Windows 7 Resource Kit- P31

Manually replace drivers or removeproblematic hardware Yes FIgURE 29-10 Follow this process to troubleshoot startup problems after the Starting Windows logo appears but before logon... T

process; symptoms include warning messages, startup failures, and Stop messages The causes are typically improper device configuration, incorrect driver settings, or hardware malfunction and failure For detailed information about troubleshooting hardware problems, read Chapter 30

How to Use System Restore

Windows automatically captures system state before installing new applications or drivers You can later use the System Restore tool to return to this system if you experience problems

To start System Restore from within Windows (including safe mode), click Start, click All Programs, click Accessories, click System Tools, and then click System Restore

To start System Restore when you cannot open Windows, follow these steps:

1. Start System Recovery tools, as described in the section titled “How to Start the System Recovery Tools” earlier in this chapter

2. Click System Restore The System Restore Wizard appears Follow these steps to restore Windows to an earlier state:

1. On the Restore System Files And Settings page of the System Restore Wizard, click Next

2. On the Choose A Restore Point page, click a restore point Typically, you should choose the most recent restore point when the computer functioned correctly If the computer has not functioned correctly for more than five days, select the Show More Restore Points check box (as shown in Figure 29-7) and then select a restore point Click Next

FIgURE 29-7 You can solve some startup problems by using System Restore

3. On the Confirm Disks To Restore page, click Next

4. On the Confirm Your Restore Point page, click Finish

5. Click Yes to confirm the system restore System Restore modifies system files and settings to return Windows to the state it was in at the time the restore point was captured

6. When System Restore is done, click Restart You should now attempt to start the computer and identify whether the problem was resolved

7. When the computer restarts, Windows will display a System Restore notification Click Close

How to Manually Repair the Boot Sector

Startup Repair is by far the quickest and easiest way to solve most startup problems However,

if you are familiar with troubleshooting startup problems and simply need to fix a boot sector problem after installing another operating system, you can run the following command from

a command prompt (including the Command Prompt tool in the System Recovery tools) bootsect /NT60 ALL

Bootsect exe is available from the \Boot\ folder of the Windows DVD and can be run from within WinRE or Windows 7

After running Bootsect, you should be able to load Windows, but you may not be able

to load earlier versions of Windows that are installed on the same computer To load other operating systems, add entries to the BCD registry file, as described in the section titled “How

to Create an Entry for Another Operating System” earlier in this chapter

How to Manually Update the BCD Registry File

The simplest way to solve problems related to the BCD registry file is to run Startup Repair,

as described earlier in this chapter However, you can also use the System Recovery tools to update the BCD registry file manually by following these steps:

1. Load the System Recovery tools, as described in the previous section

2. Click Command Prompt

3. Use BCDEdit to update the BCD registry file For detailed information, read the section titled “How to Use BCDEdit” earlier in this chapter

How to Manually Replace Files

If startup files are missing or become corrupted, Windows may not be able to boot fully Often, Windows will display an error message that shows the name of the missing file, as shown in Figure 29-8

success-FIgURE 29-8 Windows can display the names of missing startup files, which you can then manually replace

Startup Repair can automatically replace missing system files, but it may not detect corrupted files However, you can manually replace files using the System Recovery command-line tool

To replace files, follow these steps:

1. From another computer, copy the new files to removable media such as a CD-ROM

or a USB flash drive You cannot access Windows system files from the Windows DVD because they are stored within a Windows Imaging (WIM) file that is not accessible from within System Recovery

2. Start System Recovery tools, as described in the section titled “How to Start the System Recovery Tools” earlier in this chapter

3. After the System Recovery tools start, click Command Prompt

4. Your removable media will have a drive letter, just like a hard disk System Recovery tools assign hard disk letters starting with C and then assign letters to removable media

To identify the drive letter of your removable media, run the following commands

C:\>diskpart

DISKPART> list volume

Volume ### Ltr Label Fs Type Size Status Info - - - - - - - - Volume 0 C Win7 NTFS Partition 63 GB Healthy

Volume 1 E Windows XP NTFS Partition 91 GB Healthy Volume 2 D NTFS Partition 69 GB Healthy Volume 3 I Removable 0 B No Media Volume 4 H Removable 0 B No Media Volume 5 F LR1CFRE_EN_ UDF Partition 2584 MB Healthy Volume 6 G USBDRIVE FAT32 Partition 991 MB Healthy

5. Use the Copy command to transfer files from your removable media to the computer’s

hard disk

How to Reinstall Windows

Infrequently, startup files and critical areas on the hard disk can become corrupted If you are mainly concerned with salvaging readable data files and using the Backup And Restore Center

to copy them to backup media or a network location, you can perform a parallel installation

of Windows Although this may provide access to the file system, it will permanently damage your existing operating system and applications

If you cannot start Windows after following the troubleshooting steps in this guide, you can reinstall Windows for the purpose of data recovery by following these steps:

1. Insert the Windows DVD in your computer

2. Restart your computer When prompted to boot from the CD/DVD, press any key

3. Windows Setup loads When prompted, select your regional preferences and then click Next

4. Click Install Now

5. When prompted, enter your product key

6. Select the I Accept The License Terms check box and then click Next

n Reformat the system partition If you have an automated deployment solution in

place (as described in Part II of this book, “Deployment”), the quickest solution is to

back up important files and redeploy Windows If you need to manually reinstall Windows, you can follow this process:

1. Back up all important files by writing them to removable media, copying them to

an external hard disk, or copying them to a shared folder on the network

2. Reinstall Windows This time, choose to reformat the system partition

3. Reinstall all applications and reconfigure all custom settings

4. Restore important files

n Continue working with the current system partition You can move important

files to the proper locations within the new instance of Windows Then, reinstall all applications and reconfigure any custom settings Finally, you can delete the original Windows instance by removing the \Windows Old folder using Disk Cleanup

Startup Troubleshooting after the Starting Windows Logo appears

If your computer displays the graphical Starting Windows logo before failing, as shown in Figure 29-9, the Windows kernel was successfully loaded Most likely, the startup failure is caused by a faulty driver or service

FIgURE 29-9 Displaying the Starting Windows logo indicates that Windows 7 has successfully loaded the kernel

Use the process illustrated in Figure 29-10 to identify and disable the failing software feature to allow Windows to start successfully After Windows starts, you can perform further troubleshooting to resolve the problem with the feature if necessary If the startup problem occurs immediately after updating or installing a startup application, try troubleshooting the startup application For information about troubleshooting startup applications, see the section titled “How to Temporarily Disable Startup Applications and Processes” later in this chapter

Run StartupRepair

Use the lastknown goodconfiguration

Use SystemRestore

Enable boot loggingand attempt to startWindows 7

Analyze event viewerand boot log toisolate problem

Doescomputer start

in Safe Mode?

Use Device Manager

to upgrade, roll back,

or remove failing driver

Use System Configuration Utility

to disable failing services

or applications

Did youidentify afailing driver?

No

No Yes

Startup fails after theprogress appears

Use System RecoveryTools to analyze theboot log Manually replace drivers or removeproblematic hardware

Yes

FIgURE 29-10 Follow this process to troubleshoot startup problems after the Starting Windows logo appears but before logon

The sections that follow describe each of these steps in more detail

How to Run Startup Repair

Startup Repair can automatically fix many common startup problems, even if the problem occurs after the Starting Windows logo is displayed Because Startup Repair is easy to use and has a very low likelihood of causing additional problems, it should be your first troubleshoot-ing step For detailed instructions, refer to the section titled “How to Run Startup Repair”

earlier in this chapter After running Startup Repair, attempt to start your computer normally and continue with the troubleshooting process only if Windows fails to start

How to Restore the Last Known Good Configuration

Last Known Good Configuration is usually used to enable the operating system to start if

it fails after the Starting Windows logo is displayed Using Last Known Good Configuration helps to correct instability or startup problems by reversing the most recent system, driver, and registry changes within a hardware profile When you use this feature, you lose all configuration changes that were made since you last successfully started your computer Using the Last Known Good Configuration restores previous drivers and also restores registry settings for the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet Windows Vista does not update the LastKnownGood control set until you successfully start the operat-ing system in normal mode and log on

When you are troubleshooting, it is recommended that you use Last Known Good Configuration before you try other startup options, such as safe mode However, if you decide to use safe mode first, logging on to the computer in safe mode does not update the LastKnownGood control set Therefore, Last Known Good Configuration remains an option if you cannot resolve your problem by using safe mode

To access the Last Known Good Configuration startup option, follow these steps:

1. Remove all floppy disks, CDs, DVDs, and other bootable media from your computer and then restart your computer

2. Press F8 at the operating system menu If the operating system menu does not appear, press F8 repeatedly after the firmware POST process completes but before the Starting

Windows logo appears The Advanced Boot Options menu appears

3. On the Advanced Boot Options menu, select Last Known Good Configuration (Advanced), as shown in Figure 29-11

FIgURE 29-11 Use Last Known Good Configuration to restore some settings to their state during the last time a user successfully logged on

When Windows starts, it reads status information from the file %WinDir%\Bootstat dat If Windows detects that the last startup attempt was unsuccessful, it automatically displays the startup recovery menu, which provides startup options similar to the Advanced Boot Options menu, without requiring you to press F8

note If you suspect that changes made since you last successfully restarted the computer are causing problems, do not start Windows and log on normally—logging on overwrites the LastKnownGood control set Instead, restart the computer and use the Last Known Good Configuration You can also log on in safe mode without overwriting the Last Known Good Configuration For more information about control sets, see the section titled

“Kernel Loading phase” earlier in this chapter.

How to Use System Restore

If Last Known Good Configuration fails to resolve the problem, you can manually perform

a system restore if Startup Repair did not initiate it However, Startup Repair would typically have taken this step already if it might have solved the problem For information on how to use System Restore, see the section titled “How to Use System Restore” earlier in this chapter

How to Enable Boot Logging

Boot logging is useful for isolating the cause of a startup problem that occurs after the ating system menu appears You can enable boot logging by following these steps:

1. Remove all floppy disks, CDs, DVDs, and other bootable media from your computer and then restart your computer

2. Press F8 at the operating system menu If the operating system menu does not appear, press F8 repeatedly after the firmware POST process completes but before the Starting

Windows logo appears The Advanced Boot Options menu appears

3. On the Advanced Boot Options menu, select Enable Boot Logging, as shown in Figure 29-12

FIgURE 29-12 Enabling boot logging can help you identify the cause of startup problems

Windows starts and creates a log file at %WinDir%\Ntbtlog txt The log file starts with the

time and version information and then lists every file that is successfully loaded, as shown here

Microsoft (R) Windows (R) Version 6.1 (Build 7100)

5 27 2009 17:57:37.500 Loaded driver \SystemRoot\system32\ntoskrnl.exe Loaded driver \SystemRoot\system32\hal.dll Loaded driver \SystemRoot\system32\kdcom.dll Loaded driver \SystemRoot\system32\mcupdate_GenuineIntel.dll Loaded driver \SystemRoot\system32\PSHED.dll

Loaded driver \SystemRoot\system32\BOOTVID.dll Loaded driver \SystemRoot\system32\CLFS.SYS

Loaded driver \SystemRoot\system32\CI.dll Loaded driver \SystemRoot\system32\drivers\wdf0100.sys Loaded driver \SystemRoot\system32\drivers\WDFLDR.SYS Did not load driver \SystemRoot\system32\drivers\serial.sys Loaded driver \SystemRoot\system32\drivers\acpi.sys

The following sections will provide additional information about viewing and analyzing the boot log file

How to Start in Safe Mode

Safe mode is a diagnostic environment that runs only a subset of the drivers and services that are configured to start in normal mode Safe mode is useful when you install software

or a device driver that causes instability or problems with starting in normal mode Often, Windows can start in safe mode even if hardware failure prevents it from starting in normal mode In most cases, safe mode allows you to start Windows and then troubleshoot problems that prevent startup

Logging on to the computer in safe mode does not update the LastKnownGood control set Therefore, if you log on to your computer in safe mode and then decide you want to try Last Known Good Configuration, this option is still available to you

In safe mode, Windows uses the minimum set required to start the GUI The following registry subkeys list the drivers and services that start in safe mode:

n Safe mode: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot

\Minimal

n Safe mode with networking: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet

\Control\SafeBoot\Network

To access safe mode, follow these steps:

1. Remove all floppy disks and CDs from your computer and then restart your computer

2. Press F8 at the operating system menu If the operating system menu does not appear, press F8 repeatedly after the firmware POST process completes but before the Starting

Windows logo appears The Advanced Boot Options menu appears

3. On the Advanced Boot Options menu, select Safe Mode, Safe Mode With Networking,

or Safe Mode With Command Prompt Select Safe Mode if you do not require working support Select Safe Mode With Networking if you require access to the net-work for your troubleshooting—for example, if you must download an updated driver Select Safe Mode With Command Prompt if you want to work at a command prompt When Windows starts, it reads status information from the file %SystemRoot%\Bootstat dat

net-If Windows detects that the last startup attempt was unsuccessful, it automatically displays the startup recovery menu, which provides startup options similar to the Advanced Boot Options menu, without requiring you to press F8

How to Identify Failing Drivers and Services

When you are troubleshooting, the method for determining which services and processes to temporarily disable varies from one computer to the next The most reliable way to determine what you can disable is to gather more information about the services and processes enabled

on your computer The following Windows tools and features generate a variety of logs that can provide you with valuable troubleshooting information:

HOW TO aNaLYZE STaRTUp pROBLEMS IN SaFE MODE

Safe mode gives you access to all standard graphical troubleshooting tools, including those described in the following sections

Event Viewer (Eventvwr.msc)

You can use Event Viewer (Eventvwr msc) to view logs that can help you to identify system problems when you are able to start the system in safe or normal mode When you are troubleshooting, use these logs to isolate problems by application, driver, or service and to identify frequently occurring issues You can save these logs to a file and specify filtering criteria

Event Viewer provides a minimum of three logs, as follows:

n Application logs The Application log contains events logged by applications or

programs For example, a database program might record read or write errors here

n Security logs The security log holds security event records, such as logon attempts

and actions related to creating, opening, or deleting files An administrator can specify what events to record in the security log

n System logs The system log contains information about system features Event

Viewer logs an entry when a driver or other system feature does not load during startup Therefore, you can use Event Viewer to search for information about drivers

or services that did not load

To use Event Viewer to obtain driver and service error information from the system log, follow these steps:

1. Click Start, right-click Computer, and then click Manage

2. Under System Tools, expand Event Viewer, expand Windows Logs, and then click System

3. Click the Action menu and then click Filter Current Log

4. Under Event Level, select the Critical and Error check boxes

5. In the Event source list, click Service Control Manager and then click OK

6. Double-click an event entry to view details Not all startup problems result in an entry being added to the event log Therefore, you might not find any related information For more information about the Event Viewer, read Chapter 21, “Maintaining Desktop Health ”

System Information

If a startup problem occurs inconsistently and if you can start Windows in safe or normal mode, you can use System Information to view driver and service name, status, and startup information

Using System Information, you can create lists of drivers that were processed during safe and normal mode startups By comparing the differences between the two lists, you can determine which features are not required to start Windows For diagnostic purposes, you can use this list of differences to help you determine which services to disable In safe mode, disable a service and then try to restart the operating system in normal mode Repeat this process for each service until you are able to start in normal mode

To view service or driver information, follow these steps:

1 Click Start, type msinfo32, and then press Enter

2. Depending on the information you want, do one or more of the following:

n To view service information, expand Software Environment and then click Services

n To view the state of a driver, expand Software Environment and then click System Drivers Information for each driver is in the right pane

n To view driver information arranged by category, expand Components and then select a category, such as Display

n To view problem devices, expand Components and then click Problem Devices amine the Error Code column for information relating to the source of the problem

Ex-n To view shared and conflicting resources (which do not always indicate a critical problem), expand Hardware Resources and then click Conflicts/Sharing Examine the Resource and Device columns for devices that are incorrectly assigned overlapping resources Remove or disable one of the devices or use Device Manager to change the resources assigned to the devices

Error Reporting Service

The Windows error reporting service monitors your computer for problems that affect services and applications When a problem occurs, you can send a problem report to Microsoft and receive an automated response with more information, such as news about an update for an application or device driver For more information about the Event Viewer, read Chapter 21

HOW TO USE DEVICE MaNaGER TO VIEW OR CHaNGE RESOURCES

Installing new hardware or updating drivers can create conflicts, causing devices to become inaccessible You can use Device Manager to review resources used by these devices to identify conflicts manually

To use Device Manager (Devmgmt msc) to view or change system resource usage tion, follow these steps:

1. Click Start, right-click Computer, and then click Manage

2. Click Device Manager and then double-click a device

3. Click the Resources tab to view the resources used by that device

4. Clear the Use Automatic Settings check box

5. Click Change Setting and specify the resources assigned to the device For more information about managing devices, see Chapter 17

HOW TO aNaLYZE BOOT LOGS

Boot logging lists the files that successfully and unsuccessfully processed during startup You use boot logging to log the Windows features that are processed when you start your com-puter in safe mode and also in normal mode By comparing the differences between the two logs, you can determine which features are not required to start

Windows records the name and path of each file that runs during startup in a log,

%WinDir%\Ntbtlog txt The log marks each file as successful (“Loaded Driver…”) or unsuccessful (“Did Not Load Driver…”) Boot logging appends entries to Ntbtlog txt when you start Windows

in safe mode Comparing normal mode and safe mode entries enables you to determine which services run in normal mode only—one of which must be the cause of the startup problem if Windows is able to start in safe mode successfully The following lines are sample Ntbtlog txt entries

Loaded driver \SystemRoot\System32\DRIVERS\flpydisk.sys Did not load driver \SystemRoot\System32\DRIVERS\sflpydisk.SYS

Note that not every “Did Not Load Driver” message necessarily indicates an error that would prevent Windows from booting, because many drivers are not required for Windows to start To repair problems caused by problematic drivers when you can start safe mode, follow these steps:

1. Restart the computer and enable boot logging

2. Restart the computer after it fails and then start safe mode

3 Click Start and then type %WinDir%\ntbtlog.txt The boot log file opens in Notepad

4. Compare the list of drivers loaded in normal mode to the list of drivers loaded in safe mode The driver that is causing the system to fail is one of the drivers listed with

“Loaded Driver…” in the normal mode boot log, but listed with “Did Not Load Driver…”

in the safe mode boot log

5. In safe mode, use Device Manager to replace or roll back potentially problematic drivers, as described in the next section, “How to Roll Back Drivers ” Start by replacing drivers that have been recently installed or updated After replacing a driver, repeat this process until the system starts successfully in normal mode

For the services that run only in normal mode, disable those services one at a time, trying

to restart your computer in normal mode after you disable each service Continue to disable services individually until your computer starts in normal mode

To repair problems caused by problematic drivers when the computer does not start in safe mode, follow these steps:

1. Restart the computer and then load System Recovery tools

2 Click Command Prompt At the command prompt, type Notepad %WinDir%\ ntbtlog.txt Notepad opens and displays the boot log

3. Compare the boot log created when the system failed to start in safe mode to a boot log created when the system started successfully in safe mode If you do not have a boot log that was created when the system started successfully in safe mode, create a boot log on a similarly configured computer by starting it in safe mode The driver that

is causing safe mode to fail is one of the drivers that is not listed in the boot log that

was created when the system failed but is listed with “Loaded Driver…” in the boot log

created when safe mode started successfully

4. Replace the driver file with a working version, using the Copy command at the mand prompt Start by replacing or deleting drivers that have been recently installed

com-or updated After replacing a driver, repeat this process until the system starts fully in normal mode

success-How to Roll Back Drivers

When you update a device driver, your computer might have problems that it did not have with the previous version For example, installing an unsigned device driver might cause the device to malfunction or cause resource conflicts with other installed hardware Installing faulty drivers might cause Stop errors that prevent the operating system from starting in normal mode Typically, the Stop message text displays the file name of the driver that causes the error

Windows provides a feature called Device Driver Roll Back that might help you restore system stability by rolling back a driver update

note You can use System Information or the Sigverif tool to determine whether a driver

on your computer is signed and to obtain other information about the driver, such as sion, date, time, and manufacturer This data, combined with information from the manu- facturer’s Web site, can help you decide whether to roll back or update a device driver.

ver-To roll back a driver, follow these steps:

1. Click Start, right-click Computer, and then click Manage

2. Under System Tools, click Device Manager

3. Expand a category (Network Adapters, for example) and then double-click a device

4. Click the Driver tab and then click Roll Back Driver You are prompted to confirm that you want to overwrite the current driver Click Yes to roll back the driver The rollback process proceeds, or else you are notified that an older driver is not available

How to Temporarily Disable a Service

Many services automatically run at startup, but others are started only by users or by another process When you troubleshoot startup issues that are related to system services, a useful technique is to simplify your computer configuration so that you can reduce system complex-ity and isolate operating system services To decrease the number of variables, temporarily disable startup applications or services and re-enable them one at a time until you reproduce the problem Always disable applications first before attempting to disable system services The System Configuration utility allows you to disable system services individually or several

at a time To disable a service by using the System Configuration utility, follow these steps:

1 Click Start, type msconfig, and then press Enter

2. Do one of the following:

n To disable all services, on the General tab, click Selective Startup and then clear the Load System Services check box

n To disable specific services, on the Services tab, click to clear the check boxes that correspond to the items you want to disable You can also click Disable All to disable all items

If you change any startup setting by using the System Configuration utility, Windows prompts you to return to normal operations the next time you log on The System Configu-ration Utility prompt will appear each time you log on until you restore the original startup settings by clicking Normal Startup under Startup Selection on the General tab To change

a startup setting permanently, use the Services console, change a Group Policy setting, or uninstall the software that added the service

Troubleshooting Startup problems after Logon

If your computer fails immediately after a user logs on, use the process illustrated in Figure 29-13 to identify and disable the failing startup application to allow the user to log on suc-cessfully If the problem occurs immediately after updating or installing an application, try uninstalling that application

Doesholding downthe Shift keyresolve theproblem?

Disable startup applications

by using the SystemConfiguration utility

Modify Group Policy

to identify theproblematic application

Once you identify theapplication, fix oruninstall it

No

Yes

Startup fails after logon

FIgURE 29-13 Follow this process to troubleshoot startup problems that occur after logon

How to Temporarily Disable Startup applications and processes

If a problem occurs after installing new software, you can temporarily disable or uninstall the application to verify that the application is the source of the problem

Problems with applications that run at startup can cause logon delays or even prevent you from completing Windows startup in normal mode The following subsections provide techniques for temporarily disabling startup applications

HOW TO DISaBLE STaRTUp appLICaTIONS USING THE SHIFT KEY

One way you can simplify your configuration is to disable startup applications By holding down the Shift key during the logon process, you can prevent the operating system from running startup programs or shortcuts in the following folders:

To use the Shift key to disable applications and shortcuts in startup folders, log off the computer and then log on again Immediately press and hold down the Shift key Continue

to hold down the Shift key until the desktop icons appear If you can log on successfully, you have isolated the cause of the problem to your startup applications Next, you should use the System Configuration utility to temporarily disable applications one by one until you identify the cause of the problem With the cause of the problem identified, you can fix the applica-tion or permanently remove it from your startup programs

HOW TO DISaBLE STaRTUp pROGRaMS USING THE SYSTEM CONFIGURaTION UTILITY

The System Configuration utility allows you to disable startup applications individually or several at a time To disable a startup program by using the System Configuration utility, follow these steps:

1 Click Start, type msconfig, and then press Enter

2. You can disable all or selective startup applications:

n To disable all startup applications, click the General tab, click Selective Startup, and then clear the Load Startup Items check box

n To disable specific startup items, click the Startup tab and then clear the check boxes that correspond to the items you want to disable temporarily You can also click Disable All on the Startup tab to disable all items

To change a startup setting permanently, you must move or delete startup shortcuts, change a Group Policy setting, or uninstall the application that added the startup application

HOW TO DISaBLE STaRTUp appLICaTIONS CONFIGURED USING GROUp pOLICY OR LOGON SCRIpTS

You can use the Group Policy snap-in to disable applications that run at startup Local Group Policy can be applied to computers, in which case you need to edit the Group Policy settings

on the computer that you are troubleshooting Group Policy objects (GPOs) are frequently applied within AD DS domains, in which case you need to connect to the domain to edit the appropriate policy Before modifying domain Group Policy settings, you should follow the steps described later in this section to disconnect the computer you are troubleshooting from the network to determine whether the problem is related to domain Group Policy settings

To disable startup applications by using the Group Policy Management Editor snap-in, follow these steps:

1 Click Start, type gpedit.msc, and then click OK

2. Within either Computer Configuration (for computer-wide startup applications) or User Configuration (for user-specific startup applications), expand Policies, expand Adminis-trative Templates, expand System, and then click Logon

3. Double-click Run These Programs At User Logon, which is a Group Policy setting Next,

do one of the following:

n To disable all startup applications configured by that policy, click Disabled

n To selectively disable individual programs that are listed in the computer-specific or user-specific policy, click Show In the Show Contents dialog box, select a program

to disable and then click Remove You can change additional Group Policy settings that might help you simplify your com-puter configuration when you are troubleshooting startup problems by enabling the Do Not Process The Run Once List policy If you enable this Group Policy setting, the computer ignores the programs listed in the following RunOnce subkeys the next time a user logs on to the computer:

n HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

n HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceAdditionally, you can enable the Group Policy setting Do Not Process The Legacy Run List

to disable the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run subkey that startup applications might use The programs listed in this subkey are a custom-ized list of programs that were configured by using the System Policy Editor for Windows NT

4 0 or earlier versions If you enable this Group Policy setting, Windows ignores the programs listed in this subkey when you start your computer If you disable or do not configure this Group Policy setting, Windows processes the customized run list that is contained in this reg-istry subkey when you start the computer

Group Policy changes do not always take effect immediately You can use the Gpupdate (Gpupdate exe) tool to refresh local Group Policy changes to computer and user policies After you refresh the policy, you can use the Group Policy Result (Gpresult exe) tool to verify that the updated settings are in effect

Group Policy settings can be applied locally or to an entire domain To determine how tings are applied to a specific computer, use the Resultant Set Of Policy (Rsop msc) tool Then, edit those Group Policy objects to apply a change For the purpose of isolating the source of the problem, you can prevent Group Policy, logon scripts, roaming user profiles, scheduled tasks, and network-related issues from affecting your troubleshooting by temporarily disabling the network adapter and then logging on by using a local computer account

set-If local and domain Group Policy settings do not reveal the source of the startup problem, the application may be started by a logon script Logon scripts are configured in the local

or domain user properties To view the logon script, open Computer Management and then view the user’s properties Then click the Profile tab Make note of the path to the logon script and edit it in a tool such as Notepad to determine whether any startup applications are con-figured For more detailed information about Group Policy, read Chapter 14, “Managing the Desktop Environment ”

How to permanently Disable Startup applications and processes

You can permanently disable a startup application in several ways, explained in the following sections

UNINSTaLL THE appLICaTION

If you find that recently installed software causes system instability or if error messages sistently point to a specific application, you can use Uninstall A Program under Programs in Control Panel to uninstall the software If the application is required, you can install it in a lab environment and perform additional testing before reinstalling it on production computers

con-MaNUaLLY REMOVE THE ENTRY

You can manually delete shortcuts from the Startup folder, remove startup entries from the registry, remove entries from Group Policy or logon scripts, or disable a service For a list of registry subkeys that contain entries for service and startup programs, see the section titled

“Logon Phase” earlier in this chapter

Summary

Windows 7 automatically installs WinRE and improves startup, shutdown, and sleep recovery times Although the startup improvements over Windows Vista are minimal, Windows Vista introduced many improvements over Windows XP that Windows 7 continues to support These features include:

n Windows Boot Manager

n Windows Boot Loader

n The BCD registry file and the BCDEdit command-line tool

n System Recovery tools

n Startup Repair

If you are familiar with earlier versions of Windows, you will be comfortable ing most problems that occur in the kernel loading phase of startup or later Fortunately, you (or any user) can resolve many common startup problems simply by running the Startup Repair tool from the Windows DVD

n Chapter 30, “Troubleshooting Hardware, Driver, and Disk Issues” includes more information about hardware-related startup problems

n Chapter 32, “Troubleshooting Stop Messages” includes more information about Stop errors that might occur during startup

n “Boot Configuration Data in Windows Vista,” which includes detailed information

about the BCD registry file, is found at http://www.microsoft.com/whdc/system /platform/firmware/bcd.mspx

n “BCD WMI Provider Classes” on MSDN is found at http://msdn.microsoft.com/en-us /library/aa362675.aspx.

n Article 92765 in the Microsoft Knowledge Base, “Terminating a SCSI Device,” is found

at http://support.microsoft.com/?kbid=92765

n Article 154690 in the Microsoft Knowledge Base, “How to Troubleshoot Event ID 9,

Event ID 11, and Event ID 15 Error Messages,” is found at http://support.microsoft.com /?kbid=154690

n Article 224826 in the Microsoft Knowledge Base, “Troubleshooting Text-Mode Setup

Problems on ACPI Computers,” is found at http://support.microsoft.com/?kbid=224826

On the Companion Media

n ConfigureCrashSettings ps1

n DetectStartUpPrograms ps1

n DisplayBootConfig ps1

n Get-SystemDisk ps1

C H A P T E R 3 0

Troubleshooting Hardware, Driver, and Disk Issues

n Windows 7 Improvements for Hardware and Driver Troubleshooting 1474

n The Process of Troubleshooting Hardware Issues 1481

n How to Diagnose Hardware Problems 1485

n How to Use Built-In Diagnostics 1491

n How to Troubleshoot Disk Problems 1499

n How to Troubleshoot Driver Problems 1506

n How to Use System Restore 1511

n How to Troubleshoot USB Problems 1511

n How to Troubleshoot Bluetooth Problems 1516

For hardware problems that prevent Windows from starting, see Chapter 29, uring Startup and Troubleshooting Startup Issues ” For network problems, see Chapter 31,

“Config-“Troubleshooting Network Issues ” For problems that result in Stop errors (also known as

blue screens), see Chapter 32, “Troubleshooting Stop Messages ”

Windows 7 Improvements for Hardware and Driver Troubleshooting

Windows 7 includes Reliability Monitor and Resource Monitor to simplify how you isolate the source of hardware problems, allowing you to reduce client computer downtime Additionally, Windows 7 includes several troubleshooting features first introduced with Windows Vista The following sections describe these improvements

Windows Troubleshooting platform

The Windows Troubleshooting Platform, new to Windows 7, is an extensible infrastructure for automated diagnosis of software and hardware problems If you used Windows Network Diagnostics in Windows Vista, you’re familiar with how Windows Troubleshooting Platform works

To the user performing the troubleshooting, the Windows Troubleshooting Platform is a wizard that attempts to identify the source of the problem and might provide instructions

to the user for solving the problem or might solve the problem directly Users can launch a troubleshooting pack from several different locations For example, if Windows Internet Explorer cannot open a Web site, the user can click the Diagnose Connection Problems button

to launch Windows Network Diagnostics (implemented using the Windows Troubleshooting Platform) Users can also launch troubleshooting packs from Control Panel (located at Control Panel\All Control Panel Items\Troubleshooting) or Help And Support

Built-in Troubleshooting packs

Windows 7 includes built-in troubleshooting packs to correlate to the top 10 categories of Microsoft support calls, including power efficiency, application compatibility, networking, and sound Table 30-1 describes the troubleshooting packs that are built into Windows 7 or are currently available using the Windows Online Troubleshooting Service (WOTS) WOTS is a free online service that Windows 7 can use to download new or updated troubleshooting packs

TABlE 30-1 Windows 7 Troubleshooting Packs

TROUBlESHOOTINg PACK DESCRIPTION

displaying Aero animations and effectsPlaying Audio Troubleshoot problems that prevent your computer from

playing soundRecording Audio Troubleshoot problems that prevent your computer from

recording sound

printer

TROUBlESHOOTINg PACK DESCRIPTION

Performance Adjust settings in Windows that can help improve overall

speed and performanceSystem Maintenance Clean up unused files and shortcuts and perform other

maintenance tasks

power consumptionHomeGroup Troubleshoot problems that prevent you from viewing

computer or shared files in a HomeGroupHardware And Devices Troubleshoot problems with hardware and devicesInternet Explorer

Library

Troubleshoot problems that prevent music and movies from being shown in the Windows Media Player LibraryWindows Media Player

Settings

Reset Windows Media Player back to default settings

Windows Media Player DVD Troubleshoot problems that prevent playing a DVD in

Windows Media PlayerConnection to a Workplace

Using DirectAccess

Connect to your workplace network over the InternetShared Folders Access shared files and folders on other computersIncoming Connections Allow other computers to connect to your computerNetwork Adapter Troubleshoot Ethernet, wireless, or other network adaptersInternet Connections Connect to the Internet or to a particular Web site

Program Compatibility Troubleshoot a program that doesn't work in this version of

WindowsSearch And Indexing Troubleshoot problems finding items with Windows SearchWindows Update Troubleshoot problems preventing Windows Update from

working correctly

Windows Troubleshooting platform Components

The Windows Troubleshooting Platform consists of three main components:

n Windows troubleshooting packs A collection of Windows PowerShell 2 0 scripts

that diagnose and resolve problems Because they are based on Windows PowerShell, administrators with scripting experience can create their own troubleshooting packs

You can use this capability to automate troubleshooting of problems unique to your environment, such as those relating to your internal applications or network

n Windows troubleshooting engine The tool that runs the troubleshooting pack’s

Windows PowerShell scripts The Windows PowerShell scripts within a ing pack use a set of developer interfaces provided by the troubleshooting engine to identify root causes, prompt the user for information, and mark problems as resolved

troubleshoot-n The troubleshooting wizard The primary user interface for the troubleshooting

packs The wizard first displays the publisher and description of the troubleshooting pack to the user The Windows PowerShell scripts within the troubleshooting pack can prompt the user through the wizard interface After the troubleshooting pack has completed, the wizard displays the troubleshooting results in a report You can bypass the wizard interface to run the troubleshooting pack from a command line or use Extensible Markup Language (XML)–based answer files to run a troubleshooting pack automatically

Creating Custom Troubleshooting packs

The Windows 7 Software Development Kit (SDK), a free download from

http://download.microsoft.com, includes the Windows Troubleshooting Pack Designer in the

\Bin\TSPDesigner folder You can use the Windows Troubleshooting Pack Designer to create your own troubleshooting packs to troubleshoot common problems not covered by the built-in troubleshooting packs Troubleshooting packs are also a convenient way to maintain computers; by scheduling them to run in an automated way, you can use troubleshooting packs to detect and resolve common problems without user intervention

Users can run stand-alone troubleshooting packs packaged as diagcab files The diagcab file format is a specialized archive that contains each of the troubleshooting pack scripts When packaged as a diagcab file, troubleshooting packs can be distributed using Group Policy preferences, Microsoft System Center Configuration Manager (either during or after deployment), or non-Microsoft software distribution tools For external customers, you could post the diagcab files to a Web site and direct your users to open the Uniform Resource Locator (URL) when they experience a problem

Running Troubleshooting packs Remotely

You can run a troubleshooting pack across the network on a remote computer, which can allow you to diagnose common problems quickly and possibly solve them without walking the user through the troubleshooting process The following Windows PowerShell commands, when run on a Windows 7 computer (either locally or remotely using Invoke-Command or the *-PSession cmdlets), will run the built-in Windows Aero troubleshooting pack, automati-cally attempt to resolve any problems, and store the results to the C:\DiagResult folder Import-Module TroubleshootingPack

$aero = Get-TroubleshootingPack $env:SystemRoot\Diagnostics\System\Aero Invoke-TroubleshootingPack -Pack $aero -Result C:\DiagResult -unattend

You could also use this technique in a script to run a troubleshooting pack on multiple computers across the network; in combination with a custom troubleshooting pack, you could quickly determine which computers suffered from a specific problem or misconfigura-tion Because troubleshooting packs can make configuration changes to solve problems, you could use this approach to detect and resolve a common problem without contacting users

or manually connecting to computers

Reliability Monitor

Two of the biggest challenges of troubleshooting hardware problems are determining when the problem began occurring and what might have changed on the computer to introduce the problem Windows Vista introduced the Reliability Monitor snap-in (as part of the Computer Management console) so that you can easily view application installations, driver installations, and significant failures over several weeks or months

With Windows 7, Reliability Monitor is now integrated with the Action Center to better correlate system changes and events Figure 30-1 shows Reliability Monitor providing details about events on a specific day, including a failed application installation and security updates

FIgURE 30-1 Reliability Monitor provides you with a history of changes and problems

Beyond the improved user interface, Windows 7 extends Reliability Monitor by exposing reliability data via the Windows Management Instrumentation (WMI) Using WMI, you can