Windows Troubleshooting: Boot Failures, BSODs, and Performance

Windows Troubleshooting: Boot Failures, BSODs, and Performance

The CompTIA Six-Step Troubleshooting Methodology

Every diagnostic task in this lab follows the same six steps CompTIA defines for the A+ exam:

1. Identify the problem – gather symptoms, question the user, check recent changes.

2. Establish a theory of probable cause – list the most likely causes, starting with the obvious.

3. Test the theory – perform a specific action to confirm or eliminate your theory.

4. Establish a plan of action – decide on the fix and document it before touching anything.

5. Implement the solution or escalate – apply the fix, or hand off if the fix is beyond your scope.

6. Verify full system functionality and, if applicable, implement preventive measures – confirm the repair worked, then document and prevent recurrence.

Skipping steps wastes time and can make problems worse. Use your structured troubleshooting form to record every step for every scenario.

---

Boot Failures and the Boot Configuration Data (BCD)

When a Windows PC powers on, firmware (UEFI or legacy BIOS) hands control to the Windows Boot Manager, which reads the Boot Configuration Data (BCD) store. The BCD is a database that tells the boot manager where the Windows OS loader lives and what options to pass it. A corrupted or missing BCD produces errors such as:

• "BOOTMGR is missing"
• "The boot configuration data file is missing required information"
• "An error occurred while attempting to read the boot configuration data"

The command-line tool bcdedit reads and writes BCD entries. In this lab the instructor uses bcdedit to remove or alter a BCD entry, simulating corruption. Your job is to spot that the BCD is the cause and use WinRE to rebuild it.

Repairing the BCD from WinRE Command Prompt:

```

bootrec /scanos -- scans all disks for Windows installations

bootrec /rebuildbcd -- rebuilds the BCD store

bootrec /fixmbr -- rewrites the Master Boot Record (MBR, legacy systems)

bootrec /fixboot -- writes a new boot sector to the active partition

```

On UEFI systems you may also need to run:

```

bcdboot C:\Windows /s C: /f UEFI

```

---

Missing or Corrupted System Files

Windows depends on protected system files. If one is deleted, renamed, or replaced with a damaged copy, Windows may fail to start or produce a stop error. Two built-in tools address this:

• SFC (System File Checker): `sfc /scannow` compares protected files against a cached copy and replaces damaged ones. Run from an elevated Command Prompt or from WinRE.
• DISM (Deployment Image Servicing and Management): `DISM /Online /Cleanup-Image /RestoreHealth` repairs the Windows component store that SFC draws from. Run DISM first if SFC fails.

If both fail, System Restore (available in WinRE under Advanced Options) can roll the system back to a restore point created before the damage occurred — without affecting personal files.

---

Blue Screen of Death (BSOD) / Stop Errors

A stop error (BSOD) means Windows encountered a condition it cannot safely recover from and halted to prevent data corruption. The screen displays a stop code (e.g., `CRITICAL_PROCESS_DIED`, `SYSTEM_SERVICE_EXCEPTION`). Key diagnostic steps:

1. Record the stop code and any listed file names.

2. Check `%SystemRoot%\Minidump` for crash dump files; analyze with Windows Debugger (WinDbg) in a professional setting.

3. Boot into Safe Mode (loads minimal drivers) to determine whether a third-party driver or service is the cause.

4. Use Event Viewer → Windows Logs → System to find critical events logged just before the crash.

5. If a recent driver or update triggered the stop, use Roll Back Driver or uninstall the update via WinRE.

---

Performance Degradation: High CPU Usage

A process consuming excessive CPU starves other processes and causes sluggishness. Use these tools in order:

• Task Manager (Ctrl + Shift + Esc): The Processes tab shows CPU% per process. Sort descending to find the offender. Note the process name and PID (Process ID).
• Resource Monitor: Launched from Task Manager's Performance tab. The CPU tab shows threads, handles, and the associated services for each PID — essential for identifying svchost.exe instances.
• Event Viewer: Filter Windows Logs → Application and System for errors or warnings timestamped when the high-CPU condition started. This often reveals a crashed service restarting in a loop.

Once identified, right-click the process in Task Manager and select End Task if it is safe to do so. Document the process name, PID, and the event log evidence in your incident report.

---

Windows Recovery Environment (WinRE)

WinRE is a minimal Windows environment you access by booting from the Windows installation USB or by pressing the correct key during a failed boot sequence. Key tools inside WinRE:

| Tool | Purpose |

|---|---|

| Startup Repair | Automated scan and fix of common boot issues |

| Command Prompt | Manual commands (bootrec, sfc, bcdedit) |

| System Restore | Roll back to a saved restore point |

| Uninstall Updates | Remove a recently applied update |

| Startup Settings | Boot into Safe Mode or disable driver signature enforcement |

---

Safety and Professional Standards

• Electrostatic discharge (ESD): Wear an antistatic wrist strap connected to a grounded mat when opening any lab PC chassis. Never place circuit boards on untreated surfaces.
• Data backup first: Before running any repair tool in a real workplace, confirm a current backup exists. In this lab, the instructor has pre-imaged the drives; treat that image as your backup.
• Change management: In a production environment, every action you take should be logged. Your troubleshooting form is the equivalent of a change log — complete it fully.
• Authorization: Never run commands on a system you are not explicitly authorized to access. This applies to lab equipment as much as customer machines.