4.1.1. Troubleshoot common Windows OS issues. (Obj. 3.1)

💡 First Principle: Isolate the issue by differentiating between system-wide failures (OS), application-specific failures (app), and external factors (connectivity).

When a Windows computer misbehaves, the symptoms can range from a minor annoyance to a complete system failure. A technician's job is to interpret these symptoms and follow a logical path to the root cause.

Figure: Windows 10/11 Blue Screen of Death showing a stop code and QR code for troubleshooting

• Blue Screen of Death (BSOD): This is a Windows "stop error," a critical failure from which the OS cannot recover. The blue screen itself contains vital clues, including a stop code (e.g., IRQL_NOT_LESS_OR_EQUAL) and often the name of the faulting driver file (e.g., nvlddmkm.sys). Your first step is to research this stop code. BSODs are most commonly caused by faulty hardware (especially RAM), corrupt drivers, or low-level system file corruption. A named .sys file points at its driver (nvlddmkm.sys is the NVIDIA display driver). Common codes: MEMORY_MANAGEMENT usually means faulty RAM; DRIVER_IRQL_NOT_LESS_OR_EQUAL a bad device driver; INACCESSIBLE_BOOT_DEVICE a storage-controller or boot-configuration problem; CLOCK_WATCHDOG_TIMEOUT, or crashes that only happen under heavy load, point to CPU stress such as overheating or overclocking. Gather evidence from the System log in Event Viewer and rule out RAM with Windows Memory Diagnostic.
• "Operating System Not Found" / Boot Failures: When the computer starts, you may see an error like this. This points to a problem in the boot process. Your theory should be:
  1. Is the boot order in the BIOS/UEFI correct? Maybe the PC is trying to boot from a non-bootable USB drive.
  2. Is the boot drive physically connected and detected by the BIOS/UEFI?
  3. Is the boot sector (MBR or GPT) corrupt? Tools like bootrec /fixmbr and bootrec /rebuildbcd from the Windows Recovery Environment can fix this.
  4. Is the drive itself failing?
• Windows Recovery Environment (WinRE) Tools: WinRE is a separate repair environment, reached from Settings > System > Recovery > Advanced startup, by holding Shift while choosing Restart, or automatically after repeated failed boots. Because it does not depend on the installed Windows starting, it can repair boot problems that stop even Safe Mode from loading. Pick the least destructive tool that fits. Safe Mode loads only a minimal set of drivers and services, so if Windows is stable there but not in normal mode, a third-party driver, service or startup program is the cause. Startup Repair automatically fixes problems that stop Windows from loading, and Command Prompt runs manual repairs such as bootrec and sfc; both leave apps and settings intact. System Restore rolls system files, the registry, drivers and installed programs back to a restore point (useful after a bad driver or update) but does not touch personal files, so it cannot bring back deleted documents. Reset this PC reinstalls Windows when it is too damaged to repair: Keep my files preserves personal files but removes apps and settings; Remove everything wipes the drive.
• Applications Crashing / Freezing: If a single application is crashing but the rest of the OS is fine, the problem is likely with that application. Check Event Viewer for application error logs. The solution often involves updating the application, reinstalling it, or checking for conflicts with other software or drivers.
• Slow System Performance: This is a common complaint with a wide range of causes. Use Task Manager to see what's consuming resources (CPU, RAM, Disk). It could be a runaway process, too many startup programs, not enough RAM, a failing hard drive (indicated by 100% disk utilization), or a malware infection.
• Other Performance Checks: Check free disk space, the Task Manager Power usage column (one process monopolizing the CPU drains a laptop battery), and Windows Search building its index (temporary heavy disk activity; if search misses recent files, rebuild the index from Indexing Options in Control Panel). On an older PC with a mechanical hard drive, replacing it with an SSD is usually the most noticeable single upgrade.
• Low Memory Warnings: Windows is running short of RAM plus page file. Use Task Manager to find and close memory-heavy apps; the lasting fix is more RAM. If one process's memory use keeps climbing until RAM runs out, the application has a memory leak: it never releases memory it no longer needs, so closing or updating the app is the fix. When RAM is full, Windows constantly swaps pages between RAM and the page file, keeping the disk busy and everything slow; this is disk thrashing. Disabling the page file makes low-memory crashes worse, not better.
• Frozen Applications: If End task on the Processes tab doesn't work, go to the Details tab, right-click the executable and choose End process tree to kill it and its child processes.
• Compatibility and Dependencies: An app that breaks after a major Windows feature update is usually incompatible with the new build, so check for a vendor update or try Compatibility mode. Apps that need runtimes such as .NET or the Visual C++ Redistributables fail when they're missing; installed runtimes are listed in Programs and Features. If an app fails for one user but works for others, suspect that user's profile or local app settings.
• Slow Profile Load / Profile Problems: A long wait after entering the password usually means too many startup programs or a very large (roaming) profile. Desktop settings that don't stick, such as icons rearranging after every reboot, point to a corrupt user profile.
• Services Not Starting: A service set to Automatic but found Stopped has usually crashed or failed to start. Check it in the Services console (services.msc), where you start, stop and restart services, and find the reason in Event Viewer's System log. Many symptoms trace back to one stopped service: DHCP Client obtains IP addresses, Print Spooler queues print jobs, and Windows Time keeps the clock synchronized.
• Time Drift: Domain (Kerberos) authentication fails when a PC's clock differs from the domain controller's by more than about five minutes. If the date survives reboots but the clock drifts, the Windows Time service isn't synchronizing; a clock that resets to an old date at every boot points to a failing CMOS battery instead.
• Frequent Shutdowns: Sudden power-offs under heavy load, with the laptop or case hot, point to overheating (a blocked fan or heatsink). Event Viewer logs Kernel-Power Event ID 41 when the system rebooted without cleanly shutting down first; it records that power was lost, not why. A laptop that freezes only on battery points to the power-management settings that apply on battery (aggressive CPU or device power saving) rather than to Windows itself.
• Device and Peripheral Problems: Unlike a driver problem, where Device Manager still lists the device (with a yellow exclamation point), a built-in device missing from Device Manager entirely is usually disabled in BIOS/UEFI (or disconnected). If print jobs vanish from one user's queue while others print to the same printer fine, suspect that workstation's printer driver. A dim or flickering laptop screen at full brightness is a failing backlight (or inverter on older panels), and erratic 'ghost' touches on a touchscreen usually mean a dirty or damaged screen.
• Recovering Deleted Files: With no backup, stop using the drive immediately, because new writes can overwrite the deleted data, and run file-recovery software.
• Certificate Errors on Every Website: Check the date and time first. A certificate is valid only between its start and expiry dates, so a wrong system clock makes every HTTPS site fail validation at once; correct the clock and sync it to a time server.
• Failing Drive with Irreplaceable Data: Stop using the drive at once, because every hour of use risks total failure. Recover first, repair later: attach it to a healthy system as a secondary drive rather than booting from it, copy the data to known-good storage, confirm the copies actually open, and only then replace or securely wipe the drive.

Technician's Diagnostic Path: Scenario: A user reports that their PC has started crashing to a Blue Screen of Death (BSOD) several times a day. It seems to happen randomly. You are able to get it to boot.

This scenario walks through applying the troubleshooting methodology to a real BSOD issue:

1. Identify the Problem & Gather Clues: The problem is intermittent BSODs. Ask the user: "When did this start? Did you install any new hardware or software recently?" The user mentions they updated their graphics card driver two days ago. You note the stop code from the last crash: SYSTEM_SERVICE_EXCEPTION.
2. Establish a Theory: The timing strongly suggests the new graphics driver is the cause. The driver may be buggy or incompatible, causing a conflict at the kernel level. A secondary theory is failing hardware, like RAM.
3. Test the Theory (Driver First):
   • Boot Windows into Safe Mode. If the system is stable in Safe Mode (which uses a generic video driver), this strengthens the theory that the graphics driver is the problem.
   • In normal mode, open Device Manager. Find the display adapter, right-click it, go to Properties -> Driver tab.
   • Click "Roll Back Driver". This will uninstall the new driver and revert to the previously installed, stable one.
4. Verify Functionality: After rolling back the driver and rebooting, use the computer normally. If the BSODs do not recur for a significant period (a day or two), you have likely found the cause.
5. Establish a Plan of Action: The rollback is the immediate fix. The long-term plan is to visit the graphics card manufacturer's website and look for a different, stable version of the driver—perhaps a slightly older one or a newer beta version that specifically addresses the bug.
6. Alternative Test (if driver rollback fails): If the BSODs continue, your next theory is faulty RAM. Run the built-in Windows Memory Diagnostic tool or a more thorough tool like MemTest86 overnight to test the memory modules for errors.

Reflection Question: When a Windows PC experiences a Blue Screen of Death (BSOD), what is the most important piece of information to note from the blue screen itself, and why?