Windows 7 Resource Kit- P31

The Process of Troubleshooting Startup CHAPTER 29
1453
process; symptoms include warning messages, startup failures, and Stop messages. The
causes are typically improper device configuration, incorrect driver settings, or hardware
malfunction and failure. For detailed information about troubleshooting hardware problems,
read Chapter 30.
How to Use System Restore
Windows automatically captures system state before installing new applications or drivers.
You can later use the System Restore tool to return to this system if you experience problems.
To start System Restore from within Windows (including safe mode), click Start, click All
Programs, click Accessories, click System Tools, and then click System Restore.
To start System Restore when you cannot open Windows, follow these steps:
1.
Start System Recovery tools, as described in the section titled “How to Start the System
Recovery Tools” earlier in this chapter.
2.
Click System Restore.
The System Restore Wizard appears. Follow these steps to restore Windows to an earlier state:
1.
On the Restore System Files And Settings page of the System Restore Wizard, click
Next.
2.
On the Choose A Restore Point page, click a restore point. Typically, you should choose
the most recent restore point when the computer functioned correctly. If the computer
has not functioned correctly for more than five days, select the Show More Restore
Points check box (as shown in Figure 29-7) and then select a restore point. Click Next.
FIGURE 29-7
You can solve some startup problems by using System Restore.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues
1454

3.
On the Confirm Disks To Restore page, click Next.
4.
On the Confirm Your Restore Point page, click Finish.
5.
Click Yes to confirm the system restore. System Restore modifies system files and
settings to return Windows to the state it was in at the time the restore point was
captured.
6.
When System Restore is done, click Restart. You should now attempt to start the
computer and identify whether the problem was resolved.
7.
When the computer restarts, Windows will display a System Restore notification. Click
Close.
How to Manually Repair the Boot Sector
Startup Repair is by far the quickest and easiest way to solve most startup problems. However,
if you are familiar with troubleshooting startup problems and simply need to fix a boot sector
problem after installing another operating system, you can run the following command from
a command prompt (including the Command Prompt tool in the System Recovery tools).
bootsect /NT60 ALL
Bootsect.exe is available from the \Boot\ folder of the Windows DVD and can be run from
within WinRE or Windows 7.
After running Bootsect, you should be able to load Windows, but you may not be able
to load earlier versions of Windows that are installed on the same computer. To load other
operating systems, add entries to the BCD registry file, as described in the section titled “How
to Create an Entry for Another Operating System” earlier in this chapter.
How to Manually Update the BCD Registry File
The simplest way to solve problems related to the BCD registry file is to run Startup Repair,
as described earlier in this chapter. However, you can also use the System Recovery tools to
update the BCD registry file manually by following these steps:

1.
Load the System Recovery tools, as described in the previous section.
2.
Click Command Prompt.
3.
Use BCDEdit to update the BCD registry file.
For detailed information, read the section titled “How to Use BCDEdit” earlier in this chapter.
How to Manually Replace Files
If startup files are missing or become corrupted, Windows may not be able to boot success-
fully. Often, Windows will display an error message that shows the name of the missing file, as
shown in Figure 29-8.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
The Process of Troubleshooting Startup CHAPTER 29
1455
FIGURE 29-8
Windows can display the names of missing startup files, which you can then manually
replace.
Startup Repair can automatically replace missing system files, but it may not detect
corrupted files. However, you can manually replace files using the System Recovery
command-line tool.
To replace files, follow these steps:
1.
From another computer, copy the new files to removable media such as a CD-ROM
or a USB flash drive. You cannot access Windows system files from the Windows DVD
because they are stored within a Windows Imaging (WIM) file that is not accessible
from within System Recovery.
2.
Start System Recovery tools, as described in the section titled “How to Start the System
Recovery Tools” earlier in this chapter.
3.

After the System Recovery tools start, click Command Prompt.
4.
Your removable media will have a drive letter, just like a hard disk. System Recovery
tools assign hard disk letters starting with C and then assign letters to removable media.
To identify the drive letter of your removable media, run the following commands.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues
1456
C:\>diskpart
DISKPART> list volume
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 C Win7 NTFS Partition 63 GB Healthy
Volume 1 E Windows XP NTFS Partition 91 GB Healthy
Volume 2 D NTFS Partition 69 GB Healthy
Volume 3 I Removable 0 B No Media
Volume 4 H Removable 0 B No Media
Volume 5 F LR1CFRE_EN_ UDF Partition 2584 MB Healthy
Volume 6 G USBDRIVE FAT32 Partition 991 MB Healthy
5.
Use the Copy command to transfer files from your removable media to the computer’s
hard disk.
How to Reinstall Windows
Infrequently, startup files and critical areas on the hard disk can become corrupted. If you are
mainly concerned with salvaging readable data files and using the Backup And Restore Center
to copy them to backup media or a network location, you can perform a parallel installation
of Windows. Although this may provide access to the file system, it will permanently damage
your existing operating system and applications.
If you cannot start Windows after following the troubleshooting steps in this guide, you
can reinstall Windows for the purpose of data recovery by following these steps:

1.
Insert the Windows DVD in your computer.
2.
Restart your computer. When prompted to boot from the CD/DVD, press any key.
3.
Windows Setup loads. When prompted, select your regional preferences and then click
Next.
4.
Click Install Now.
5.
When prompted, enter your product key.
6.
Select the I Accept The License Terms check box and then click Next.
7.
Click Custom.
8.
On the Where Do You Want to Install Windows? page, select the partition containing
your Windows installation and then click Next.
9.
When prompted, click OK.
Setup will install a new instance of Windows and will move all files from your previous
installation into the \Windows.Old folder (including the \Program Files, \Windows, and \Users
folders). You now have two choices for returning the computer to its original state:
n
Reformat the system partition If you have an automated deployment solution in
place (as described in Part II of this book, “Deployment”), the quickest solution is to
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
The Process of Troubleshooting Startup CHAPTER 29
1457
back up important files and redeploy Windows. If you need to manually reinstall

Windows, you can follow this process:
1.
Back up all important files by writing them to removable media, copying them to
an external hard disk, or copying them to a shared folder on the network.
2.
Reinstall Windows. This time, choose to reformat the system partition.
3.
Reinstall all applications and reconfigure all custom settings.
4.
Restore important files.
n
Continue working with the current system partition You can move important
files to the proper locations within the new instance of Windows. Then, reinstall all
applications and reconfigure any custom settings. Finally, you can delete the original
Windows instance by removing the \Windows.Old folder using Disk Cleanup.
Startup Troubleshooting After the Starting Windows Logo
Appears
If your computer displays the graphical Starting Windows logo before failing, as shown in
Figure 29-9, the Windows kernel was successfully loaded. Most likely, the startup failure is
caused by a faulty driver or service.
FIGURE 29-9
Displaying the Starting Windows logo indicates that Windows 7 has successfully loaded the
kernel.
Use the process illustrated in Figure 29-10 to identify and disable the failing software
feature to allow Windows to start successfully. After Windows starts, you can perform further
troubleshooting to resolve the problem with the feature if necessary. If the startup problem
occurs immediately after updating or installing a startup application, try troubleshooting
the startup application. For information about troubleshooting startup applications, see the
section titled “How to Temporarily Disable Startup Applications and Processes” later in this
chapter.

Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues
1458
Run Startup
Repair
Use the last
known good
configuration
Use System
Restore
Enable boot logging
and attempt to start
Windows 7
Analyze event viewer
and boot log to
isolate problem
Does
computer start
in Safe Mode?
Use Device Manager
to upgrade, roll back,
or remove failing driver
Use System
Configuration Utility
to disable failing services
or applications
Did you
identify a
failing driver?
No

No
Ye s
Startup fails after the
progress appears
Use System Recovery
Tools to analyze the
boot log. Manually
replace drivers or remove
problematic hardware
Ye s
FIGURE 29-10
Follow this process to troubleshoot startup problems after the Starting Windows logo
appears but before logon.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
The Process of Troubleshooting Startup CHAPTER 29
1459
The sections that follow describe each of these steps in more detail.
How to Run Startup Repair
Startup Repair can automatically fix many common startup problems, even if the problem
occurs after the Starting Windows logo is displayed. Because Startup Repair is easy to use and
has a very low likelihood of causing additional problems, it should be your first troubleshoot-
ing step. For detailed instructions, refer to the section titled “How to Run Startup Repair”
earlier in this chapter.
After running Startup Repair, attempt to start your computer normally and continue with
the troubleshooting process only if Windows fails to start.
How to Restore the Last Known Good Configuration
Last Known Good Configuration is usually used to enable the operating system to start if
it fails after the Starting Windows logo is displayed. Using Last Known Good Configuration
helps to correct instability or startup problems by reversing the most recent system, driver,
and registry changes within a hardware profile. When you use this feature, you lose all

configuration changes that were made since you last successfully started your computer.
Using the Last Known Good Configuration restores previous drivers and also restores
registry settings for the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet. Windows
Vista does not update the LastKnownGood control set until you successfully start the operat-
ing system in normal mode and log on.
When you are troubleshooting, it is recommended that you use Last Known Good
Configuration before you try other startup options, such as safe mode. However, if you
decide to use safe mode first, logging on to the computer in safe mode does not update the
LastKnownGood control set. Therefore, Last Known Good Configuration remains an option if
you cannot resolve your problem by using safe mode.
To access the Last Known Good Configuration startup option, follow these steps:
1.
Remove all floppy disks, CDs, DVDs, and other bootable media from your computer
and then restart your computer.
2.
Press F8 at the operating system menu. If the operating system menu does not appear,
press F8 repeatedly after the firmware POST process completes but before the Starting
Windows logo appears. The Advanced Boot Options menu appears.
3.
On the Advanced Boot Options menu, select Last Known Good Configuration
(Advanced), as shown in Figure 29-11.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues
1460
FIGURE 29-11
Use Last Known Good Configuration to restore some settings to their state during
the last time a user successfully logged on.
When Windows starts, it reads status information from the file %WinDir%\Bootstat.dat. If
Windows detects that the last startup attempt was unsuccessful, it automatically displays the
startup recovery menu, which provides startup options similar to the Advanced Boot Options

menu, without requiring you to press F8.
note
If you suspect that changes made since you last successfully restarted the
computer are causing problems, do not start Windows and log on normally—logging on
overwrites the LastKnownGood control set. Instead, restart the computer and use the Last
Known Good Configuration. You can also log on in safe mode without overwriting the Last
Known Good Configuration. For more information about control sets, see the section titled
“Kernel Loading Phase” earlier in this chapter.
How to Use System Restore
If Last Known Good Configuration fails to resolve the problem, you can manually perform
a system restore if Startup Repair did not initiate it. However, Startup Repair would typically
have taken this step already if it might have solved the problem. For information on how to
use System Restore, see the section titled “How to Use System Restore” earlier in this chapter.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
The Process of Troubleshooting Startup CHAPTER 29
1461
How to Enable Boot Logging
Boot logging is useful for isolating the cause of a startup problem that occurs after the oper-
ating system menu appears. You can enable boot logging by following these steps:
1.
Remove all floppy disks, CDs, DVDs, and other bootable media from your computer
and then restart your computer.
2.
Press F8 at the operating system menu. If the operating system menu does not appear,
press F8 repeatedly after the firmware POST process completes but before the Starting
Windows logo appears. The Advanced Boot Options menu appears.
3.
On the Advanced Boot Options menu, select Enable Boot Logging, as shown in
Figure 29-12.
FIGURE 29-12

Enabling boot logging can help you identify the cause of startup problems.
Windows starts and creates a log file at %WinDir%\Ntbtlog.txt. The log file starts with the
time and version information and then lists every file that is successfully loaded, as shown
here.
Microsoft (R) Windows (R) Version 6.1 (Build 7100)
5 27 2009 17:57:37.500
Loaded driver \SystemRoot\system32\ntoskrnl.exe
Loaded driver \SystemRoot\system32\hal.dll
Loaded driver \SystemRoot\system32\kdcom.dll
Loaded driver \SystemRoot\system32\mcupdate_GenuineIntel.dll
Loaded driver \SystemRoot\system32\PSHED.dll
Loaded driver \SystemRoot\system32\BOOTVID.dll
Loaded driver \SystemRoot\system32\CLFS.SYS
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues
1462
Loaded driver \SystemRoot\system32\CI.dll
Loaded driver \SystemRoot\system32\drivers\wdf0100.sys
Loaded driver \SystemRoot\system32\drivers\WDFLDR.SYS
Did not load driver \SystemRoot\system32\drivers\serial.sys
Loaded driver \SystemRoot\system32\drivers\acpi.sys
The following sections will provide additional information about viewing and analyzing the
boot log file.
How to Start in Safe Mode
Safe mode is a diagnostic environment that runs only a subset of the drivers and services
that are configured to start in normal mode. Safe mode is useful when you install software
or a device driver that causes instability or problems with starting in normal mode. Often,
Windows can start in safe mode even if hardware failure prevents it from starting in normal
mode. In most cases, safe mode allows you to start Windows and then troubleshoot problems
that prevent startup.

Logging on to the computer in safe mode does not update the LastKnownGood control
set. Therefore, if you log on to your computer in safe mode and then decide you want to try
Last Known Good Configuration, this option is still available to you.
In safe mode, Windows uses the minimum set required to start the GUI. The following
registry subkeys list the drivers and services that start in safe mode:
n
Safe mode: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
\Minimal
n
Safe mode with networking: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
\Control\SafeBoot\Network
To access safe mode, follow these steps:
1.
Remove all floppy disks and CDs from your computer and then restart your computer.
2.
Press F8 at the operating system menu. If the operating system menu does not appear,
press F8 repeatedly after the firmware POST process completes but before the Starting
Windows logo appears. The Advanced Boot Options menu appears.
3.
On the Advanced Boot Options menu, select Safe Mode, Safe Mode With Networking,
or Safe Mode With Command Prompt. Select Safe Mode if you do not require net-
working support. Select Safe Mode With Networking if you require access to the net-
work for your troubleshooting—for example, if you must download an updated driver.
Select Safe Mode With Command Prompt if you want to work at a command prompt.
When Windows starts, it reads status information from the file %SystemRoot%\Bootstat.dat.
If Windows detects that the last startup attempt was unsuccessful, it automatically displays
the startup recovery menu, which provides startup options similar to the Advanced Boot
Options menu, without requiring you to press F8.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
The Process of Troubleshooting Startup CHAPTER 29

1463
How to Identify Failing Drivers and Services
When you are troubleshooting, the method for determining which services and processes to
temporarily disable varies from one computer to the next. The most reliable way to determine
what you can disable is to gather more information about the services and processes enabled
on your computer.
The following Windows tools and features generate a variety of logs that can provide you
with valuable troubleshooting information:
n
Event Viewer
n
Sc.exe
n
System Information
n
Error reporting service
n
Boot logs
Of these tools, only the boot logs are available when using System Recovery tools. All tools
are available when using safe mode, however.
HOW TO ANALYZE STARTUP PROBLEMS IN SAFE MODE
Safe mode gives you access to all standard graphical troubleshooting tools, including those
described in the following sections.
Event Viewer (Eventvwr.msc)
You can use Event Viewer (Eventvwr.msc) to view logs that can help you to identify system
problems when you are able to start the system in safe or normal mode. When you are
troubleshooting, use these logs to isolate problems by application, driver, or service and to
identify frequently occurring issues. You can save these logs to a file and specify filtering
criteria.
Event Viewer provides a minimum of three logs, as follows:

n
Application logs The Application log contains events logged by applications or
programs. For example, a database program might record read or write errors here.
n
Security logs The security log holds security event records, such as logon attempts
and actions related to creating, opening, or deleting files. An administrator can specify
what events to record in the security log.
n
System logs The system log contains information about system features. Event
Viewer logs an entry when a driver or other system feature does not load during
startup. Therefore, you can use Event Viewer to search for information about drivers
or services that did not load.
To use Event Viewer to obtain driver and service error information from the system log,
follow these steps:
1.
Click Start, right-click Computer, and then click Manage.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues
1464
2.
Under System Tools, expand Event Viewer, expand Windows Logs, and then click System.
3.
Click the Action menu and then click Filter Current Log.
4.
Under Event Level, select the Critical and Error check boxes.
5.
In the Event source list, click Service Control Manager and then click OK.
6.
Double-click an event entry to view details.
Not all startup problems result in an entry being added to the event log. Therefore, you

might not find any related information. For more information about the Event Viewer, read
Chapter 21, “Maintaining Desktop Health.”
System Information
If a startup problem occurs inconsistently and if you can start Windows in safe or normal
mode, you can use System Information to view driver and service name, status, and startup
information.
Using System Information, you can create lists of drivers that were processed during safe
and normal mode startups. By comparing the differences between the two lists, you can
determine which features are not required to start Windows. For diagnostic purposes, you
can use this list of differences to help you determine which services to disable. In safe mode,
disable a service and then try to restart the operating system in normal mode. Repeat this
process for each service until you are able to start in normal mode.
To view service or driver information, follow these steps:
1.
Click Start, type msinfo32, and then press Enter.
2.
Depending on the information you want, do one or more of the following:
n
To view service information, expand Software Environment and then click Services.
n
To view the state of a driver, expand Software Environment and then click System
Drivers. Information for each driver is in the right pane.
n
To view driver information arranged by category, expand Components and then
select a category, such as Display.
n
To view problem devices, expand Components and then click Problem Devices. Ex-
amine the Error Code column for information relating to the source of the problem.
n
To view shared and conflicting resources (which do not always indicate a critical

problem), expand Hardware Resources and then click Conflicts/Sharing. Examine the
Resource and Device columns for devices that are incorrectly assigned overlapping
resources. Remove or disable one of the devices or use Device Manager to change
the resources assigned to the devices.
Error Reporting Service
The Windows error reporting service monitors your computer for problems that affect services
and applications. When a problem occurs, you can send a problem report to Microsoft and
receive an automated response with more information, such as news about an update for an
application or device driver. For more information about the Event Viewer, read Chapter 21.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
The Process of Troubleshooting Startup CHAPTER 29
1465
HOW TO USE DEVICE MANAGER TO VIEW OR CHANGE RESOURCES
Installing new hardware or updating drivers can create conflicts, causing devices to become
inaccessible. You can use Device Manager to review resources used by these devices to identify
conflicts manually.
To use Device Manager (Devmgmt.msc) to view or change system resource usage informa-
tion, follow these steps:
1.
Click Start, right-click Computer, and then click Manage.
2.
Click Device Manager and then double-click a device.
3.
Click the Resources tab to view the resources used by that device.
4.
Clear the Use Automatic Settings check box.
5.
Click Change Setting and specify the resources assigned to the device.
For more information about managing devices, see Chapter 17.
HOW TO ANALYZE BOOT LOGS

Boot logging lists the files that successfully and unsuccessfully processed during startup. You
use boot logging to log the Windows features that are processed when you start your com-
puter in safe mode and also in normal mode. By comparing the differences between the two
logs, you can determine which features are not required to start.
Windows records the name and path of each file that runs during startup in a log,
%WinDir%\Ntbtlog.txt. The log marks each file as successful (“Loaded Driver…”) or unsuccessful
(“Did Not Load Driver…”). Boot logging appends entries to Ntbtlog.txt when you start Windows
in safe mode. Comparing normal mode and safe mode entries enables you to determine
which services run in normal mode only—one of which must be the cause of the startup
problem if Windows is able to start in safe mode successfully. The following lines are sample
Ntbtlog.txt entries.
Loaded driver \SystemRoot\System32\DRIVERS\flpydisk.sys
Did not load driver \SystemRoot\System32\DRIVERS\sflpydisk.SYS
Note that not every “Did Not Load Driver” message necessarily indicates an error that
would prevent Windows from booting, because many drivers are not required for Windows to
start. To repair problems caused by problematic drivers when you can start safe mode, follow
these steps:
1.
Restart the computer and enable boot logging.
2.
Restart the computer after it fails and then start safe mode.
3.
Click Start and then type %WinDir%\ntbtlog.txt. The boot log file opens in Notepad.
4.
Compare the list of drivers loaded in normal mode to the list of drivers loaded in safe
mode. The driver that is causing the system to fail is one of the drivers listed with
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues
1466
“Loaded Driver…” in the normal mode boot log, but listed with “Did Not Load Driver…”

in the safe mode boot log.
5.
In safe mode, use Device Manager to replace or roll back potentially problematic
drivers, as described in the next section, “How to Roll Back Drivers.” Start by replacing
drivers that have been recently installed or updated. After replacing a driver, repeat
this process until the system starts successfully in normal mode.
For the services that run only in normal mode, disable those services one at a time, trying
to restart your computer in normal mode after you disable each service. Continue to disable
services individually until your computer starts in normal mode.
To repair problems caused by problematic drivers when the computer does not start in
safe mode, follow these steps:
1.
Restart the computer and then load System Recovery tools.
2.
Click Command Prompt. At the command prompt, type Notepad %WinDir%\
ntbtlog.txt. Notepad opens and displays the boot log.
3.
Compare the boot log created when the system failed to start in safe mode to a boot
log created when the system started successfully in safe mode. If you do not have a
boot log that was created when the system started successfully in safe mode, create a
boot log on a similarly configured computer by starting it in safe mode. The driver that
is causing safe mode to fail is one of the drivers that is not listed in the boot log that
was created when the system failed but is listed with “Loaded Driver…” in the boot log
created when safe mode started successfully.
4.
Replace the driver file with a working version, using the Copy command at the com-
mand prompt. Start by replacing or deleting drivers that have been recently installed
or updated. After replacing a driver, repeat this process until the system starts success-
fully in normal mode.
How to Roll Back Drivers

When you update a device driver, your computer might have problems that it did not have
with the previous version. For example, installing an unsigned device driver might cause the
device to malfunction or cause resource conflicts with other installed hardware. Installing
faulty drivers might cause Stop errors that prevent the operating system from starting in
normal mode. Typically, the Stop message text displays the file name of the driver that causes
the error.
Windows provides a feature called Device Driver Roll Back that might help you restore
system stability by rolling back a driver update.
note
You can use System Information or the Sigverif tool to determine whether a driver
on your computer is signed and to obtain other information about the driver, such as ver-
sion, date, time, and manufacturer. This data, combined with information from the manu-
facturer’s Web site, can help you decide whether to roll back or update a device driver.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
The Process of Troubleshooting Startup CHAPTER 29
1467
To roll back a driver, follow these steps:
1.
Click Start, right-click Computer, and then click Manage.
2.
Under System Tools, click Device Manager.
3.
Expand a category (Network Adapters, for example) and then double-click a device.
4.
Click the Driver tab and then click Roll Back Driver. You are prompted to confirm that
you want to overwrite the current driver. Click Yes to roll back the driver. The rollback
process proceeds, or else you are notified that an older driver is not available.
How to Temporarily Disable a Service
Many services automatically run at startup, but others are started only by users or by another
process. When you troubleshoot startup issues that are related to system services, a useful

technique is to simplify your computer configuration so that you can reduce system complex-
ity and isolate operating system services. To decrease the number of variables, temporarily
disable startup applications or services and re-enable them one at a time until you reproduce
the problem. Always disable applications first before attempting to disable system services.
The System Configuration utility allows you to disable system services individually or several
at a time. To disable a service by using the System Configuration utility, follow these steps:
1.
Click Start, type msconfig, and then press Enter.
2.
Do one of the following:
n
To disable all services, on the General tab, click Selective Startup and then clear the
Load System Services check box.
n
To disable specific services, on the Services tab, click to clear the check boxes that
correspond to the items you want to disable. You can also click Disable All to disable
all items.
If you change any startup setting by using the System Configuration utility, Windows
prompts you to return to normal operations the next time you log on. The System Configu-
ration Utility prompt will appear each time you log on until you restore the original startup
settings by clicking Normal Startup under Startup Selection on the General tab. To change
a startup setting permanently, use the Services console, change a Group Policy setting, or
uninstall the software that added the service.
Troubleshooting Startup Problems After Logon
If your computer fails immediately after a user logs on, use the process illustrated in Figure
29-13 to identify and disable the failing startup application to allow the user to log on suc-
cessfully. If the problem occurs immediately after updating or installing an application, try
uninstalling that application.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues

1468
Does
holding down
the Shift key
resolve the
problem?
Disable startup applications
by using the System
Configuration utility
Modify Group Policy
to identify the
problematic application
Once you identify the
application, fix or
uninstall it
No
Ye s
Startup fails
after logon
FIGURE 29-13
Follow this process to troubleshoot startup problems that occur after logon.
How to Temporarily Disable Startup Applications and Processes
If a problem occurs after installing new software, you can temporarily disable or uninstall the
application to verify that the application is the source of the problem.
Problems with applications that run at startup can cause logon delays or even prevent
you from completing Windows startup in normal mode. The following subsections provide
techniques for temporarily disabling startup applications.
HOW TO DISABLE STARTUP APPLICATIONS USING THE SHIFT KEY
One way you can simplify your configuration is to disable startup applications. By holding
down the Shift key during the logon process, you can prevent the operating system from

running startup programs or shortcuts in the following folders:
n
%SystemDrive%\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu
\Programs\Startup
n
%SystemDrive%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
To disable the applications or shortcuts in the preceding folders, you must hold down the
Shift key until the desktop icons appear. Holding down the Shift key is a better alternative
than temporarily deleting or moving programs and shortcuts, because this procedure affects
only the current user session.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
The Process of Troubleshooting Startup CHAPTER 29
1469
To use the Shift key to disable applications and shortcuts in startup folders, log off the
computer and then log on again. Immediately press and hold down the Shift key. Continue
to hold down the Shift key until the desktop icons appear. If you can log on successfully, you
have isolated the cause of the problem to your startup applications. Next, you should use the
System Configuration utility to temporarily disable applications one by one until you identify
the cause of the problem. With the cause of the problem identified, you can fix the applica-
tion or permanently remove it from your startup programs.
HOW TO DISABLE STARTUP PROGRAMS USING THE SYSTEM CONFIGURATION UTILITY
The System Configuration utility allows you to disable startup applications individually or
several at a time. To disable a startup program by using the System Configuration utility,
follow these steps:
1.
Click Start, type msconfig, and then press Enter.
2.
You can disable all or selective startup applications:
n
To disable all startup applications, click the General tab, click Selective Startup, and

then clear the Load Startup Items check box.
n
To disable specific startup items, click the Startup tab and then clear the check
boxes that correspond to the items you want to disable temporarily. You can also
click Disable All on the Startup tab to disable all items.
To change a startup setting permanently, you must move or delete startup shortcuts,
change a Group Policy setting, or uninstall the application that added the startup application.
HOW TO DISABLE STARTUP APPLICATIONS CONFIGURED USING GROUP POLICY OR LOGON
SCRIPTS
You can use the Group Policy snap-in to disable applications that run at startup. Local Group
Policy can be applied to computers, in which case you need to edit the Group Policy settings
on the computer that you are troubleshooting. Group Policy objects (GPOs) are frequently
applied within AD DS domains, in which case you need to connect to the domain to edit the
appropriate policy. Before modifying domain Group Policy settings, you should follow the
steps described later in this section to disconnect the computer you are troubleshooting from
the network to determine whether the problem is related to domain Group Policy settings.
To disable startup applications by using the Group Policy Management Editor snap-in,
follow these steps:
1.
Click Start, type gpedit.msc, and then click OK.
2.
Within either Computer Configuration (for computer-wide startup applications) or User
Configuration (for user-specific startup applications), expand Policies, expand Adminis-
trative Templates, expand System, and then click Logon.
3.
Double-click Run These Programs At User Logon, which is a Group Policy setting. Next,
do one of the following:
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues
1470

n
To disable all startup applications configured by that policy, click Disabled.
n
To selectively disable individual programs that are listed in the computer-specific or
user-specific policy, click Show. In the Show Contents dialog box, select a program
to disable and then click Remove.
You can change additional Group Policy settings that might help you simplify your com-
puter configuration when you are troubleshooting startup problems by enabling the Do
Not Process The Run Once List policy. If you enable this Group Policy setting, the computer
ignores the programs listed in the following RunOnce subkeys the next time a user logs on to
the computer:
n
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
n
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Additionally, you can enable the Group Policy setting Do Not Process The Legacy Run List
to disable the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
subkey that startup applications might use. The programs listed in this subkey are a custom-
ized list of programs that were configured by using the System Policy Editor for Windows NT
4.0 or earlier versions. If you enable this Group Policy setting, Windows ignores the programs
listed in this subkey when you start your computer. If you disable or do not configure this
Group Policy setting, Windows processes the customized run list that is contained in this reg-
istry subkey when you start the computer.
Group Policy changes do not always take effect immediately. You can use the Gpupdate
(Gpupdate.exe) tool to refresh local Group Policy changes to computer and user policies.
After you refresh the policy, you can use the Group Policy Result (Gpresult.exe) tool to verify
that the updated settings are in effect.
Group Policy settings can be applied locally or to an entire domain. To determine how set-
tings are applied to a specific computer, use the Resultant Set Of Policy (Rsop.msc) tool. Then,
edit those Group Policy objects to apply a change. For the purpose of isolating the source of

the problem, you can prevent Group Policy, logon scripts, roaming user profiles, scheduled
tasks, and network-related issues from affecting your troubleshooting by temporarily disabling
the network adapter and then logging on by using a local computer account.
If local and domain Group Policy settings do not reveal the source of the startup problem,
the application may be started by a logon script. Logon scripts are configured in the local
or domain user properties. To view the logon script, open Computer Management and then
view the user’s properties. Then click the Profile tab. Make note of the path to the logon script
and edit it in a tool such as Notepad to determine whether any startup applications are con-
figured. For more detailed information about Group Policy, read Chapter 14, “Managing the
Desktop Environment.”
How to Permanently Disable Startup Applications and Processes
You can permanently disable a startup application in several ways, explained in the following
sections.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
Additional Resources CHAPTER 29
1471
UNINSTALL THE APPLICATION
If you find that recently installed software causes system instability or if error messages con-
sistently point to a specific application, you can use Uninstall A Program under Programs in
Control Panel to uninstall the software. If the application is required, you can install it in a lab
environment and perform additional testing before reinstalling it on production computers.
MANUALLY REMOVE THE ENTRY
You can manually delete shortcuts from the Startup folder, remove startup entries from the
registry, remove entries from Group Policy or logon scripts, or disable a service. For a list of
registry subkeys that contain entries for service and startup programs, see the section titled
“Logon Phase” earlier in this chapter.
Summary
Windows 7 automatically installs WinRE and improves startup, shutdown, and sleep recovery
times. Although the startup improvements over Windows Vista are minimal, Windows Vista
introduced many improvements over Windows XP that Windows 7 continues to support.

These features include:
n
Windows Boot Manager
n
Windows Boot Loader
n
The BCD registry file and the BCDEdit command-line tool
n
System Recovery tools
n
Startup Repair
If you are familiar with earlier versions of Windows, you will be comfortable troubleshoot-
ing most problems that occur in the kernel loading phase of startup or later. Fortunately,
you (or any user) can resolve many common startup problems simply by running the Startup
Repair tool from the Windows DVD.
Additional Resources
These resources contain additional information and tools related to this chapter.
Related Information
n
Chapter 16, “Managing Disks and File Systems,” includes more information about
startup problems related to disk configuration.
n
Chapter 17, “Managing Devices and Services,” includes information about configuring
hardware and services.
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.
CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues
1472
n
Chapter 30, “Troubleshooting Hardware, Driver, and Disk Issues” includes more
information about hardware-related startup problems.

n
Chapter 32, “Troubleshooting Stop Messages” includes more information about Stop
errors that might occur during startup.
n
“Boot Configuration Data in Windows Vista,” which includes detailed information
about the BCD registry file, is found at
/platform/firmware/bcd.mspx.
n
“BCD WMI Provider Classes” on MSDN is found at
/library/aa362675.aspx.
n
Article 92765 in the Microsoft Knowledge Base, “Terminating a SCSI Device,” is found
at />n
Article 154690 in the Microsoft Knowledge Base, “How to Troubleshoot Event ID 9,
Event ID 11, and Event ID 15 Error Messages,” is found at
/?kbid=154690.
n
Article 224826 in the Microsoft Knowledge Base, “Troubleshooting Text-Mode Setup
Problems on ACPI Computers,” is found at />On the Companion Media
n
ConfigureCrashSettings.ps1
n
DetectStartUpPrograms.ps1
n
DisplayBootConfig.ps1
n
Get-SystemDisk.ps1
Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.