Windows Troubleshooting Reference
Symptom to cause to first action, for the Windows problems A+ Core 2 (220-1202) puts in front of you. Covers boot failures, the repair tools, malware removal order, and the security settings on objective 2.2.
Boot and startup symptoms
| Symptom | Usual cause | First thing to try |
|---|---|---|
| No boot device found | Boot order changed, or the drive is not detected | Check the firmware boot order, then the drive cable and power |
| BOOTMGR is missing | Damaged boot files or wrong active partition | Startup Repair from recovery media, then bootrec /rebuildbcd |
| Blue screen right after a driver install | Bad or mismatched driver | Safe Mode, then roll back the driver in Device Manager |
| Reboot loop after an update | Failed update or damaged system files | Recovery Environment: uninstall the update, or System Restore |
| Black screen after sign in | Explorer is not running, or a display driver fault | Ctrl+Shift+Esc, then run explorer.exe as a new task |
| Very slow boot | Too many startup programs or services | Task Manager Startup tab; msconfig for boot options |
| Blue screen naming memory | Failing RAM module | Run mdsched.exe, then test one module at a time |
| Windows loads to Recovery every time | Repeated boot failures triggered automatic repair | Read the log at the repair screen, then run sfc and chkdsk offline |
Recovery and repair tools
| Tool | What it does | How to reach it |
|---|---|---|
| Safe Mode | Boots with minimal drivers and services so you can undo a change | Shift plus Restart, Troubleshoot, Advanced options, Startup Settings |
| System Restore | Rolls system files, drivers and registry back to a restore point; personal files are left alone | rstrui.exe |
| Startup Repair | Automated repair of boot files and configuration | Recovery Environment, Advanced options |
| Reset this PC | Reinstalls Windows, with a choice to keep or remove personal files | Settings, System, Recovery |
| System File Checker | Repairs protected system files from the local cache | sfc /scannow |
| DISM | Repairs the component store that System File Checker pulls replacement files from | dism /online /cleanup-image /restorehealth |
| Event Viewer | Application, security and system logs with error detail | eventvwr.msc |
| Reliability Monitor | Timeline of crashes, failed updates and app failures | perfmon /rel |
| Task Manager | Processes, startup impact, services and resource use | Ctrl+Shift+Esc |
| Windows Memory Diagnostic | Tests RAM on the next reboot | mdsched.exe |
Run box and .msc shortcuts
| Command | Opens |
|---|---|
| devmgmt.msc | Device Manager |
| diskmgmt.msc | Disk Management |
| compmgmt.msc | Computer Management (holds most of the snap-ins below) |
| services.msc | Services |
| eventvwr.msc | Event Viewer |
| taskschd.msc | Task Scheduler |
| perfmon.msc | Performance Monitor |
| lusrmgr.msc | Local Users and Groups (not in Home editions) |
| gpedit.msc | Local Group Policy Editor (not in Home editions) |
| secpol.msc | Local Security Policy (not in Home editions) |
| certmgr.msc | Certificates for the current user |
| msinfo32 | System Information |
| msconfig | System Configuration: boot options and services |
| resmon | Resource Monitor |
| regedit | Registry Editor (export the key before you change it) |
Malware removal procedure, in order
| # | Step | Why it is here |
|---|---|---|
| 1 | Investigate and verify the symptoms | Confirm it is malware and not a failing disk or a bad update |
| 2 | Quarantine the infected system | Disconnect it so the infection cannot spread or call out |
| 3 | Disable System Restore | Restore points can hold the infection and put it back |
| 4 | Remediate | Update the anti-malware definitions, then scan and remove |
| 5 | Schedule scans and run updates | Recurring scans plus current OS and definition updates |
| 6 | Re-enable System Restore and create a restore point | Give the clean system a known good point |
| 7 | Educate the end user | The behaviour that let it in is the thing that repeats |
Application and performance symptoms
| Symptom | Usual cause | First thing to try |
|---|---|---|
| Application will not launch | Damaged install or a missing dependency | Repair or reinstall; read the Application log in Event Viewer |
| Low memory warnings | Too many processes, a leaking app, or too little RAM | Sort Task Manager by memory; check the page file size; add RAM |
| Certificate warning on every HTTPS site | System clock is wrong, or a root certificate is missing | Fix the date, time and time zone first |
| Clock drifts after every reboot | Dead CMOS battery, or the time service cannot reach a server | w32tm /resync, then replace the CMOS battery |
| Pop-ups and redirected searches | Malicious browser extension or bundled adware | Remove extensions, reset the browser, run a full scan |
| Signed in with a temporary profile | The user profile is damaged | Create a new profile and copy the data across |
| USB device not recognized | Driver problem or insufficient port power | Device Manager: uninstall the device, then scan for hardware changes |
| Printer output is garbled | Wrong or corrupt print driver | Remove the driver and install the correct one for the model |
| Services fail to start after boot | Dependency service disabled, or wrong logon account | services.msc: check the Dependencies and Log On tabs |
| Disk activity pinned at 100 percent | Indexing, an update, or a failing drive | Task Manager to find the process; then check SMART status |
Windows OS security settings
| Setting | What it does |
|---|---|
| BitLocker | Encrypts the whole volume; uses the TPM to release the key at boot |
| BitLocker To Go | The same volume encryption for removable drives |
| EFS | Encrypts individual files and folders; needs NTFS, not available in Home editions |
| User Account Control | Prompts for consent or credentials before an action runs elevated |
| Windows Defender Firewall | Inbound and outbound rules held separately per profile: Domain, Private, Public |
| Windows Security | Built-in antivirus, real-time protection and threat history |
| Local Security Policy | Password length and age, account lockout, audit policy (secpol.msc) |
| NTFS permissions | Apply locally and over the network; Deny beats Allow |
| Share permissions | Apply only over the network; the more restrictive of share and NTFS wins |
| Standard vs administrator account | Daily work runs as a standard user; sign in as an admin only for admin tasks |
Ready to test yourself?
Memorizing a table is a start, practice questions make it stick.