When facing a system crash or startup up problems on Windows Computers, troubleshooting the problem can be difficult to resolve. The first step with recovery is to use Windows Safe Mode option during startup. One Safe Mode option that will help troubleshoot boot problems is to enable Boot Logging which will create a log and help identify the device or driver that is causing the problem during startup.

When Boot Logging is enable, Windows boots normally, until the device or driver that is causing the problem either crashes the system or completes starting up but causes an error message in the Event Log. While booting, Windows creates a log file that lists every step processed that is attempted and completed.

You can then reboot in to Safe Mode and review the log file named ntbootlog.txt. The log is stored in the %SYSTEMROOT% directory (normally C:\Windows or C:\WINNT folder). Below is an example of ntbootlog.txt log file on Windows XP (Vista log is similar):

Service Pack 2 5  4 2007 10:45:44.500
Loaded driver \WINDOWS\system32\ntkrnlpa.exe
Loaded driver \WINDOWS\system32\hal.dll
Loaded driver \WINDOWS\system32\KDCOM.DLL
Loaded driver \WINDOWS\system32\BOOTVID.dll
Loaded driver ACPI.sys
Loaded driver \WINDOWS\System32\DRIVERS\WMILIB.SYS
Loaded driver pci.sys
Loaded driver isapnp.sys
Loaded driver compbatt.sys
Loaded driver \WINDOWS\System32\DRIVERS\BATTC.SYS
Loaded driver intelide.sys
Loaded driver \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
Loaded driver MountMgr.sys
Loaded driver ftdisk.sys
Loaded driver dmload.sys
Loaded driver dmio.sys
Loaded driver PartMgr.sys
Loaded driver VolSnap.sys
Loaded driver atapi.sys
Loaded driver vmscsi.sys
Loaded driver \WINDOWS\System32\DRIVERS\SCSIPORT.SYS
Loaded driver disk.sys
Loaded driver \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
Loaded driver fltmgr.sys
Loaded driver sr.sys

To enable Boot Logging on Windows XP and Vista, boot your Computer, and during startup continually press F8 until the menu screen appears:

NOTE: screen shot is from XP. Vista menu will look slightly different than XP.

Press F8 to display the Advanced Menu screen and select Enable Boot Logging

You will be returned to the menu screen and you should see Enable Boot Logging in blue displayed at the bottom of the screen (don't worry if this screen is not displayed and Windows starts to boot):

If the problem does not cause Windows to crash, and after startup has completed, you can review the ntbootlog.txt file. Look for any signs of problems loading device drivers. If you find problems, go into Device Manager and disable the device or uninstall the program, then reboot again. If the problem does not occur then you know it was that device and you should check the vendor website for new drivers or known issues.

If your problem does cause Windows to crash, reboot into Safe mode by selecting Safe Mode from the Advanced Menu screen. When reviewing ntbootlog.txt file, look for events that were attempted to load but not completed. More than likely the problem will be toward the end of the file (since that was the last item logged before crashing). When you identify the problem, either uninstall the application or go in to Device Manager and disable the device. Reboot your Computer and see if the problem still exist. If it boots without crashing, check the vendor website for new drivers or known issues.

If you are still having problems, enable Boot Logging again to see if new events are logged after you have disabled the device or uninstalled the program. If you are unable to fix the problem, you may need to have a Computer shop troubleshoot the problem for you.

Notes on Boot Logging:

• Boot Logging can only be enabled from Safe Mode. Once it is enabled, it only logs during the current boot. It will not log during the next reboot unless you enable it again from Safe Mode.
• If an existing ntbootlog.txt files exist, the next time Boot Logging is enabled, Windows will append to the existing log file.
• It is a good idea to have Windows create a new log when there are no problems or after you have added new devices. This will allow full logging to occur and will let you compare with a log when problems exists.

This can happen to any of us, usually we forget Windows accounts' passwords, when we want it least of all. But such situations are very common and this is good when you know how to reset it, as it will save your time and efforts in future.

This is an instruction how to reset account password in Windows XP (on condition that you do not have password set on Administrator account):

1. Reboot PC/laptop in Safe Mode (press and hold 'F8' button when the PC starts and choose 'Safe Mode' in the list). Log in under 'Administrator' account.

Frequently this account doesn't have password set. 

You're prompted to set password on it during Windows XP installation.

2. Go to [Start] > [Control Panel] > [Administrative Tools] > [Computer Management] :

3. Expend 'System Tools' node, then 'Local Users & Groups' and choose 'Users'. On the right side choose user account and right-click on it. Menu with options will appear.

Select "Set Password..." option.

4. The confirmation window will appear. Press 'Proceed' button to continue the process of resetting password:

5. After that the window with the passwords fields will appear. Enter new password twice, or leave these fields empty to log in without password.

When computer faced a major virus infestation, it might be necessary to boot computer into safe mode and perform some actions there. What is the difference between normal boot and Safe Mode? Only basic drivers and services are loaded when booting into safe mode, thus not allowing viruses to start themselves. Most of the viruses will not operate in Safe Mode, so you could try curing it. It is not a surprise that some viruses disable safe mode as soon as they take control of computer.

How can be Safe Mode disabled? In most cases viruses simply delete registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot. When you try booting into safe mode on the machine that has this key deleted, you will receive the following BSOD:

Solution:

In this case you will need to find computer with the same version of OS and Service Pack, get these settings from there and then import them into problematic computer. To export settings from working computer, you will need to do the following:

1. Open regedit
2. Navigate your way to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot and export its contents into a file

This will create a reg file that we will transfer to the machine without SafeBoot.

Alternatively, you could use registry files created on our test machines, but some settings are machine-specific, so these files are provided "as is".

WinXP_SafeBoot.reg (26,81 kb)

Win7_SafeBoot.reg (36,04 kb)

Now when when these reg files are on the computer that needs Safe Mode restored, merge them with the registry. You can do that either by double-clicking or by right-clicking on the reg file and selecting Merge option from the dropdown menu.

SafeBoot should work from now on if the problem was in deleted key.

Initial Problem:

User cannot boot into Windows. He was able to boot into Safe Mode. User said that video adapter configuring were made before the problem started.

Cause:

Video adapter chipset drivers failed to install and lead to system failure. Safe Mode option was available because in this mode system loads basic video drivers.

Solution:

To resolve this problem appropriate video adapter driver should be installed.

Here is the troubleshooting steps:

1. Boot Windows using VGA Mode (an option from Advanced Boot Menu). This mode is the best for this type of problem because it allows user to access the Internet (for driver updates) and support add-ons and ActiveX controls of web browser (some manufacturers' sites require additional add-ons and ActiveX controls to be enabled).

2. Go to manufacturer's web site and download drivers for your video adapter model.

3. Install the drivers.

4. Restart your computer.

Initial Problem:

Every time you download or install a new game, application, or software update, you make changes to your computer. Sometimes that change may make your system unstable. Have you ever wanted to go back to the way it was? With System Restore, you can.

System Restore works a lot like the Undo command in Microsoft Word. You can use System Restore to remove any system changes that were made since the last time you remember your computer working correctly. System Restore does not affect your personal data files (such as Microsoft Word documents, browsing history, drawings, favorites, or e-mail) so you won't lose changes made to these files.

To restore Windows Vista click here

Solution:

If Windows XP will start:

• Log on to Windows as an Administrator.
• Click Start, point to All Programs - Accessories - System Tools - System Restore.
• On the Welcome to System Restore page, click Restore my computer to an earlier time, and click Next.
• Or type or paste the following command in the Start - Run box then press Enter.

%systemroot%\system32\restore\rstrui.exe

This command can be used at the Safe Mode Command Prompt also.

On the Select a Restore Point page, click on a bold date on the calendar pryer to the day of the problem stated. There may also be a restore point for an earlier time on the same day. Try to use a restore point as close as possible to a time just before the problem started. If the problem persists, an earlier restore point can be used.

On the Confirm Restore Point Selection page, click Next. System Restore restores the previous Windows XP configuration, and then restarts the computer.

If Windows will not start in normal mode

System Restore can be run form Safe Mode or Safe Mode Command Prompt.

Warning: When restoring a system from Safe Mode or from the Command Prompt an Undo restore point will NOT be created!

Initial Problem:

In some special cases you may need to boot the system in safe mode. This article discusses the several Safe Boot options that Windows XP supports. These options load a minimal set of drivers. You can use these options to start Windows so that you can modify the registry or load or remove drivers.

Solution:

If Windows XP is the only operating system installed on your computer, booting into Safe Mode with these instructions.

• If the computer is running, shut down Windows, and then turn off the power

• Wait 30 seconds, and then turn the computer on.

• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.

• Ensure that the Safe mode option is selected.

• Press Enter. The computer then begins to start in Safe mode.

• When you are finished with all troubleshooting, close all programs and restart the computer as you normally would.

To use the System Configuration Utility method

• Close all open programs.

• Click Start, Run and type MSCONFIG in the box and click OK

• The System Configuration Utility appears, On the BOOT.INI tab, Check the "/SAFEBOOT" option, and then click OK and Restart your computer when prompted.

• The computer restarts in Safe mode.

• Perform the troubleshooting steps for which you are using Safe Mode.
  When you are finished with troubleshooting in Safe mode, open MSCONFIG again, on the BOOT.INI tab,  uncheck "/SAFEBOOT" and click OK to restart your computer

Windows as part of a multiboot system

Use this method ONLY if you have multiple operating systems installed on your computer.

• If the computer is running, shut down Windows, and then turn off the power

• Wait 30 seconds, and then turn the computer on.
  

• When the Boot loader menu (list of the available operating systems) appears, use the arrow keys on the keyboard to select the version Windows what you want

• Press Enter, and then immediately begin tapping the F8 key. The Windows Advanced Options menu appears.

• Scroll to and select the Safe mode menu item, and then press Enter.

Description of Safe Boot options

• Safe Mode (SAFEBOOT_OPTION=Minimal): This option uses a minimal set of device drivers and services to start Windows.

• Safe Mode with Networking (SAFEBOOT_OPTION=Network): This option uses a minimal set of device drivers and services to start Windows together with the drivers that you must have to load networking.

• Safe Mode with Command Prompt (SAFEBOOT_OPTION=Minimal(AlternateShell)): This option is the same as Safe mode, except that Cmd.exe starts instead of Windows Explorer.

• Enable VGA Mode: This option starts Windows in 640 x 480 mode by using the current video driver (not Vga.sys). This mode is useful if the display is configured for a setting that the monitor cannot display.

  
  Note Safe mode and Safe mode with Networking load the Vga.sys driver instead.

• Last Known Good Configuration: This option starts Windows by using the previous good configuration.

• Directory Service Restore Mode: This mode is valid only for Windows-based domain controllers. This mode performs a directory service repair.

• Debugging Mode: This option turns on debug mode in Windows. Debugging information can be sent across a serial cable to another computer that is running a debugger. This mode is configured to use COM2.

• Enable Boot Logging: This option turns on logging when the computer is started with any of the Safe Boot options except Last Known Good Configuration. The Boot Logging text is recorded in the Ntbtlog.txt file in the %SystemRoot% folder.

• Starts Windows Normally: This option starts Windows in its normal mode.

• Reboot: This option restarts the computer.

• Return to OS Choices Menu: On a computer that is configured to starting to more than one operating system, this option returns to the Boot menu.