Certopolis

CompTIA A+ Core 2

Windows BSOD and boot failures: A+ Core 2 troubleshooting

Most stop errors come from third-party drivers, so check drivers first, especially recently added ones, and use safe mode to disable a driver that crashes Windows at startup. For startup failures, work out which phase fails. Boot loader errors such as Bootmgr missing are repaired from installation media, and a hang at the spinning dots calls for safe mode and a clean start.

What causes stop errors

Microsoft's analysis of crashes found that 70% are caused by third-party driver code, 10% by hardware, 5% by Microsoft code, and 15% have unknown causes because memory is too corrupted to analyze.

The root cause is rarely a user-mode process. An application such as a spreadsheet may trigger the crash, but it usually exposes a problem in a driver, hardware or the OS.

The stop screen shows a stop code, such as PAGE_FAULT_IN_NONPAGED_AREA or MEMORY_MANAGEMENT, and the module name if one is available. Ask the user to record it. In most cases a single unexpected restart fixes itself and needs no action; troubleshoot when the same stop code keeps coming back.

Working a recurring stop error

Remove any newly added hardware. Install the latest Windows updates and check that BIOS and firmware are current. Run hardware and memory tests and a malware scan. Keep 10 to 15 percent of the disk free.

In Device Manager, look for devices marked with an exclamation point and update the driver; if that does not help, disable or uninstall the device. If the stop screen names a driver, get an update from the maker or disable the driver. Rolling back to the previous driver version is another option.

If the error happens during startup, start in safe mode (Advanced startup on the Recovery page in Settings, then Troubleshoot > Advanced options > Startup Settings, and press 4 or F4) and disable the driver in Device Manager.

If no driver is named, as can happen with DPC_WATCHDOG_VIOLATION, check the System log in Event Viewer for errors that identify the device, and confirm new hardware is compatible with the installed Windows version.

To capture evidence of an intermittent crash, open Advanced system settings, select Settings under Startup and Recovery, choose Automatic memory dump under Write debugging information, and restart. The dump is saved to %SystemRoot%\MEMORY.DMP. Run chkdsk /f /r for disk errors; on the system partition the scan runs after a restart.

Which startup phase is failing

BIOS or UEFI phase: if the drive activity light does not work, or NumLock does not toggle, startup is stuck in firmware, which may mean a hardware fault.

Boot loader phase: a black screen with a blinking cursor, or errors such as Bootmgr missing or corrupted, BCD missing, Operating system missing, or system hive missing. Start from Windows installation media, choose Repair your computer and run Startup Repair, or press Shift+F10 for a command prompt and use bootrec /fixmbr, bootrec /fixboot or bootrec /rebuildbcd.

Kernel phase: a stop error after the logo, INACCESSIBLE_BOOT_DEVICE, a hang at the spinning dots, or a black screen after the splash screen. Try safe mode and read Event Viewer. Then do a clean start: in System Configuration (msconfig) choose Selective startup and test services one at a time. In most cases the faulty service is third-party, so test those before Microsoft system services.

A corrupt registry hive is recovered with a system restore point. Since Windows 10 version 1803, Windows no longer backs up the registry to the RegBack folder automatically.

Getting into the Windows Recovery Environment

If Windows fails to start correctly several times, it enters Windows RE automatically. You can force this by interrupting startup twice with the power button; on the third start Windows shows Automatic Repair.

From a working desktop, use Settings > System > Recovery > Advanced startup, or hold Shift while selecting Restart. A USB recovery drive or Windows installation media (Repair my PC) also reaches Windows RE.

Where the exam catches people

  • Believing hardware is the usual cause of a BSOD: Microsoft attributes 70% of crashes to third-party drivers and 10% to hardware.
  • Believing the application that was open caused the crash: it usually exposes an underlying driver, hardware or OS problem.
  • Believing one unexpected restart needs a reinstall: in most cases the restart resolves it and no action is needed unless the stop code recurs.
  • Believing a Bootmgr missing error is fixed from safe mode: it is a boot loader problem, repaired after starting from installation media.
  • Believing a clean start should test Microsoft services first: Microsoft says the faulty service is usually third-party.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A Windows workstation has begun showing recurring stop errors. The stop screen names no module, and no hardware has been added or changed. Which of the following should the technician investigate first?

    Right. In the game that’s Renown for your Software Troubleshooting building.

    Not that one: C is right. In the game your Software Troubleshooting building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    With no module named and nothing changed in the hardware, third-party drivers are the most likely cause and the first thing to check.

    Written from learn.microsoft.com/en-us/troubleshoot/windows-client/performance/stop-code-error-troubleshooting

  2. A technician cannot reproduce intermittent stop errors on a Windows workstation and wants Windows to save the system's memory contents at the next crash for analysis. Which of the following should the technician configure?

    Right. In the game that’s Renown for your Software Troubleshooting building.

    Not that one: B is right. In the game your Software Troubleshooting building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Windows then writes a dump file when the next stop error occurs.

    Written from learn.microsoft.com/en-us/troubleshoot/windows-client/performance/stop-code-error-troubleshooting

  3. A Windows workstation freezes at the spinning dots after the logo screen, but it starts in safe mode. The technician suspects a service and will use System Configuration's Selective startup to test services one at a time. Which of the following should the technician test first?

    Right. In the game that’s Renown for your Software Troubleshooting building.

    Not that one: C is right. In the game your Software Troubleshooting building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    So the third-party services are tested first.

    Written from learn.microsoft.com/en-us/troubleshoot/windows-client/performance/windows-boot-issues-troubleshooting