Troubleshooting Windows

Jump to the Examples

Disclaimer: Should you decide to act upon any information on this website, you do so at your own risk! Commands such as chkdsk, diskpart and bootrec, and anything that edits the registry or the boot files, can turn a computer that is merely sick into one that is dead, and a "Reset this PC" can erase your files. Back up first, read what a command does before you press Enter, and do not paste commands from a forum post or a video that you cannot explain to somebody else.

Most Windows problems are boring. A driver that was updated last week, a disk that is almost full, an update that stopped halfway, a program in the startup list that nobody remembers installing. The hard part is rarely the repair itself. It is working out which of the twenty possible causes is yours, and not making things worse while you look. This note is about that order of work, and about the tools and commands I would reach for. It is written for Windows 11, but nearly all of it applies to Windows 10 too, only the menus have other names.

Some of the topics continue in other notes: old computers that Windows has given up on in Reviving an Old Computer, backups, malware and scams in Security Considerations, the terminal in Communication with the Machines, and what to do when it is the network and not the computer in Computer Networks. The same approach for the other big family of systems is in Troubleshooting Linux.

A Method Before the Tools

The tools are the easy part, and every guide on the Internet lists them. What separates a quick repair from a lost weekend is what you do before you open any of them.

1. Describe the problem exactly. "It is slow" is not a symptom, "it is slow for two minutes after I sign in and then it is fine" is. If there is an error screen, photograph it with your phone. The error code or the stop code is the most useful thing you will have, and it is gone after the next restart.
2. Ask what changed. A new driver, an update, a program, a new device, a power cut, a cable that somebody moved. Most problems start with a change, and Reliability Monitor (below) keeps a timeline of exactly those.
3. Save your data before you repair anything. Not after. The repair tools are mostly safe, but "mostly" is a poor word when it is the only copy of the photographs.
4. Change one thing at a time and test after each change. If you change five things and the problem disappears, you have learned nothing, and you cannot undo it either.
5. Begin with the cheap and reversible. A restart, unplugging the USB devices, Safe Mode, a restore point. The commands that rewrite things come later.
6. Keep notes. A line for each step: what you did, what happened. It sounds fussy, but at one in the morning you will not remember whether you already ran chkdsk.
7. Know when to stop. Sometimes the honest answer is a reinstall. See the last practical section.

How Windows Starts, and Where It Breaks

Half of the diagnosis is knowing how far the computer gets. A machine that never shows the manufacturer's logo has a different problem than one that reaches the sign-in screen and then freezes, even if both are described as "it does not start". The boot is a chain, and every link hands over to the next one.

Power on
    |
[ Firmware (UEFI / BIOS) ]      tests the hardware, finds a boot device
    |
[ Boot manager (bootmgr) ]      reads the boot configuration (BCD)
    |
[ Windows loader (winload) ]    loads the kernel and the boot drivers
    |
[ Kernel, drivers, services ]   most blue screens at start-up happen here
    |
[ Sign-in screen ]              user profile, start-up programs
    |
[ Desktop (explorer.exe) ]

Where it stops, and where I would look first (my own rules of thumb, not a complete list):

The Tools Already Inside Windows

You do not need to install anything to start. Windows ships with a surprisingly good set of diagnostic tools, and they know the machine better than any third-party "optimizer" does. For the commands below, open a terminal as administrator: right-click the Start button and choose Terminal (Admin). The basics of the command line are in Communication with the Machines.

What is there and what it tells you:

Safe Mode deserves one more sentence. If you cannot get to the settings because Windows does not start, interrupt the start-up by switching the computer off while the logo is spinning. After two or three failed starts Windows opens the recovery environment by itself, and the same menu (Troubleshoot, Advanced options) is there. If even that fails, boot from the USB stick and choose Repair your computer.

Common Symptoms and the First Things to Check

The table is only a starting point. Each row says what I would look at first, and what comes next if the first look shows nothing. The numbered examples after it go through the steps in detail.

Symptoms, first checks and the next step:

A Note on BitLocker

Many new laptops, especially with Windows 11 Home, turn on device encryption the moment you sign in with a Microsoft account, and nobody is told. It is a good thing until the day you change the firmware settings, replace the motherboard, or boot from a USB stick, and Windows asks for a 48-digit recovery key. Without that key the data is gone, and that is by design. The key is stored with your Microsoft account (account.microsoft.com/devices/recoverykey) or the work or school account. Look at it today, from another device, and copy it into your password manager.

Examples: Step by Step

Each example is the order in which I would try things, not the only possible one. Stop as soon as the problem is solved, and write down what worked.

Example 1: The Computer Has Become Slow

1. Open Task Manager (Ctrl + Shift + Esc). Click the columns CPU, Memory and Disk to sort. One program using everything is a very different story from everything being slightly busy.
2. Open the Startup apps tab and switch off what you do not need at sign-in. Leave the security software and the drivers of your devices alone. If you are not sure what an item does, search for its name before you switch it off.
3. Check the free space on drive C:. Windows needs room to work: when it is under about 10 to 15 percent, everything gets slower, and updates fail. Settings, System, Storage shows what is taking the space, and Temporary files is a safe place to start.
4. Check that the disk is healthy. In PowerShell: Get-PhysicalDisk | Format-Table FriendlyName, MediaType, HealthStatus. A second opinion on the SMART values comes from a free program like CrystalDiskInfo. If the disk reports problems, copy your data first, and do not run long repair scans on a dying disk.
5. Run the offline scan: Windows Security, Virus & threat protection, Scan options, Microsoft Defender Antivirus (offline scan). The computer restarts and scans before Windows starts.
6. Look at the temperatures with a program like HWiNFO. A laptop that is at 95 degrees under a light load has a clogged cooler or dried thermal paste, and the processor slows itself down to survive. Compressed air helps more often than people expect.
7. If the system drive is still a mechanical hard disk, this is where the advice stops being about software.

Example 2: Repairing the System Files

Windows keeps a protected copy of its own files, and two tools compare the running system with it. DISM repairs the copy (the component store), sfc repairs the running files from the copy. If the copy itself is damaged, sfc cannot repair anything, so the usual order is DISM first. Both need an elevated terminal, and both take a while. A percentage that sits at 20 or 62 for several minutes is normal.

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Restart afterwards and run sfc /scannow once more. If it still reports files that it could not repair, the details are in C:\Windows\Logs\CBS\CBS.log, which is long and ugly, but searching it for the word corrupt tells you which files. If both tools finish cleanly and the problem remains, the cause is probably not in the system files, and it is time to look at the drivers, the disk and the hardware.

A similar check for the file system: chkdsk C: /scan scans while Windows is running and changes nothing. chkdsk C: /f fixes errors, and for the system drive it asks to run at the next restart. The option /r also looks for bad sectors and is very slow, so use it only when you have a reason to suspect the surface of a hard disk, and have a backup.

Example 3: The Network Does Not Work

The method is a ladder: go up one step at a time, and the first step that fails shows you where the problem is. The background (addresses, DNS, gateways) is in Computer Networks. Run these in the terminal:

ipconfig /all              # does the computer have an address, a gateway, a DNS server?
ping 192.168.1.1           # the router (use your own gateway address from the line above)
ping 1.1.1.1               # the Internet, by address, no DNS needed
ping example.org           # the Internet, by name, DNS needed

• No address, or an address starting with 169.254: the computer did not get one from the router. Check the cable and the Wi-Fi, restart the router, and then the network adapter.
• The router answers, the address does not: the problem is the Internet connection of the router itself, not your computer.
• The address answers, the name does not: DNS. Try ipconfig /flushdns, and if that is not enough, change the DNS server of the adapter to a different one.
• Nothing helps and only this computer is affected: reset the network stack, then restart.

netsh winsock reset
netsh int ip reset

The same thing with a button is Settings, Network & Internet, Advanced network settings, Network reset. It removes and reinstalls all the network adapters and forgets the saved Wi-Fi passwords and VPN settings, so have them at hand. A VPN client or a "security suite" that installed its own network driver is a more frequent cause than people think; if the problem started with its installation, remove it first.

Example 4: Windows Will Not Start

Before anything else: is the disk visible in the firmware setup? If it is not, no software step will help, and the cable, the connector or the disk itself is the problem. If it is visible, boot from the USB stick (the key for the boot menu is usually F12, F10, F9, Esc or F2, depending on the manufacturer), choose your language, and click Repair your computer in the lower left corner. If the disk is encrypted, keep the recovery key at hand.

Under Troubleshoot, Advanced options try them in this order, and restart to test after each one:

1. Startup Repair. It fails often, but it costs nothing.
2. Uninstall Updates (the latest quality update, then the feature update), if the problem began after an update.
3. System Restore, if there is a restore point from before the trouble.
4. Command Prompt, for rebuilding the boot files by hand (below).

In the recovery command prompt the drive letters are often not the same as in Windows, so first find out which is which. On a modern computer (UEFI, GPT disk) the boot files live on a small FAT32 partition of about 100 to 500 MB, and the commands look like this:

diskpart
  list volume                   # find the Windows volume and the small FAT32 one
  select volume 3               # the number of the FAT32 (EFI) volume
  assign letter=S
  exit
bcdboot D:\Windows /s S: /f UEFI    # D: is the Windows volume that you found above

bcdboot writes fresh boot files from the installed Windows. On older computers with a BIOS and an MBR disk the classic way is bootrec /fixmbr, bootrec /fixboot and bootrec /rebuildbcd. On a UEFI computer bootrec /fixboot often answers "Access is denied", which is the reason why bcdboot is the better tool there. If the file system is damaged, chkdsk D: /f from the same prompt is also possible. The offline version of sfc is sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows.

If all of this fails, and the disk is healthy, do not spend the evening on it. Boot from the USB stick, copy the files to an external disk (type notepad in the recovery command prompt, choose File, Open, and you have a rough file browser in which you can copy files to the external disk with a right click), and read the section on reinstalling.

Example 5: Blue Screens

A blue screen is Windows stopping on purpose because continuing could damage data. It shows a stop code in capital letters (for example CRITICAL_PROCESS_DIED, IRQL_NOT_LESS_OR_EQUAL, PAGE_FAULT_IN_NONPAGED_AREA, WHEA_UNCORRECTABLE_ERROR) and sometimes the name of a file. One blue screen in a year is a curiosity. Several in a week are a symptom.

1. Write down the stop code and the file name, and note what you were doing. The bug check reference from Microsoft explains the codes.
2. Think about what changed. A new graphics, network or storage driver is the most common reason. In Device Manager open the device, then Driver, Roll Back Driver, or uninstall the update in Settings, Windows Update, Update history.
3. Read the dump file. Windows saves a small one in C:\Windows\Minidump and a large one as C:\Windows\MEMORY.DMP. A free program like BlueScreenView lists the drivers involved. WinDbg from the Microsoft Store, with the command !analyze -v, gives the more serious analysis.
4. Test the memory. Bad RAM looks like everything else: random stop codes, programs that crash for no reason, files that become damaged. Run MemTest86 for at least a few passes. If you enabled XMP or EXPO (the memory profile) or overclocked anything in the firmware, switch it off for a week and see.
5. Check the disk and the temperatures, as in Example 1. A blue screen only under a heavy load, like a game, points to the graphics card, the power supply or heat.
6. If the codes keep changing from one blue screen to another, I would suspect the hardware, and memory in particular, rather than Windows.

Example 6: Windows Update Is Stuck

First the quiet steps: free space on C:, a restart, the troubleshooter (Settings, System, Troubleshoot, Other troubleshooters, Windows Update), and the DISM and sfc pair from Example 2. Look up the error code of the failed update, because the same few codes account for most cases. If that is not enough, the widely used trick is to let Windows rebuild its download cache. It is safe, because Windows creates the folder again, but it belongs after the simple steps and not before:

net stop wuauserv
net stop bits
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
net start wuauserv
net start bits

Then check for updates again. The old folder can be deleted after a week, when everything works.

When to Stop Repairing

There is a point where a repair costs more than a reinstall, and a good sign is that you start repeating yourself. The same system files are damaged again after you repaired them. A fix that worked last month is needed again. The computer behaves differently in Safe Mode, in a new user account and with a new profile, and you still cannot find the reason. Windows that has lived on one computer for six years, through three major versions, a few antivirus programs and dozens of drivers, is allowed to be tired.

The options, from the gentlest to the most thorough:

Some practical details that cost people their evening. Download the network driver of the computer on another device before you reinstall, because a fresh Windows without a network driver cannot download anything else. Modern Windows 10 and 11 licences are normally linked to the hardware and activate by themselves, and you do not need to type a key, but sign in with the same Microsoft account afterwards. Know where your applications' licence keys and installers are before you wipe anything. And if the computer is old enough that Windows 11 will not install on it, the alternative of a different operating system is in Reviving an Old Computer.

Making It Less Likely Next Time

• Back up, and try the restore once. A backup that has never been restored is a hope. Keep one copy that is not connected to the computer all the time, because ransomware encrypts every drive it can see. The 3-2-1 rule is in Security Considerations.
• Make the recovery USB stick now, and copy the BitLocker recovery key to the password manager. The stick has to be made on a working computer, and you will not have one when you need it.
• Leave System Protection on for drive C: (search for "Create a restore point"), so that Windows makes restore points before installing drivers and updates.
• Keep some free space on the system drive, at least 15 percent.
• Do not use registry cleaners, "PC optimizers" or driver updater programs. They do not make anything faster, they are a frequent source of the very problems they claim to fix, and some of them are malware. Drivers come from Windows Update or from the manufacturer of the hardware.
• Uninstall what you do not use, especially programs that add themselves to the start-up and to the context menu.
• Use a standard account for everyday work and an administrator account only when you install something. Most malware needs the administrator rights that you click through.
• Keep the updates on. It annoys people, but unpatched Windows is the more expensive problem. If you cannot afford a surprise (before a presentation, for example), pause them for a week, but not for a year.
• Watch the hardware. Dust, temperature, the SMART values of the disk, and the odd noise that a mechanical disk makes before it dies.

Some resources:

• Microsoft – Windows help and learning
• Windows release health – known issues of each update
• sfc – command reference and repairing a Windows image with DISM
• bcdboot – command-line options
• Bug check code reference (stop codes)
• Sysinternals, MemTest86, HWiNFO, CrystalDiskInfo, BlueScreenView
• Download Windows 11 – installation media and ISO

A Few More Thoughts

I notice that the dull advice does most of the work: look before you touch, change one thing, keep a copy. The clever commands are for the rare evening when the dull advice has been used up. Troubleshooting is also a skill that grows with repetition. After the third time that a blue screen turns out to be a graphics driver, you stop being afraid of blue screens, and the one after that takes ten minutes.

It is also worth saying that "Windows is broken" is sometimes true and not your fault. Updates do go wrong, and the release health page above exists for that reason. Before you spend an evening on your own machine, a quick search for the exact error and the name of the update shows whether thousands of others have the same problem this week. And if you run other machines for the household, a small server or a shared mailbox, the notes Constructing a Cloud and Constructing E-mail describe the other side of the same craft, where you are the one who has to keep it running.