a Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista or Windows XP installation disc.
Fix 1:
You can run Startup Repair tool from the Windows Recovery Environment (WinRE).
Read my Windows Recovery Environment tutorial to learn more about Windows Recovery Environment (WinRE).
Fix 2:
Rebuild the boot configuration data (BCD) from Windows Recovery Environment (WinRE)
In the System Recovery Options dialog box, click Command Prompt.
Type Bootrec /RebuildBcd command and then press ENTER.
You can also run System Restore tool from Windows Recovery Environment (WinRE).
The bootrec command-line tool is a Windows Recovery Environment troubleshooting and repair tool that repairs the master boot record, boot sector, or BCD store. It replaces the old fixboot, fixmbr and Bootcfg, Recovery Console commands.
Replace NTLDR and NTDETECT.COM files
Methods that you can use to troubleshoot the "NTLDR Is Missing" error message that you may receive when you try to start Microsoft Windows 2000 and Windows XP.
Windows XP users can replace the required files for NTLDR to load correctly by using your Windows Installation Disc. The files are named NTLDR and NTDETECT.COM.
Fix 1:
Here are the steps to replace these files:
1. Inserting your Windows XP install CD.
2. Restart your computer and boot from the CD.
3. Press any key to boot from the CD.
4. Press R when you reach the Windows Options menu to access Repair Console.
5. After this step you’ll need to log into Windows by pressing 1 using your Administrator password if you have one.
6. Use the following commands to copy the NTLDR and NTDETECT.COM files from the Windows installation disk to your hard disk drive:
Where X:\ is your inserted CD’s drive letter and C:\ drive letter is your Windows XP installed partition drive letter.
7. Once these files are copied, remove the Windows installation disc from the disc drive.
8. Restart your PC.
Fix 2:
The next steps are to rebuild the boot.ini file:
1. Inserting your Windows XP install CD.
2. Restart your computer and boot from the CD.
3. Press any key to boot from the CD.
4. Press R when you reach the Windows Options menu to access Repair Console.
5. Enter your Administrator password.
6. Enter the following command when Command Prompt appears:
7. Remove the install CD.
8. Restart your computer.
Fix 3:
Another easy fix is to make sure you don’t have any non-bootable media added recently in your computer, such as CDs, DVDs, USB flash drives etc.
This can also include any memory card you may have entered in the card reader. The NTLDR error may appear if your computer tries to boot from one of these non-bootable media devices.
You can prevent it by changing the boot order from BIOS setup utility to make sure your computer boots from the hard disk drive first, as primary source, and not from any other devices.
Fix 4:
A loose IDE cable can lead to this error to occur. Make sure both ends of your hard disk cable are not faulty or loose.
Try to connect and reconnect back the cable and restart your PC.
If none of the solutions are working for you, try to check if the IDE cable is faulty and replace it with a new one. You can check that by replacing it on another computer’s hard drive and restart that PC to see if it boots correctly.
Visit Microsoft website for more troubleshooting steps:
Windows may not start and you may receive an "NTLDR is missing" error message if Windows is not up-to-date and there are too many files in the root folder : https://support.microsoft.com/en-us/kb/320397
Failure to Boot: Hardware or Configuration
Most failed boot scenarios require you to determine where the fault occurred with the hardware and configuration, or in Windows. This is a pretty straight forward problem. Imagine that a user says “My PC won’t boot” or “My computer is dead.” At this point, your best tools are knowledge of the boot process and asking lots of questions. Here are some I use regularly:
“What displays on the screen—if anything—after you press the power button on the case?”
“What do you hear—if anything—after you press the power button on the case?”
“Is the PC plugged in?”
“Do you smell anything weird?”
Hardware problems can give you a blank screen on boot up, so follow the tried and true troubleshooting methodology for hardware. Make sure everything is plugged in and turned on. If the PC is new, as in less than 30 days old, you know it might have suffered a burn-in failure. If the customer smells something, one of the components might have fried. Try replacing with known good devices: RAM, power supply, CPU, hard drive, motherboard.
If the user says that the screen says “No boot device detected” and the system worked fine before, it could mean something as simple as the computer has attempted to boot to an incorrect device, such as to something other than the primary hard drive.
Failure to Boot: Windows XP
Windows boot errors take place in those short moments between the time POST ends and the Loading Windows screen begins. For Windows XP to start loading the main operating system, the critical system files ntldr, ntdetect.com, and boot.ini must reside in the root directory of the C: drive, and boot.ini must point to the Windows boot files. In a scenario where any of these requirements isn’t in place, the system won’t get past this step. Here are some of the common error messages you see at this point:
No Boot Device Present
NTLDR Bad or Missing
Invalid BOOT.INI
These text errors take place very early in the startup process. That’s your big clue that you have a boot issue. If you get to the Windows splash screen and then the computer locks up, that’s a whole different game, so know the difference.
Attempt to Repair by Using the Recovery Console
To begin troubleshooting one of these errors, boot from the Windows installation CD-ROM. You have four options from the initial screen: set up Windows XP, repair using the Recovery Console, perform a XP Repair Install and using the Automated System Recovery (ASR).
The Recovery Console, provides a command-line interface for working with Windows before the GUI starts. Press R to start the Recovery Console.
The Recovery Console shines in the business of manually restoring Registries, stopping problem services, rebuilding partitions (other than the system partition), and using the expand command to extract copies of corrupted files from an optical disc or floppy disk.
A bad boot sector usually shows up as a “No Boot Device” error. If it turns out that this isn’t the problem, using the Recovery Console command to fix it won’t hurt anything.
At the Recovery Console prompt, just type:
This fixes the master boot record (MBR) and Boot Sector.
If the boot.ini file is gone or corrupted, run this below command from the Recovery Console:
The Recovery Console will try to locate all installed copies of Windows and ask you if you want to add them to the new boot.ini file it’s about to create. Type yes to the ones you want.
You may receive a message that is similar to the following message:
Total Identified Windows Installs: 2
[1] C:\Windows
Add installation to boot list? (Yes/No/All):
Enter Load Identifier: (Custom description for an operating system loading from the Boot menu)
Enter Operating System Load Options: (that is: /fastdetect)
[2] D:\Windows
Add installation to boot list? (Yes/No/All):
Enter Load Identifier: (Custom description for an operating system loading from the Boot menu)
Enter Operating System Load Options: (that is: /fastdetect)
If the Recovery Console does not do the trick, the next step is to restore Windows XP.
Attempt to Restore
If you’ve been diligent about backing up, you can attempt to restore to an earlier, working copy of Windows. Assuming you made an Automated System Recovery (ASR) backup, this will restore your system to a previously installed state, but you should use it as a last resort. You lose everything on the system that was installed or added after you created the ASR disk.
Rebuild
If faced with a full system rebuild, you have several options, depending on the particular system. You could simply reboot to the Windows CD-ROM and install right on top of the existing system, what’s called a repair installation.
Most OEM systems come with a misleadingly named Recovery CD or recovery partition. The Recovery CD is a CD-ROM that you boot to and run. The recovery partition is a hidden partition on the hard drive that you activate at boot by holding down a key combination specific to the manufacturer of that system. (See the motherboard manual or users’ guide for the key combination and other details.)
Both “recovery” options do the same thing, that is to restore your computer to the factory installed state. If you run one of these tools, you will wipe everything off your system all personal files, folders, and programs will permanently deleted!
Before running either tool, make sure all important files and folders are backed up on an optical disc or spare hard drive.
Failure to Boot: Windows Vista/7/8/8.1/10
With Windows Vista, Microsoft upgraded the installation environment from the 16-bit text mode environment used in every previous version of Windows to 32- and 64-bit. This upgrade enabled the Windows installation process to go graphical and support features such as a mouse pointer and clickable elements, rather than relying on command-line tools. Microsoft calls the installation environment the Windows Preinstallation Environment (WinPE or Windows PE). With Windows PE, you can boot directly to the Windows DVD. This loads a limited function graphical operating system that contains both troubleshooting and diagnostic tools, along with installation options. The Windows installation media is called a Live DVD because WinPE loads directly from disc into memory and doesn’t access or modify the hard drive.
When you access Windows PE and opt for the troubleshooting and repair features, you open a special set of tools from the Windows Recovery Environment (WinRE or Windows RE). The terms can get a little confusing because of the similarity of letters, so mark this: Windows RE is the repair tools that run within Windows PE. WinPE powers WinRE. Got it?
Let’s tackle WinRE.
You can read my tutorial to learn more about Windows Recovery Environment.
Note: Microsoft also refers to the Windows Recovery Environment as the "System Recovery Options" menu.
Startup Repair
The Startup Repair utility serves as a one-stop, do-it-all option. When run, it performs a number of repairs, including:
• Repairs a corrupted Registry by accessing the backup copy on your hard drive
• Restores critical system and driver files
• Runs the equivalent of the Recovery Console’s fixboot and fixmbr
• Rolls back any non-working drivers
• Uninstalls any incompatible service packs and patches
• Runs chkdsk
• Runs a memory test to check your RAM
Startup Repair fixes almost any Windows boot problem. In fact, if you have a system with one hard drive containing a single partition with Windows Vista/7/8/8.1/10 installed, you’d have trouble findings something it couldn’t fix. Upon completion, Startup Repair shows the screen below.
Note the link that says View diagnostic and repair details. This opens a text file called srttrail.txt that lists exactly what the program found, what it fixed, and what it failed to do. It may look cryptic, but you can type anything you find into Google search engine for more information.
In Windows 7/8/8.1/10, Startup Repair starts automatically if your system detects a boot problem.
Personally, I think this menu pops up way too often. If you fail to shut down your computer properly, for example, this menu appears. In this case, you can save time by booting normally. When in doubt, however, go ahead and run Startup Repair. It can’t hurt anything.
Windows Memory Diagnostics (Tool)
Bad RAM causes huge problems for any operating system, creating scenarios where computers get Blue Screens of Death (BSOD’s), system lockups, and continuous reboots. Starting with Windows Vista, Microsoft added a memory tester to the Windows Recovery Environment.
You can also use more advanced memory diagnostic tool like [url=Memtest86+]http://www.memtest.org[/url] live CD.
Note: You can also find the Windows Memory Diagnostics Tool in the “Control Panel --> System and Security --> Administrative Tools”, or start it from an administrative Command Prompt using the [c]mdsched[/c] command.
Failure to Load the GUI
Assuming that Windows gets past the boot part of the startup, it then begins to load the graphical Windows OS.
You will see the Windows startup image on the screen, hiding everything until Windows loads the desktop.
Several issues can create a scenario where the graphical interface fails to load. Windows can hang during the GUI-loading phase because of buggy device drivers or Registry problems. Even auto loading programs can cause the GUI to hang on load. The first step in troubleshooting these sorts of scenarios is to use one of the options in Advanced Boot Options menu to try to get past the hang spot and into Windows. To get to this menu, restart the computer and press F8 after the POST messages but before the Windows logo screen appears.
Here’s a rundown of the Advanced Boot Options menu options.
Safe Mode Starts up Windows but loads only very basic, non-vendor-specific drivers for mouse, 640 x 480 resolution monitor (in XP) and 800 x 600 resolution monitor (Vista and 7), keyboard, mass storage, and system services.
Once in Safe Mode, you can use tools such as Device Manager to locate and correct the source of the problem. You can disable any suspect device or perform other tasks, such as removing or updating drivers. If a problem with a device driver is preventing the operating system from starting normally, check Device Manager for warning icons that indicate an unknown device.
You can perform Clean Boot of Windows OS. A clean boot is performed to start Windows by disabling third-party or Microsoft services and startup programs.
https://support.microsoft.com/en-us/kb/929135
When you start Windows by using a normal startup operation, several applications and services start automatically, and then run in the background. These programs include basic system processes, antivirus software, system utility applications, and other software that has been previously installed. These applications and services can cause software conflicts. After the computer is restarted, you will have a clean boot environment which you can use to troubleshot startup, installation or uninstallation programs and not able to run programs.
You can use System Restore from within Safe Mode to restore Windows OS to good working date.
Safe Mode with Networking This mode is identical to plain Safe Mode except that you get network support. I use this mode to download antivirus software’s and download device drivers if none of these actions cannot be done when Windows boots into normal mode.
Safe Mode with Command Prompt When you start Windows in this mode, rather than loading the GUI desktop, it loads the Command Prompt (cmd.exe) as the shell to the operating system after you log on.
From here you can run any of the commands, plus a lot of utilities as well. Safe Mode with Command Prompt is a handy option to remember if the desktop does not display at all, which, after you have eliminated video drivers, can be caused by corruption of the explorer.exe program. Although Explorer is not loaded, you can load other GUI tools that don’t depend on Explorer. All you have to do is enter the correct command. For instance, to load Event Viewer, type eventvwr.msc at the Command Prompt and press ENTER key.
Full list of commands you can use at command Prompt visit : An A-Z Index of the Windows CMD command line
Enable Boot Logging This option starts Windows normally and creates a log file of the drivers as they load into memory. The file is named Ntbtlog.txt and is saved in the ‘C:\Windows’ folder. If the startup failed because of a bad driver, the last entry in this file may be the driver the OS was initializing when it failed. Reboot and go into the Recovery Console or WinRE. Use the tools there to read the boot log (type ntbtlog.txt) and disable or enable problematic devices or services.
Enable VGA Mode (XP)/Enable Low-Resolution Mode (Vista and 7) Enables VGA Mode/Enables Low-Resolution Mode starts Windows normally, but only loads a default VGA driver. If this mode works, it may mean you have a bad graphic card driver, or it may mean you are using the correct graphic card driver but it is configured incorrectly (perhaps with the wrong refresh rate and/or resolution). Whereas Safe Mode loads a generic VGA driver, this mode loads the driver Windows is configured to use but starts it up in standard VGA mode rather than using the settings for which it is configured. After successfully starting in this mode, open the Display applet and change the settings.
Last Known Good Configuration When Windows’ startup fails immediately after installing a new driver but before you have logged on again, try the Last Known Good Configuration option. This option applies specifically to new device drivers that cause failures on reboot. The "Last Known Good Configuration" only saves copy of a system's hardware configurations and the services, driver settings taken from the system's registry when the OS successfully boots. Using the Last Known Good Configuration restores previous drivers and also restores registry settings for the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet subkey.
Directory Services Restore Mode The title says it all here; this option only applies to Active Directory domain controllers, and only Windows Server versions can be domain controllers. I have no idea why Microsoft includes this option. If you choose it, you simply boot into Safe Mode.
Debugging Mode If you select this choice, Windows starts in kernel debug mode. To do this, you have to connect the computer you are debugging to another computer via a serial connection, and as Windows starts up, a debug of the kernel is sent to the second computer, which must also be running a debugger program.
Disable Automatic Restart on System Failure Sometimes a BSoD will appear at startup, causing your computer to spontaneously reboot. That’s all well and good, but if it happens too quickly, you might not be able to read the BSoD to see what caused the problem. Selecting Disable automatic restart on system failure from the Advanced Startup Options menu stops the computer from rebooting on Stop errors. This gives you the opportunity to write down the error and hopefully find a fix.
Disable Driver Signature Enforcement Windows Vista/7/8/8.1/10 require that all very low-level drivers (kernel drivers) must have a Microsoft driver signature. If you are using an older driver to connect to your hard drive controller or some other low-level feature, you must use this option to get Windows to load the driver. Hopefully you will always check your motherboard and hard drives for Windows compatibility and never have to use this option.
Viruses can cause the GUI to fail or make it appear to be missing. One nasty one running around, for example, caused what appeared to be a BSoD warning of imminent hard drive controller failure. Even after getting rid of the virus, Windows appeared devoid of any graphical elements at all: no Start button, icons, or files even in Computer. That’s because the virus had changed the attributes of every file and folder on the hard drive to hidden! The attrib command can be used for recovery techniques for virus-attacked computers.
Blue Screen Of Death (BSOD)
BSOD’s can be caused by poorly written device drivers or malfunctioning hardware, such as faulty memory, power supply issues, overheating of components, or hardware running beyond its specification limits.
The BSOD only appears when something causes an error from which Windows cannot recover. The BSOD is not limited to device driver problems, but device drivers are one of the reasons you’ll see the BSOD.
When dealing with BSOD issue asking lots of questions can narrow down cause of the BSOD. Here are some of the questions I ask:
• Did you recently install a new program?
• Did you recently install a new device or update or install a device driver
• Are you overclocking your PC?
• Have you installed all available Windows updates?
Knowing if program has been installed recently before BSOD issue started can help resolve BSOD issue as some programs do install device drivers that can be buggy.
Knowing if recently any device connected to computer can help as device itself could be malfunctioning or the device driver is buggy which in both case can cause BSOD.
Device driver problems that stop Windows GUI from loading look pretty scary. Infamous Windows Stop error, better known as the Blue Screen of Death (BSOD).
Whenever faced with a scenario where you get a BSoD, read what it says. Windows BSoD’s may tell you the name of the file that caused the problem and usually suggests a recommended action. Once in a while these are helpful. Above screenshot of BSOD indicates that the “SPCMDCON.SYS” driver cause the BSOD, user needs to uninstall this driver and install latest updated version of this driver.
By default, Windows will create a memory dump file when a stop BSOD occurs. Windows stores BSOD memory dump files at "C:\Windows\MiniDump" folder. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64kB "mini dump" (introduced in Windows 2000) to a "complete dump" which is effectively a copy of the entire contents of physical memory (RAM). The resulting memory dump file may be debugged later, using a kernel debugger. For Windows WinDBG or KD debuggers from Debugging Tools for Windows are used.
Diagnostics tool called BlueScreenView, which is used for analyzing Windows kernel memory dumps. BlueScreenView offers detailed information. It will automatically load minidump files found in the root folder.
A debugger is necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information on-screen is limited and thus possibly misleading, it may hide the true source of the error.
The second indication of a device problem that shows up during the GUI part of startup is a freeze-up: the Windows startup screen just stays there and you never get a chance to log on. If this happens, try one of the options from Advanced Startup Options.
I like to say thank you to usasma for contributing to this BSOD introduction he has write down a short notes for you all to follow to troubleshot BSOD errors.
Configure Driver Verifier to find out which driver is causing the Blue Screen Of Death (BSOD). Driver Verifier monitors Windows kernel-mode drivers, graphics drivers, and even 3rd party drivers to detect illegal function calls or actions that might corrupt the system. Driver Verifier can subject the Windows drivers to a variety of stresses and tests to find improper behaviour. Essentially, if there's a 3rd party driver believed to be causing the issues at hand, enabling Driver Verifier will help us see which specific driver is causing the problem.
Perhaps the most important which I will now clarify as this has been misunderstood often, enabling Driver Verifier by itself is not a solution, but instead a diagnostic utility. It will tell us if a driver is causing the BSOD, but again it will not outright solve your issues. If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is to look for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue.
Troubleshooting BSOD Stop Bugcheck Messages
https://support.microsoft.com/en-us/kb/3106831
http://www.carrona.org/bsod.html
https://support.microsoft.com/en-us/kb/244617
Failure to Boot
When Windows fails to boot, you need to determine whether the problem relates to hardware or software.
Hard drive needs proper connectivity and power, and that CMOS must be configured correctly. If not, you’ll get an error like the one in below image.
If you see this screen, the problem could be with hardware. Windows hasn’t even started trying to
boot.
This issue may occur if one or more of the following conditions are true:
• The basic input/output system (BIOS) does not detect the hard disk.
• Booting from storage device or media that does not contain bootable operating system.
• The hard disk is damaged.
• Sector zero of the physical hard disk drive has an incorrect or malformed master boot record (MBR).
Note: Some third-party programs or disk corruption can damage an MBR.
• An incompatible partition is marked as Active.
• A partition that contains the MBR is no longer active.
Verify the BIOS Settings
Verify the computer's BIOS settings to make sure that BIOS lists and recognizes the hard disk.
See the computer documentation or contact the hardware manufacturer for information about how to verify the BIOS settings.
After you verify that the computer's BIOS detects the hard disk, restart the computer, and then test to determine whether the issue is resolved. If the issue is not resolved, or if the computer's BIOS cannot detect the hard disk, you may have issues with your hardware.
However, be aware that the damage to your hard disk may be serious. Sometimes this means that your only solution is to replace your hard disk.
Use Windows Recovery Environment
Use the fixmbr command in the Windows 2000 and XP Recovery Console to repair the Master Boot Record (MBR) of the hard disk drive.
Use the Bootrec /FixMbr command in the Windows Vista and later versions of Windows OS Command Prompt to repair the MBR of the hard disk drive.
Warning:These commands can damage your partition tables if a virus is present or if a hardware problem exists. If you use this command, you may create inaccessible partitions. I recommend that you run antivirus software before you use these commands. I also recommend that you backup your data before you use these commands.
NTLDR is Missing or BOOTMGR is missing
Entirely different set of errors such as NTLDR is Missing or BOOTMGR is missing.
You need a totally different set of tools from the ones used to troubleshoot Operating System not found error.
Windows XP and Windows Vista/7/8/8.1/10 boot differently, so to troubleshoot these failures to boot you need to know both processes and the tools available read my Overview of Microsoft Windows Operating Systems tutorial to learn more about how Windows XP and Windows Vista/7/8/8.1/10 boot differently.
To complete these steps, you must have a Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista or Windows XP installation disc.
Fix 1:
You can run Startup Repair tool from the Windows Recovery Environment (WinRE).
Read my Windows Recovery Environment tutorial to learn more about Windows Recovery Environment (WinRE).
Fix 2:
Rebuild the boot configuration data (BCD) from Windows Recovery Environment (WinRE)
In the System Recovery Options dialog box, click Command Prompt.
Type Bootrec /RebuildBcd command and then press ENTER.
You can also run System Restore tool from Windows Recovery Environment (WinRE).
The bootrec command-line tool is a Windows Recovery Environment troubleshooting and repair tool that repairs the master boot record, boot sector, or BCD store. It replaces the old fixboot, fixmbr and Bootcfg, Recovery Console commands.
Replace NTLDR and NTDETECT.COM files
Methods that you can use to troubleshoot the "NTLDR Is Missing" error message that you may receive when you try to start Microsoft Windows 2000 and Windows XP.
Windows XP users can replace the required files for NTLDR to load correctly by using your Windows Installation Disc. The files are named NTLDR and NTDETECT.COM.
Fix 1:
Here are the steps to replace these files:
1. Inserting your Windows XP install CD.
2. Restart your computer and boot from the CD.
3. Press any key to boot from the CD.
4. Press R when you reach the Windows Options menu to access Repair Console.
5. After this step you’ll need to log into Windows by pressing 1 using your Administrator password if you have one.
6. Use the following commands to copy the NTLDR and NTDETECT.COM files from the Windows installation disk to your hard disk drive:
Code:
Copy X:\i386\ntldr C:\
Copy X:\i386\ntdetect.com C:\
Where X:\ is your inserted CD’s drive letter and C:\ drive letter is your Windows XP installed partition drive letter.
7. Once these files are copied, remove the Windows installation disc from the disc drive.
8. Restart your PC.
Fix 2:
The next steps are to rebuild the boot.ini file:
1. Inserting your Windows XP install CD.
2. Restart your computer and boot from the CD.
3. Press any key to boot from the CD.
4. Press R when you reach the Windows Options menu to access Repair Console.
5. Enter your Administrator password.
6. Enter the following command when Command Prompt appears:
Code:
bootcfg /rebuild
7. Remove the install CD.
8. Restart your computer.
Fix 3:
Another easy fix is to make sure you don’t have any non-bootable media added recently in your computer, such as CDs, DVDs, USB flash drives etc.
This can also include any memory card you may have entered in the card reader. The NTLDR error may appear if your computer tries to boot from one of these non-bootable media devices.
You can prevent it by changing the boot order from BIOS setup utility to make sure your computer boots from the hard disk drive first, as primary source, and not from any other devices.
Fix 4:
A loose IDE cable can lead to this error to occur. Make sure both ends of your hard disk cable are not faulty or loose.
Try to connect and reconnect back the cable and restart your PC.
If none of the solutions are working for you, try to check if the IDE cable is faulty and replace it with a new one. You can check that by replacing it on another computer’s hard drive and restart that PC to see if it boots correctly.
Visit Microsoft website for more troubleshooting steps:
Windows may not start and you may receive an "NTLDR is missing" error message if Windows is not up-to-date and there are too many files in the root folder : https://support.microsoft.com/en-us/kb/320397
Failure to Boot: Hardware or Configuration
Most failed boot scenarios require you to determine where the fault occurred with the hardware and configuration, or in Windows. This is a pretty straight forward problem. Imagine that a user says “My PC won’t boot” or “My computer is dead.” At this point, your best tools are knowledge of the boot process and asking lots of questions. Here are some I use regularly:
“What displays on the screen—if anything—after you press the power button on the case?”
“What do you hear—if anything—after you press the power button on the case?”
“Is the PC plugged in?”
“Do you smell anything weird?”
Hardware problems can give you a blank screen on boot up, so follow the tried and true troubleshooting methodology for hardware. Make sure everything is plugged in and turned on. If the PC is new, as in less than 30 days old, you know it might have suffered a burn-in failure. If the customer smells something, one of the components might have fried. Try replacing with known good devices: RAM, power supply, CPU, hard drive, motherboard.
If the user says that the screen says “No boot device detected” and the system worked fine before, it could mean something as simple as the computer has attempted to boot to an incorrect device, such as to something other than the primary hard drive.
Failure to Boot: Windows XP
Windows boot errors take place in those short moments between the time POST ends and the Loading Windows screen begins. For Windows XP to start loading the main operating system, the critical system files ntldr, ntdetect.com, and boot.ini must reside in the root directory of the C: drive, and boot.ini must point to the Windows boot files. In a scenario where any of these requirements isn’t in place, the system won’t get past this step. Here are some of the common error messages you see at this point:
No Boot Device Present
NTLDR Bad or Missing
Invalid BOOT.INI
These text errors take place very early in the startup process. That’s your big clue that you have a boot issue. If you get to the Windows splash screen and then the computer locks up, that’s a whole different game, so know the difference.
Attempt to Repair by Using the Recovery Console
To begin troubleshooting one of these errors, boot from the Windows installation CD-ROM. You have four options from the initial screen: set up Windows XP, repair using the Recovery Console, perform a XP Repair Install and using the Automated System Recovery (ASR).
The Recovery Console, provides a command-line interface for working with Windows before the GUI starts. Press R to start the Recovery Console.
The Recovery Console shines in the business of manually restoring Registries, stopping problem services, rebuilding partitions (other than the system partition), and using the expand command to extract copies of corrupted files from an optical disc or floppy disk.
A bad boot sector usually shows up as a “No Boot Device” error. If it turns out that this isn’t the problem, using the Recovery Console command to fix it won’t hurt anything.
At the Recovery Console prompt, just type:
Code:
Fixmbr
Fixboot
This fixes the master boot record (MBR) and Boot Sector.
If the boot.ini file is gone or corrupted, run this below command from the Recovery Console:
Code:
Bootcfg /rebuild
The Recovery Console will try to locate all installed copies of Windows and ask you if you want to add them to the new boot.ini file it’s about to create. Type yes to the ones you want.
You may receive a message that is similar to the following message:
Total Identified Windows Installs: 2
[1] C:\Windows
Add installation to boot list? (Yes/No/All):
Enter Load Identifier: (Custom description for an operating system loading from the Boot menu)
Enter Operating System Load Options: (that is: /fastdetect)
[2] D:\Windows
Add installation to boot list? (Yes/No/All):
Enter Load Identifier: (Custom description for an operating system loading from the Boot menu)
Enter Operating System Load Options: (that is: /fastdetect)
If the Recovery Console does not do the trick, the next step is to restore Windows XP.
Attempt to Restore
If you’ve been diligent about backing up, you can attempt to restore to an earlier, working copy of Windows. Assuming you made an Automated System Recovery (ASR) backup, this will restore your system to a previously installed state, but you should use it as a last resort. You lose everything on the system that was installed or added after you created the ASR disk.
Rebuild
If faced with a full system rebuild, you have several options, depending on the particular system. You could simply reboot to the Windows CD-ROM and install right on top of the existing system, what’s called a repair installation.
Most OEM systems come with a misleadingly named Recovery CD or recovery partition. The Recovery CD is a CD-ROM that you boot to and run. The recovery partition is a hidden partition on the hard drive that you activate at boot by holding down a key combination specific to the manufacturer of that system. (See the motherboard manual or users’ guide for the key combination and other details.)
Both “recovery” options do the same thing, that is to restore your computer to the factory installed state. If you run one of these tools, you will wipe everything off your system all personal files, folders, and programs will permanently deleted!
Before running either tool, make sure all important files and folders are backed up on an optical disc or spare hard drive.
Failure to Boot: Windows Vista/7/8/8.1/10
With Windows Vista, Microsoft upgraded the installation environment from the 16-bit text mode environment used in every previous version of Windows to 32- and 64-bit. This upgrade enabled the Windows installation process to go graphical and support features such as a mouse pointer and clickable elements, rather than relying on command-line tools. Microsoft calls the installation environment the Windows Preinstallation Environment (WinPE or Windows PE). With Windows PE, you can boot directly to the Windows DVD. This loads a limited function graphical operating system that contains both troubleshooting and diagnostic tools, along with installation options. The Windows installation media is called a Live DVD because WinPE loads directly from disc into memory and doesn’t access or modify the hard drive.
When you access Windows PE and opt for the troubleshooting and repair features, you open a special set of tools from the Windows Recovery Environment (WinRE or Windows RE). The terms can get a little confusing because of the similarity of letters, so mark this: Windows RE is the repair tools that run within Windows PE. WinPE powers WinRE. Got it?
Let’s tackle WinRE.
You can read my tutorial to learn more about Windows Recovery Environment.
Note: Microsoft also refers to the Windows Recovery Environment as the "System Recovery Options" menu.
Startup Repair
The Startup Repair utility serves as a one-stop, do-it-all option. When run, it performs a number of repairs, including:
• Repairs a corrupted Registry by accessing the backup copy on your hard drive
• Restores critical system and driver files
• Runs the equivalent of the Recovery Console’s fixboot and fixmbr
• Rolls back any non-working drivers
• Uninstalls any incompatible service packs and patches
• Runs chkdsk
• Runs a memory test to check your RAM
Startup Repair fixes almost any Windows boot problem. In fact, if you have a system with one hard drive containing a single partition with Windows Vista/7/8/8.1/10 installed, you’d have trouble findings something it couldn’t fix. Upon completion, Startup Repair shows the screen below.
Note the link that says View diagnostic and repair details. This opens a text file called srttrail.txt that lists exactly what the program found, what it fixed, and what it failed to do. It may look cryptic, but you can type anything you find into Google search engine for more information.
In Windows 7/8/8.1/10, Startup Repair starts automatically if your system detects a boot problem.
Personally, I think this menu pops up way too often. If you fail to shut down your computer properly, for example, this menu appears. In this case, you can save time by booting normally. When in doubt, however, go ahead and run Startup Repair. It can’t hurt anything.
Windows Memory Diagnostics (Tool)
Bad RAM causes huge problems for any operating system, creating scenarios where computers get Blue Screens of Death (BSOD’s), system lockups, and continuous reboots. Starting with Windows Vista, Microsoft added a memory tester to the Windows Recovery Environment.
You can also use more advanced memory diagnostic tool like [url=Memtest86+]http://www.memtest.org[/url] live CD.
Note: You can also find the Windows Memory Diagnostics Tool in the “Control Panel --> System and Security --> Administrative Tools”, or start it from an administrative Command Prompt using the [c]mdsched[/c] command.
Failure to Load the GUI
Assuming that Windows gets past the boot part of the startup, it then begins to load the graphical Windows OS.
You will see the Windows startup image on the screen, hiding everything until Windows loads the desktop.
Several issues can create a scenario where the graphical interface fails to load. Windows can hang during the GUI-loading phase because of buggy device drivers or Registry problems. Even auto loading programs can cause the GUI to hang on load. The first step in troubleshooting these sorts of scenarios is to use one of the options in Advanced Boot Options menu to try to get past the hang spot and into Windows. To get to this menu, restart the computer and press F8 after the POST messages but before the Windows logo screen appears.
Here’s a rundown of the Advanced Boot Options menu options.
Safe Mode Starts up Windows but loads only very basic, non-vendor-specific drivers for mouse, 640 x 480 resolution monitor (in XP) and 800 x 600 resolution monitor (Vista and 7), keyboard, mass storage, and system services.
Once in Safe Mode, you can use tools such as Device Manager to locate and correct the source of the problem. You can disable any suspect device or perform other tasks, such as removing or updating drivers. If a problem with a device driver is preventing the operating system from starting normally, check Device Manager for warning icons that indicate an unknown device.
You can perform Clean Boot of Windows OS. A clean boot is performed to start Windows by disabling third-party or Microsoft services and startup programs.
https://support.microsoft.com/en-us/kb/929135
When you start Windows by using a normal startup operation, several applications and services start automatically, and then run in the background. These programs include basic system processes, antivirus software, system utility applications, and other software that has been previously installed. These applications and services can cause software conflicts. After the computer is restarted, you will have a clean boot environment which you can use to troubleshot startup, installation or uninstallation programs and not able to run programs.
You can use System Restore from within Safe Mode to restore Windows OS to good working date.
Safe Mode with Networking This mode is identical to plain Safe Mode except that you get network support. I use this mode to download antivirus software’s and download device drivers if none of these actions cannot be done when Windows boots into normal mode.
Safe Mode with Command Prompt When you start Windows in this mode, rather than loading the GUI desktop, it loads the Command Prompt (cmd.exe) as the shell to the operating system after you log on.
From here you can run any of the commands, plus a lot of utilities as well. Safe Mode with Command Prompt is a handy option to remember if the desktop does not display at all, which, after you have eliminated video drivers, can be caused by corruption of the explorer.exe program. Although Explorer is not loaded, you can load other GUI tools that don’t depend on Explorer. All you have to do is enter the correct command. For instance, to load Event Viewer, type eventvwr.msc at the Command Prompt and press ENTER key.
Full list of commands you can use at command Prompt visit : An A-Z Index of the Windows CMD command line
Enable Boot Logging This option starts Windows normally and creates a log file of the drivers as they load into memory. The file is named Ntbtlog.txt and is saved in the ‘C:\Windows’ folder. If the startup failed because of a bad driver, the last entry in this file may be the driver the OS was initializing when it failed. Reboot and go into the Recovery Console or WinRE. Use the tools there to read the boot log (type ntbtlog.txt) and disable or enable problematic devices or services.
Enable VGA Mode (XP)/Enable Low-Resolution Mode (Vista and 7) Enables VGA Mode/Enables Low-Resolution Mode starts Windows normally, but only loads a default VGA driver. If this mode works, it may mean you have a bad graphic card driver, or it may mean you are using the correct graphic card driver but it is configured incorrectly (perhaps with the wrong refresh rate and/or resolution). Whereas Safe Mode loads a generic VGA driver, this mode loads the driver Windows is configured to use but starts it up in standard VGA mode rather than using the settings for which it is configured. After successfully starting in this mode, open the Display applet and change the settings.
Last Known Good Configuration When Windows’ startup fails immediately after installing a new driver but before you have logged on again, try the Last Known Good Configuration option. This option applies specifically to new device drivers that cause failures on reboot. The "Last Known Good Configuration" only saves copy of a system's hardware configurations and the services, driver settings taken from the system's registry when the OS successfully boots. Using the Last Known Good Configuration restores previous drivers and also restores registry settings for the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet subkey.
Directory Services Restore Mode The title says it all here; this option only applies to Active Directory domain controllers, and only Windows Server versions can be domain controllers. I have no idea why Microsoft includes this option. If you choose it, you simply boot into Safe Mode.
Debugging Mode If you select this choice, Windows starts in kernel debug mode. To do this, you have to connect the computer you are debugging to another computer via a serial connection, and as Windows starts up, a debug of the kernel is sent to the second computer, which must also be running a debugger program.
Disable Automatic Restart on System Failure Sometimes a BSoD will appear at startup, causing your computer to spontaneously reboot. That’s all well and good, but if it happens too quickly, you might not be able to read the BSoD to see what caused the problem. Selecting Disable automatic restart on system failure from the Advanced Startup Options menu stops the computer from rebooting on Stop errors. This gives you the opportunity to write down the error and hopefully find a fix.
Disable Driver Signature Enforcement Windows Vista/7/8/8.1/10 require that all very low-level drivers (kernel drivers) must have a Microsoft driver signature. If you are using an older driver to connect to your hard drive controller or some other low-level feature, you must use this option to get Windows to load the driver. Hopefully you will always check your motherboard and hard drives for Windows compatibility and never have to use this option.
Viruses can cause the GUI to fail or make it appear to be missing. One nasty one running around, for example, caused what appeared to be a BSoD warning of imminent hard drive controller failure. Even after getting rid of the virus, Windows appeared devoid of any graphical elements at all: no Start button, icons, or files even in Computer. That’s because the virus had changed the attributes of every file and folder on the hard drive to hidden! The attrib command can be used for recovery techniques for virus-attacked computers.
Blue Screen Of Death (BSOD)
BSOD’s can be caused by poorly written device drivers or malfunctioning hardware, such as faulty memory, power supply issues, overheating of components, or hardware running beyond its specification limits.
The BSOD only appears when something causes an error from which Windows cannot recover. The BSOD is not limited to device driver problems, but device drivers are one of the reasons you’ll see the BSOD.
When dealing with BSOD issue asking lots of questions can narrow down cause of the BSOD. Here are some of the questions I ask:
• Did you recently install a new program?
• Did you recently install a new device or update or install a device driver
• Are you overclocking your PC?
• Have you installed all available Windows updates?
Knowing if program has been installed recently before BSOD issue started can help resolve BSOD issue as some programs do install device drivers that can be buggy.
Knowing if recently any device connected to computer can help as device itself could be malfunctioning or the device driver is buggy which in both case can cause BSOD.
Device driver problems that stop Windows GUI from loading look pretty scary. Infamous Windows Stop error, better known as the Blue Screen of Death (BSOD).
Whenever faced with a scenario where you get a BSoD, read what it says. Windows BSoD’s may tell you the name of the file that caused the problem and usually suggests a recommended action. Once in a while these are helpful. Above screenshot of BSOD indicates that the “SPCMDCON.SYS” driver cause the BSOD, user needs to uninstall this driver and install latest updated version of this driver.
By default, Windows will create a memory dump file when a stop BSOD occurs. Windows stores BSOD memory dump files at "C:\Windows\MiniDump" folder. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64kB "mini dump" (introduced in Windows 2000) to a "complete dump" which is effectively a copy of the entire contents of physical memory (RAM). The resulting memory dump file may be debugged later, using a kernel debugger. For Windows WinDBG or KD debuggers from Debugging Tools for Windows are used.
Diagnostics tool called BlueScreenView, which is used for analyzing Windows kernel memory dumps. BlueScreenView offers detailed information. It will automatically load minidump files found in the root folder.
A debugger is necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information on-screen is limited and thus possibly misleading, it may hide the true source of the error.
The second indication of a device problem that shows up during the GUI part of startup is a freeze-up: the Windows startup screen just stays there and you never get a chance to log on. If this happens, try one of the options from Advanced Startup Options.
I like to say thank you to usasma for contributing to this BSOD introduction he has write down a short notes for you all to follow to troubleshot BSOD errors.
usasma wrote:
There are 2 causes for BSOD's, but due to the differences in frequency we address them as 3 causes:
- 3rd party driver problems (over 90% of BSOD errors are due to this)
- hardware problems (less than 10% of BSOD errors are due to this)
- Windows driver problems (less than 1% of BSOD errors are due to this - as long as Windows Updates are up to date)
And, just to make things more difficult, there are grey areas between the 3:
A 3rd party driver error can actually be due to hardware.
Some hardware errors can be caused by low-level driver issues or incompatibilities.
And some Windows issues are actually due to 3rd party drivers.
As such, BSOD analysis is sometimes simply playing the odds.
Fix all the most likely problems and you'll usually fix the BSOD's
If not, just keep playing the odds.
There are 2 types of BSOD's:
- simple
- complex
Simple one's are just that - you figure out what's wrong, you fix it, and the BSOD's stop
Complex one's are a bit different - you may fix them or you may not.
If not, then they may continue to BSOD, or they may show other errors (most common is a black screen)
Just treat it as a new error and diagnose it as such.
How do you tell if a BSOD has been fixed? It doesn't come back.
How long should you wait? It depends on the error and it's original frequency.
In most cases I wait a week before thinking of success, then another week before I become relatively assured of success.
Patterns:
- the most important thing with BSOD analysis is the ability to recognize patterns.
- along with this goes the ability to recognize the lack of a pattern.
In most cases patterns will lead you to the cause of the BSOD.
That's what we use all of the reports for - looking for patterns.
Recognizing patterns in the midst of seemingly random errors is crucial.
If you can do this, then the truly "random" errors will most likely be hardware issues - which cuts your work down immensely.
BUt remember the grey areas - a hardware-like error can actually be due to other problems.
When in doubt, run hardware diagnostics. I maintain a list of suggested free diagnostics here: http://www.carrona.org/hwdiag.html
You cannot fix a system that has a hardware failure unless you remove/replace the defective component (no, disabling it will not work).
FWIW - the ultimate hardware test is replacing the questionable component.
This is even true if the component has failed a hardware diagnostic (and it does happen).
If the user doesn't have a replacement component to test with, try:
- removing the component and it's drivers and then seeing if the BSOD's stop
- purchasing a new component from a store that will refund their money if the component isn't needed, and testing with that component.
Check the Usual Causes section of http://www.carrona.org/bsodindx.html for errors that have hardware problems associated with them.
Look at the memory dumps - they may suggest hardware in the output.
Other possibilities are those memory dumps with few 3rd party drivers listed.
Also, you may find instances of hal.dll in the stack text
These aren't diagnostically significant, but are suggestive enough to run hardware diagnostics.
Windows driver issues.
First and foremost is the assumption that a Windows driver that is blamed in a memory dump is probably not actually to blame.
Windows has built in error correcting mechanisms to keep this from happening.
Also, should a Windows driver cause problems, then you'd likely see more problems other than the occasional BSOD.
Secondy, Windows must be fully updated. If it's not, ask the OP to do it.
Without updates you're doomed to second guess the OP and their ability to determine what's wrong
And if they were able to determine it, why are they asking you to interpret it for them?
Windows updates rarely break things. And if they do, they're usually fixed very quickly
I say this being the victim of a STOP 0x6B BSOD due to a recent Windows Update for build 10565 of W10.
If a Windows Update is blamed - look for the underlying problem that caused the update to be blamed.
Most often it'll be an outdated, incompatible, or corrupted program/driver that the OP hasn't taken care of.
All of that being said, there's relatively few ways to fix Windows:
SFC.EXE /scannow
DISM (W8 and later)
System Restore
Startup Repair (Vista and later)
Manual registry repair (from a backup)
Last Known Good Configuration
Repair install/Refresh (W8)/Reset using Keep My Files (W10)
Reinstall Windows/Factory Restore/Reset
Wipe and clean install (this is the ultimate "fix" to determine if Windows is to blame).
- I suggest a method for this at this link: http://www.carrona.org/canned.html#clean
- You may also want to try new recovery/restore media, just to rule out problems with the original one's
So, here's how to start:
- determine if you need hardware diagnostics. (after reading the post and looking at the reports).
If so, run them.
If not, then don't run them.
If uncertain, run them anyway.
- determine if you need to run Driver Verifier. (after reading the post and looking at the reports)
There are some BSOD's that are typically driver related (STOP 0xA, 0xD1, any BSOD w/"Driver" in it's name).
If the BSOD doesn't reveal the exact driver, then it's prudent to run Driver Verifier in the beginning.
It may save you some time. I maintain a suggested procedure for using it here: http://www.carrona.org/verifier.html
REPORTS:
First, read the post carefully. There are many clues given by the OP, and it's the analyst's job to see them.
Also, many BSOD's are fixed by the OP.
They get an idea from what you've said and that reminds them of something significant about the problem - and they go ahead and fix it.
At a minimum, there are 3 things to check in the reports (you may check more, but that's up to you):
- systeminfo.txt report
- MSINFO32.nfo report
- memory dumps
Occasionally we will also use the Administrative Event logfile from Event Viewer (very handy for Event ID 41 error patterns).
systeminfo.txt report
Check for all Service Packs
Check BIOS/UEFI date (W8 and later is very important to update it, W7 and earlier is less important)
Check available memory (RAM) - if less than 1 gB - limit startups, only run 1 program at a time, upgrade RAM
Check Windows Updates - if broken, fix it; if not broken, get all of them
Check for USB wireless networking - frequent BSOD cause
MSINFO32
Check drives for less than 15% free space
Check # of drives - 3 or more, ask for PSU make, model, wattage and age
Problem devices - fix them all (except PS2 keyboard and mouse - if using USB keyboard and mouse)
Check Windows Error Reporting for significant errors
Check Startups for problem programs
Check Program Groups for problem programs
Run memory dumps and also check drivers present in the dumps
List of common BSOD related drivers: http://www.carrona.org/drivers/bsod_drivers.php
Look for drivers that are older than the release date of that version of Windows (list at http://www.carrona.org/winreldt.html )
Look for NTStatus codes in the different NTStatus links at http://www.carrona.org/bsod.html
FYI - W8.1 is (IMO) a separate version of Windows from W8 (they changed the kernel version from 6.2 to 6.3 - that's a major deal!)
WinDbg is useful, but when looking for patterns you'll need to analyze a lot of memory dumps.
The free BSOD Processing app by writhziden at Sysnative.com is handy for this (or you can run your own scripts in kd.exe).
How to determine Driver Verifier.............
Regards,
- John (aka usasma)
Configure Driver Verifier to find out which driver is causing the Blue Screen Of Death (BSOD). Driver Verifier monitors Windows kernel-mode drivers, graphics drivers, and even 3rd party drivers to detect illegal function calls or actions that might corrupt the system. Driver Verifier can subject the Windows drivers to a variety of stresses and tests to find improper behaviour. Essentially, if there's a 3rd party driver believed to be causing the issues at hand, enabling Driver Verifier will help us see which specific driver is causing the problem.
Perhaps the most important which I will now clarify as this has been misunderstood often, enabling Driver Verifier by itself is not a solution, but instead a diagnostic utility. It will tell us if a driver is causing the BSOD, but again it will not outright solve your issues. If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is to look for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue.
Troubleshooting BSOD Stop Bugcheck Messages
https://support.microsoft.com/en-us/kb/3106831
http://www.carrona.org/bsod.html
https://support.microsoft.com/en-us/kb/244617
Last edited by FreeBooter on 5th March 2018, 4:25 pm; edited 3 times in total