Windows Boot Level Troubleshooting Options

Index

• Introduction
• Vista/Windows 7
  
  • Repair Your Computer (only usually available in Vista from Recovery Disk)
    
    • Startup Repair
    • System Restore
    • System Image Recovery
    • Windows Memory Diagnostic
    • Command Prompt
  • Safe Mode
  • Safe Mode with Networking
  • Safe Mode with Command Prompt
  • Enable Boot Logging
  • Enable low-resolution video
  • Last Known Good Configuration
  • Directory Services Restore Mode
  • Debugging Mode
  • Disable automatic restart on system failure
  • Disable Driver Signature Enforcement
  • Start Windows Normally
• Windows 8/Windows 8.1/Windows 10
  
  • Troubleshoot
    
    • Refresh your PC
    • Reset your PC
    • Advanced Startup
      
      • System Restore
      • System Image Recovery
      • Startup Repair
      • Command Prompt
      • UEFI Firmware Settings
      • Startup Settings
        
        • Enable Debugging
        • Enable Boot Logging
        • Enable low-resolution video
        • Enable Safe Mode
        • Enable Safe Mode with Networking
        • Enable Safe Mode with Command Prompt
        • Disable Driver Signature Enforcement
        • Disable Early Launch Anti-Malware Protection
        • Disable Auto-Restart on System Failure

Introduction

All versions of Windows have a number of inbuilt boot level tools to help you troubleshoot your computer if it develops faults, the number available to you and the way you access them will depend on which version of Windows you have, and to some degree on who the manufacturer of your computer is (since some manufacturers add additional recovery options of their own).

The purpose of this article is to show you how to access these tools, and to introduce you to some of their capabilities. It is not meant to be exhaustive or definitive, and will cover some options in more detail than others. These will generally be the more useful ones.

The Index for this article is arranged in a manner which reflects the layout of the tools available, and you should find your way around the article by using it, because the posts do not read logically if you just scroll down and read them one at a time. All individual tool posts will contain a return link to the Index.

Vista/Windows 7

To access the Advanced Boot Options menu in Vista or Windows 7, you must ....

• Power down your computer.
• On powering it up again, you must repeatedly hit the F8 key, until the following menu appears ...

• Repair Your Computer (only usually available in Vista from Recovery Disk)
• Safe Mode
• Safe Mode with Networking
• Safe Mode with Command Prompt
• Enable Boot Logging
• Enable low-resolution video
• Last Known Good Configuration
• Directory Services Restore Mode
• Debugging Mode
• Disable automatic restart on system failure
• Disable Driver Signature Enforcement
• Start Windows Normally

If this does not work first time, shut down and try again.

Please note ... although F8 is the most commonly used key, some manufacturers use different ones, so you may need to refer to your manual to find out which key for your particular machine. F5 and Esc are popular alternatives.

Windows 8/Windows 8.1/Windows 10

With Windows 8, Microsoft went over from BIOS (Basic Input Output System) to UEFI (Unified Extensible Firmware Interface) booting. Because of this, the method for accessing the Troubleshooting Tools in Windows 8, Windows 8.1, and Windows 10, is different to the one used in earlier versions of Windows.

To access the Troubleshoot menu in Windows 8, Windows 8.1, and Windows 10 ...

• Click on your Power button.
• Press the Shift key on your keyboard, and at the same time click on the Restart option.
• Windows will reboot into the Advanced Startup Options menu.
  

  • Continue
  • Use a device
  • Troubleshoot
  • Turn off your PC

• Click on Troubleshoot

Please note ... there are other ways of accessing the Troubleshoot menu in each Windows version, but this is the quickest and easiest and works in all 3 versions.

Please note also ... if Windows fails to boot successfully on 2 successive occasions, then it will automatically boot to the Advanced Startup Options menu.

Repair Your Computer

Clicking on this option will boot the computer into Recovery Environment (RE), which is a separate self-contained system remote from normal Windows. As such it is not affected by any corruption of the main Operating System, and allows you to troubleshoot the main Operating System when it is unable to function properly.

When you boot into RE, you will be asked to ....

• Choose a keyboard appropriate to the language edition of Windows that you are using.
• Enter your logon password (if you use one).

... successful completion of those tasks will open the following menu of tools ...

• Startup Repair
• System Restore
• System Image Recovery
• Windows Memory Diagnostic
• Command Prompt

Safe Mode

When booted into Safe Mode ...

• Only a limited set of drivers and files will load, which are just enough to boot Windows.
• Startup programs do not generally auto load in Safe Mode.

Devices and drivers that start in Safe Mode ...

• Floppy disk drives (internal and USB)
• Internal CD-ROM drives (ATA, SCSI)
• External CD-ROM drives (USB)
• Internal DVD-ROM drives (ATA, SCSI)
• External DVD-ROM drives (USB)
• Internal hard disk drives (ATA, SATA, SCSI)
• External hard disk drives (USB)
• Keyboards (USB, PS/2, serial)
• Mice (USB, PS/2, serial)
• VGA display cards (PCI, AGP)

Windows services that start in Safe Mode ...

• Windows event log
• Plug and Play
• Remote procedure call (WPC)
• Cryptographic Services
• Windows Defender
• Windows Management Instrumentation (WMI)

Safe Mode is useful for troubleshooting problems where Windows may not boot properly into Normal Mode ...

• If a problem doesn't appear when you start in Safe Mode, you can eliminate the default settings and basic device drivers as possible causes of that problem.
• If a recently installed program, device, or driver prevents Windows from running in Normal Mode, in Safe Mode you can remove the program that's causing the problem.
• If your computer is infested with Malware which cannot be removed when booted into Normal Mode, or which prevents you from booting into Normal Mode, then you may be able to remove it in Safe Mode.

Warning ... it is also possible to boot into Safe Mode using MSConfig, but you should not use this method because doing so can render your computer unbootable.

A computer that is having problems is not stable, and by using the SAFEBOOT option in MSCONFIG you are altering your boot instructions to make it boot ONLY in Safe Mode. If your computer fails to boot into Safe Mode, as it may well do, then you will be left in a position where you cannot boot at all.

Because your Safe Mode Registry Entries may have been damaged, your computer cannot boot into Safe Mode. You cannot boot to Normal Mode (because of the alterations you made to your boot instructions), so now you are left with a computer that will neither boot into Safe Mode nor Normal mode which is not a situation you want to be in.

Using the BOOTSAFE option in Super Anti-Spyware can also have the same outcome, as can using BOOTSAFE by SUPERAdBlocker.

If F8 doesn't work (Vista/W7) or Shift+Restart (W8, W8.1, W10) TELL YOUR HELPER

There are tools we can use to repair your faulty Safe Mode condition, but these can only be used so long as your computer is bootable.

Safe Mode with Networking

When booted into Safe Mode with Networking ...

• Only a limited set of drivers and files will load, which are just enough to boot Windows, and to connect to the Internet.
• Startup programs do not generally auto load in Safe Mode with Networking.

Devices and drivers that start in Safe Mode with Networking ...

• Floppy disk drives (internal and USB)
• Internal CD-ROM drives (ATA, SCSI)
• External CD-ROM drives (USB)
• Internal DVD-ROM drives (ATA, SCSI)
• External DVD-ROM drives (USB)
• Internal hard disk drives (ATA, SATA, SCSI)
• External hard disk drives (USB)
• Keyboards (USB, PS/2, serial)
• Mice (USB, PS/2, serial)
• VGA display cards (PCI, AGP)

Windows services that start in Safe Mode with Networking ...

• Windows event log
• Plug and Play
• Remote procedure call (WPC)
• Cryptographic Services
• Windows Defender
• Windows Management Instrumentation (WMI)

Network-related devices and services that start in Safe Mode with Networking ...

• Network adapters (wired Ethernet and wireless 802.11x)
• Dynamic Host Configuration Protocol (DHCP)
• DNS
• Network connections
• TCP/IP-NetBIOS Helper
• Windows Firewall

Safe Mode with Networking is useful for troubleshooting problems where Windows may not connect properly to the Internet in Normal Mode ...

• If the problem doesn't appear when you start in Safe Mode with Networking, you can eliminate the default settings and basic device drivers as possible causes of that problem, which means it is one of your 3rd party programs causing the problem.

Warning ... Safe Mode with Networking is for troubleshooting only. It is not a good idea to spend much time on line when you are booted into Safe Mode with Networking, because your defences against Malware attacks are significantly lower than they would be if you were connected in Normal Mode, when all your defensive programs would be running.

Safe Mode with Command Prompt

Safe Mode with Command Prompt is essentially the same as Safe Mode, except that you interface with the computer via a Command Prompt rather than by a GUI (Graphic User Interface).

This can have advantages for the Administrators of large networks, who use scripts to perform many of their troubleshooting tasks, but for most non-professionals Safe Mode is the preferrable boot option when troubleshooting.

Enable Boot Logging

When the Enable Boot Logging option is selected, Windows will create a log ntbtlog.txt of the drivers loaded during the boot process.

Example log ....

Below is an exerpt from a ntbtlog.txt which shows which drivers loaded, and which drivers did not load. This can help you in assessing which drivers might be preventing Windows from booting.

Microsoft (R) Windows (R) Version 6.3 (Build 9600)
9 7 2015 12:14:09.486
BOOTLOG_LOADED \SystemRoot\system32\ntoskrnl.exe
BOOTLOG_LOADED \SystemRoot\system32\hal.dll
BOOTLOG_LOADED \SystemRoot\system32\kd.dll
BOOTLOG_LOADED \SystemRoot\system32\mcupdate_AuthenticAMD.dll
BOOTLOG_LOADED \SystemRoot\System32\drivers\werkernel.sys
BOOTLOG_LOADED \SystemRoot\System32\drivers\CLFS.SYS
BOOTLOG_LOADED \SystemRoot\System32\drivers\tm.sys
BOOTLOG_LOADED \SystemRoot\system32\PSHED.dll
BOOTLOG_NOT_LOADED \SystemRoot\System32\drivers\dxgkrnl.sys
BOOTLOG_LOADED \SystemRoot\System32\drivers\BasicDisplay.sys
BOOTLOG_LOADED \SystemRoot\System32\Drivers\Npfs.SYS
BOOTLOG_NOT_LOADED \SystemRoot\System32\drivers\dxgkrnl.sys
BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\atikmpag.sys
BOOTLOG_LOADED \SystemRoot\System32\drivers\HDAudBus.sys
BOOTLOG_LOADED \SystemRoot\system32\DRIVERS\rtwlane.sys

Enable low-resolution video

The Enable low-resolution video option ...

• Decreases the screen resolution.
• Lowers the refresh rate.
• It does not change the display driver

It is used to troubleshoot monitor problems, and is most useful when the screen resolution has been changed to one that the monitor you're using can't support.

In this option you enter Windows at a universally accepted resolution, so you can then set the screen resolution for normal mode to one that your monitor can support.

Last Known Good Configuration

Each time Windows boots it uses a set of settings known as the Current Control Set to boot from, and if it boots successfully into Normal Mode with them ...

• It creates a cache of the settings used and calls them the Last Known Good Configuration
• These setting will overwrite any that were previously stored.

Any changes made to your computer whilst it is booted are made to your Current Control Set only, and saved when you shut down your computer. Now it is conceivable that the changes made in your last session could make your computer "unstable", so if on the next boot, your computer fails to boot correctly ...

• You can use the Last Known Good Configuration option, and boot from the cached settings (which are free from these changes).

Please note ... this option is not available in Windows 8, Windows 8.1, or Windows 10.

Directory Services Restore Mode

This option starts Windows domain controller running Active Directory, so that the directory service can be restored.

It is for the use of IT Professionals who administrate large Networks, and has no practical use for home users.

Please note ... this option is not available in Windows 8, Windows 8.1, or Windows 10.

Debugging Mode

With this option selected Windows will send information to a connected debugger.

It is meant for the use of IT Professionals, and is not really too useful for the average home user.

Disable automatic restart on system failure

Used when troubleshooting Blue Screen problems which occur at startup.

• Windows fails to boot.
• A blue error screen shows up briefly
• Computer shuts down and auto restarts
• The cycle repeats

Because the computer auto restarts you do not have time to view the error screen, so it's impossible to find out what is causing the error.

By selecting Disable automatic restart on system failure you can read the error screen, which should give you information that will help you resolve the problem.

Disable Driver Signature Enforcement

Used when troubleshooting problems which occur after installing new software.

• You install new software, and either ...
  
  • Windows fails to boot properly
  • Windows boots OK, but the software fails to run properly

By default, Windows will only allow signed Drivers to run, so if a Driver is unsigned it will not be loaded.

For troubleshooting purposes only, you can select the Disable Driver Signature Enforcement option, to test whether that resolves things.

If it does ...

• Report the matter to the software developer, so that they can get the relevant driver signed.
• Do not run Windows permanently with Driver Signature Enforcement disabled, as this will seriously degrade your security.