A plus 1002 Sub-objective 3.1 – Given a scenario, troubleshoot Microsoft Windows OS problems
A plus 1002 Sub-objective 3.1 – Given a scenario, troubleshoot Microsoft Windows OS problems
Your system can crash anytime it encounters an unexpected condition or fails to receive its next instruction. Many situations see the user successfully shut down the machine and the next time they try to power it up they get an error. Interestingly there are two conditions that identify whether you have a hardware or software problem. If the system boots to a black screen it is highly likely that you have a hardware error. The message will be a little vague but usually points you in the right direction. BSOD, on the other hand, indicates that the operating system is trying to load and has encountered an irrecoverable error. The BSOD provides the error code in hexadecimal which renders it unintelligible to humans, but researching that code can reveal a better explanation of the error along with the conditions that created it.
Chances are that you have not gone a day without hearing a complaint from someone, a coworker friend and frequently from a cashier. No one is completely satisfied with their system’s performance. To separate their impression of performance from the capabilities of their system you have the tools to establish if there is a problem or that the situation is normal operation. Check the Background processes for scheduled tasks that may be hampering performance. A good example would be a scheduled malware scan that is in progress. This operation will impact CPU and Disk usage dramatically. Only on a system that you are authorized to make changes to, perform routine maintenance like disk cleanup and defrag including uninstalling unused programs. Then perform a clean boot to be sure you have a reliable start point. Or benchmark. Now open Task Manager and check the Performance tab. Assess the CPU, Memory and Disk values for signs of problems.
Task Manager Performance
The image shown indicates normal usage. If you see incidence of higher than normal utilization of any of these key areas, check the Startup tab to see if there are any programs that are not frequently used and are consuming resources. Disable those programs after you have investigated their function. Do not disable anything based on your impression. Check the exact filename, research it and then make your determination. Reboot and evaluate system operation anytime you make changes of this nature. Then if satisfied perform the same evaluation using the Processes tab. Here on the Processes tab the running apps appear normal while the Background processes may represent a reasonable amount of memory that could be freed. Remember to fully investigate the application beforehand. As an example ending the Amazon Assistant app eliminated the Microsoft HTML Application freeing up over 70MB of memory.
Task Manager Processes
When you experience limited connectivity or no connectivity at all you should start troubleshooting at the connection points. In a wired environment check that the connection LEDs are lit on the device and the router or switch. Wireless connections should be checked by first viewing the available networks and attempting to connect to your WAP. Investigate hardware failures or driver issues by checking the adapter in Device Manager.
Open a command prompt window. Check the IP configuration with ipconfig and confirm that the settings are correct, and the address is not duplicated. Use Ipconfig /release and ipconfig /renew to refresh your settings Try to ping another host either your router or on the internet like www.google.com. If the internet fails using the URL you may have a DNS problem. Try pinging the IP address 220.127.116.11. If successful diagnose the DNS settings.
Failure to boot
When a system fails to boot it is important to observe all of the conditions and messages that are provided by the system. These will present during post as Invalid System Disk or Disk Boot Failure or No boot device found. All of these messages indicate to you that the error is occurring before the OS loads. Some of the things that would cause this are UEFI/BIOS misconfigurations. For example, if you have inserted a USB Thumb Drive, the system may be configured to treat the USB drive or even the CD-ROM as the primary boot device and subsequently fail. When presented with this condition, reduce the attached hardware to a minimum and clear the optical drives.
No OS found
On a Windows 7 or later system, the missing operating system error often results from UEFI/BIOS being configured to boot from the optical drive or USB device that does not contain a bootable media type like an audio CD, a multimedia DVD or USB drive containing ordinary files. This is the simplest condition in terms of a repair. Simply configure the boot order properly. If your UEFI/BIOS is configured to boot to the hard disk this could be a sign that the disk is failing or has failed. Confirm first that you are attempting to boot to the correct drive. Reduce the machine’s configuration to the minimum requirement, remove any external media sources such as thumb drives and optical disks. If there are more than one possible disk drives present make sure that you are booting from the correct one. If this fails your hard disk may be failing or failed. Start by attempting to repair the system by booting to your installation media and following the GUI prompts. Access the Advanced options and choose startup repair. Use the options that are the least drastic until you have success. Do not reinstall your operating system. Aside from these options consider that this type of error does not occur accidentally this is a sign that your MBR has been corrupted. When you can access the system immediately backup all of your important data. After securing your data run disk maintenance utilities chkdsk and sfc. Consider a hard drive replacement. Here is a look at the Advanced options in Windows 8.1.
Advanced startup options
The Blue screen (BSOD) / Black Screens
The Blue screen presents when an operating system is unable to complete its instruction. This could be due to a missing or corrupt file or malfunctioning hardware. In all cases when you see a Blue screen error it was generated by Windows. It will have a brief explanation and a hexadecimal error code. Research these codes in the order they present to recognize the chain of events that led to the error.
When a Windows system is going to crash or the running application is going to crash you will experience a period of unresponsiveness usually indicated by a circular rotating icon designed to give you hope. This will in many cases be followed by a BSOD. The reason the Blue screen is considered proprietary is that only Windows systems generate this error. It is fatal to the session you are in and you will need to reboot. The system dumps its current state into a memory Dump (.dmp) file for use in troubleshooting. When you encounter a Black screen restart the machine in safe mode and check the event logs.
If you are having printing issues start by confirming that the printer is operational, online and your connection is good print a test page. use the Print Management Tool (printmanagement.msc) to check the print queue for errors. If you find your attempted print job(s) clear the queue and before trying again Check Device Manager for errors.
Services fail to start
When you have a service that fails to start the first stage of your investigation will be easy enough to examine. Use Administrative Tools in Control Panel and open the Services component. There every system service is listed along with its condition. Services can be set for automatic start, or the automatic start can be delayed to have less of an impact on system boot times. They can be started automatically or manually. Here is a look at the MessagingService showing its current status and startup options.
A slow bootup can often be attributed to having too many programs or services starting at once or possibly a fragmented hard disk. Examine the startup impact of programs using Task Manager and evaluate the results. Another cause could be related to the user profile, we’ll cover that in a moment.
Slow profile load
Once the Hardware portion of the boot process completes the system is handed over to the OS and the user can login and load their profile. By default a user profile is created on the local machine when a user first logs in. This profile is stored in in the C:\Users\username folder. It contains the sub-folders relevant to the user. If there are user specific programs that load or possibly corrupted data, it will take more time for the profile to load. When roaming profiles are used the network condition or profile availability can impact the speed of the profile load.
Defragment the hard drive
Since hard disks continuously read and write data to the disk parts of files get separated from each other as fragments. While the system knows where the pieces are, it takes additional time to reconstruct them. Over time frequently used files can take longer to load. The solution is to defragment the drive and restore as much data as possible to it’s original condition. Right click the C: drive and choose Tools then choose Optimize. Below we see that the drives have been recently defragmented and are scheduled for weekly optimization.
Defragment and Optimization
Often the first weapon against a sluggish system is a simple reboot. This clears up any programs that may have been closed but continue running background processes using valuable resources. This leads us to the next topic.
Your PC memory is the most valuable real estate in terms of system operation. As discussed earlier, tasks running in the background can consume quite a bit of memory. Look at the Task Manager image below. The CPU, Disk and Network usage is in good shape. However, our Memory usage is close to 50%! We’re running 11 apps. Most notable in the Apps section is the Google Chrome Browser, it currently has one Tab open but is running 14 instances of the browser using 267MB of memory!
OK so we kill the Browser(s) Microsoft Edge is using 8 instances. That will help but look at the background processes. 83 seems like a lot but you can’t just start killing them because some are critical system processes. The surest resolution is to reboot and see where you stand with no apps running.
You may find that your system will start behaving erratically. If this happens look for an error message. There may be a service that needs attention. If the message provides enough information you can manually restart the service using its name or Process ID (PID) number. Again in Task Manager on the Services Tab right clicking the process will give you the option to stop, restart or get more information. Please remember that these services are named cryptically and your actions could end you session. Reboot when you can to be safe.
Update network settings
When you have a machine the does not connect properly or maintain the connection the first order of business is to isolate the issue to that machine. If other devices are connecting reliably then it’s time to try resetting your network connection. In windows 10 go to Settings Then Network and Internet. The Status page is displayed. Scroll down in the right pane and click Reset now. Be advised that your PC will reboot and you may need to reconfigure any VPN or virtual switch connections. Have your passwords handy!
If you believe your system was corrupted by a recent update you can try to restore the previous version. This will retain your data. You can also reinstall Windows as an upgrade which will also save your data. When you have a system that is beyond conventional repairs it’s time to take more drastic measures. Using a system image will repair the system but lose all data and settings. Reloading the OS from the OEM recovery partition will also wipe out your personal data.
Roll back updates
Windows updates have caused more than a few problems. They’re getting better but there is always that one case… If you have a problem Windows 10 can help you recover. Go to Settings and choose Update and Security. There you will see Recovery in the left pane and the option to Get started! You’ll be asked if you want to keep your files and that’s usually a good idea, you will lose your apps and settings..
Roll back device drivers
Keeping your device drivers up to date is a good practice as you will get the benefits of any improvements since the last update. A malfunctioning device driver can cause varying degrees of bad system behavior. If after a driver update you find that you’re having problems go to Device Manager select the device in question and access its properties. Click the Driver tab and you’ll see the option to Roll Back the drivers.
Roll Back Driver
Your Windows 10 system will check for system updates and apply them automatically. You can check the update status and apply updates by accessing the Settings, clicking Update & Security then Windows Update. Click check for updates. This allows you to check for updates and manually install any that are ready.
This system had an update available and it is installing. A reboot may be required to complete this process.
Applying Windows Update
When you have an app that crashes or behaves erratically You can attempt to repair it using Windows tools. Go to Settings then Apps. The Apps & features menu is displayed in the right pane. You will see an extensive list containing Microsoft apps and any user installed applications. Find the offending app and click it. You will see the option to Modify or Uninstall it. For Microsoft apps there are Advanced options that will allow you to Terminate, Repair, Reset, or uninstall the app. Apps that load at startup can be accessed and controlled by clicking Startup in the laft pane and evaluating their impact on the startup process.
Apps and features
Update boot order
If you are having problems booting the system you can change the boot device order in BIOS/UEFI to boot to another device or media. On a multi-boot system the order of Operating System booting with System Configuration utility (msconfig.exe).
– Disable Windows services/applications
To disable Windows services type Services in the Search bar and launch the Services app. Select the service and choose Disabled on the Startup type dropdown list.
Disable application startup
To disable applications at startup open System settings, click Apps then select Startup in the left pane. This will provide a list of all user apps and the impact they have on the startup process. Simply turn off anything you don’t want running at startup using the On/Off switch.
A setting in the System Configuration utility can be most easily by entering msconfig in the search or run boxes. This tool is extremely useful when trying to isolate a particular startup item. Open the System Configuration utility and choose the Boot tab there you will see your operating system choices along with your safe boot options. This hidden (from most) capability allows you to temporarily boot the system to various specific configurations to test the behavior. Do not make these changes permanent! Identify and resolve the problem, then uncheck the Safe boot option.
MSConfig with Safeboot
Rebuild Windows profiles–
A corrupt user profile can cause Windows not to load. There are a few ways to handle this issue. First, try the Windows Troubleshooter it is in Control Panel and uses the Troubleshoot Icon. Use the Advanced options to run as Administrator and make the repairs.
Run the System File Checker (sfc /scannow) from a Command Prompt.
Use System Restore if there is a recent Restore Point See if that helps
Delete the profile. Log in to a different account with administrative privileges. Open Control Panel and then User Accounts. Click on the account you want to delete and choose Delete account in the left menu. You will have the option to retain some user files and save them to the Desktop. Some settings and email will be lost.
User account deletion
Well, that’s all for A+ exam sub-objective 3.1! Keep up the good work. See you in 3.2!