This chapter covers troubleshooting Windows boot failures, a critical skill for the CompTIA A+ Core 2 (220-1102) exam, specifically under Objective 3.1 (Given a scenario, troubleshoot common Windows OS problems). Boot failures are a frequent topic on the exam, appearing in roughly 10-15% of troubleshooting questions. Mastering the boot process, recovery tools, and error interpretation is essential for both the exam and real-world IT support. We will dissect each boot stage, common failure points, and step-by-step repair methods using built-in Windows tools like the Recovery Environment (WinRE) and Advanced Boot Options.
Jump to a section
Windows boot is like a relay race with four runners, each handing a baton to the next. The first runner (UEFI/BIOS) starts from a dead stop—it checks the track (hardware POST) and then passes the baton to the second runner (Boot Manager). The Boot Manager reads a sign (BCD) telling it which path to take and which third runner to tag (Windows Boot Loader). The third runner (Winload.exe) carries the baton into the OS starting line, loading the kernel and core drivers. At this point, the track changes from a simple oval to a complex obstacle course. The fourth runner (Session Manager Subsystem) takes the baton, starts all the background services (like a pit crew), and finally hands off to you—the user—who logs in. If any runner drops the baton (e.g., a missing boot file, corrupted BCD, failed driver), the race stops. The troubleshooting process is like reviewing race footage: you check each handoff point (boot stage) to see where the baton was dropped. The exact error message or screen tells you which runner failed, guiding your repair. For example, if the Boot Manager can't read the BCD, the race halts before the third runner even starts—that's an 'Operating system not found' error.
Windows Boot Process Overview
The Windows boot process is a sequence of phases that transition control from firmware to the OS kernel. Understanding each phase is crucial for pinpointing where a failure occurs. The phases are:
Pre-Boot (UEFI/BIOS + POST)
Boot Manager (Bootmgr)
Boot Loader (Winload.exe)
Kernel Loading (NTOSKRNL.exe)
Session Manager (SMSS.exe)
Winlogon (Logon)
Each phase has specific files, registry keys, and error messages. The exam expects you to map symptoms to the failing phase.
Pre-Boot Phase: Firmware and POST
When the system is powered on, the UEFI (or legacy BIOS) firmware performs a Power-On Self-Test (POST) to verify hardware integrity. On UEFI systems, the firmware reads the NVRAM boot entries to find the Windows Boot Manager (bootmgfw.efi). On legacy BIOS, it reads the Master Boot Record (MBR) from the first boot device. Common failures here include:
No POST: beep codes or blank screen indicating hardware failure (power supply, RAM, CPU).
Boot device not found: incorrect boot order in firmware settings, disconnected drive, or corrupted MBR/GPT.
The exam often tests that a 'Boot device not found' error points to firmware settings or disk connectivity, not Windows files.
Boot Manager Phase: bootmgr and BCD
Once the firmware locates the boot device, it loads the Windows Boot Manager (bootmgr on BIOS, bootmgfw.efi on UEFI). The Boot Manager reads the Boot Configuration Data (BCD) store, located at \Boot\BCD on the active partition. The BCD contains entries for each installed OS, including drive letters, paths to boot loaders, and boot parameters (e.g., safe mode, kernel debugging).
Common failures: - Missing or corrupted BCD: Results in 'Boot Configuration Data is missing' or '0xc000000f' error. Caused by accidental deletion, disk corruption, or dual-boot misconfiguration. - Missing bootmgr: Error 'Bootmgr is missing' (BIOS) or 'File: \EFI\Microsoft\Boot\bootmgfw.efi not found' (UEFI). Often due to a damaged boot sector or inactive system partition.
The exam loves to test that you can rebuild the BCD using bootrec /rebuildbcd or bootrec /fixmbr (for BIOS). For UEFI, you may need to use bcdedit or bootrec /fixboot.
Boot Loader Phase: Winload.exe
The Boot Manager loads the Windows Boot Loader (winload.exe for BIOS, winload.efi for UEFI). Winload loads the OS kernel (ntoskrnl.exe) and the Hardware Abstraction Layer (hal.dll), along with boot-critical drivers. It also reads the registry hive SYSTEM to determine which drivers to load at boot.
Failures here often produce: - 0xc0000428: Invalid image hash (driver signature issue). - 0xc0000001: Boot-critical driver missing or corrupt. - 0xc0000225: File not found or missing critical system file.
The exam tests that you can use Last Known Good Configuration or Safe Mode to bypass a faulty driver. If Safe Mode fails, you may need to restore system files via System File Checker (SFC) or DISM.
Kernel Loading Phase: NTOSKRNL.exe
Winload passes control to the kernel, which initializes the Executive subsystems (memory manager, object manager, etc.). The kernel loads the SYSTEM registry hive and starts boot-start drivers. If a driver fails, the system may bugcheck (BSOD) with a stop code like DRIVER_IRQL_NOT_LESS_OR_EQUAL or SYSTEM_SERVICE_EXCEPTION.
The exam tests that you can use Safe Mode to load only essential drivers, or use Driver Verifier Manager to identify problematic drivers.
Session Manager Phase: SMSS.exe
The Session Manager Subsystem (smss.exe) starts the Windows subsystem, creates system environment variables, and launches the Windows Logon process (winlogon.exe). It also runs the Program Compatibility Assistant (PCA) and other early services. Failures here may result in a blank screen after the Windows logo, or a 'Session Manager initialization failed' error.
Winlogon Phase: Logon
Winlogon presents the logon screen. After authentication, the Service Control Manager (SCM) starts services set to 'Automatic', and the Userinit.exe process loads the user profile. Failures here include:
Continuous reboot loop: often caused by a service or application crashing during logon.
'User profile cannot be loaded': corrupted profile registry hive (ntuser.dat).
The exam tests using Safe Mode or Last Known Good Configuration to bypass a problematic service. If the user profile is corrupt, you may need to rename or restore it from a backup.
Recovery Tools: WinRE and Advanced Boot Options
Windows Recovery Environment (WinRE) is a troubleshooting platform accessible via:
F11 during boot (on some OEMs)
Shift + Restart from Windows
Boot from Windows installation media and select 'Repair your computer'
WinRE provides:
Startup Repair: Automated diagnostic and repair tool that checks for common boot issues (corrupted BCD, missing boot files, driver problems). It analyzes boot logs and can fix many problems without user intervention.
System Restore: Reverts system files and registry to a previous restore point, but does not affect user data.
System Image Recovery: Restores from a full system backup.
Command Prompt: Access to advanced tools like bootrec, bcdedit, diskpart, sfc, dism.
Safe Mode: Boots with minimal drivers and services. Accessible via F8 on legacy BIOS (if enabled) or via WinRE > Troubleshoot > Advanced Options > Startup Settings.
Common Boot Errors and Their Causes
| Error Code/Message | Likely Cause | Repair Action | |-------------------|--------------|---------------| | 'Bootmgr is missing' | Corrupted boot sector or inactive system partition | bootrec /fixmbr, bootrec /fixboot, bootrec /rebuildbcd | | '0xc000000f' (BCD missing) | Corrupted BCD store | bootrec /rebuildbcd | | '0xc0000428' | Driver signature enforcement failure | Disable driver signature enforcement in Startup Settings, or update driver | | '0xc0000001' | Missing boot-critical driver | Safe Mode to identify driver, then disable or replace | | '0xc0000225' | Missing system file (e.g., winload.exe) | Boot from installation media and run sfc /scannow or dism /restorehealth | | 'Inaccessible Boot Device' | Corrupted disk driver or storage controller | Use Safe Mode to roll back driver, or use Last Known Good Configuration | | 'Kernel not found' | Corrupted or missing ntoskrnl.exe | Boot from installation media and copy file from Windows side-by-side store |
Command-Line Tools for Boot Repair
bootrec.exe: Used to repair MBR, boot sector, and BCD.
bootrec /fixmbr: Writes a new MBR to the system partition (BIOS systems only). Does not affect partition table.
bootrec /fixboot: Writes a new boot sector to the system partition (BIOS) or repairs the boot manager (UEFI).
bootrec /scanos: Scans all disks for Windows installations and displays them.
bootrec /rebuildbcd: Scans for Windows installations and prompts to add them to the BCD.
bcdedit.exe: Edits the BCD store directly.
bcdedit /enum: Lists all boot entries.
bcdedit /default {identifier}: Sets the default OS.
bcdedit /delete {identifier}: Removes a boot entry.
bcdedit /set {identifier} safeboot minimal: Enables Safe Mode from command line.
sfc /scannow: Scans and repairs protected system files.
DISM /Online /Cleanup-Image /RestoreHealth: Repairs Windows image corruption.
Boot Sequence in UEFI vs Legacy BIOS
UEFI: Uses GPT partitioning, stores boot manager in EFI System Partition (ESP), formatted as FAT32. Boot process: UEFI firmware -> bootmgfw.efi -> BCD -> winload.efi.
Legacy BIOS: Uses MBR partitioning, boot manager in active partition's boot sector. Boot process: BIOS -> bootmgr -> BCD -> winload.exe.
The exam tests that UEFI systems require a GPT disk and that the ESP must be present. A common trap is trying to use MBR on a UEFI system.
Safe Mode and Last Known Good Configuration
Safe Mode: Loads only essential drivers and services. Used to remove problematic drivers or malware. Access via F8 (if enabled) or WinRE > Startup Settings. Variants: Safe Mode, Safe Mode with Networking, Safe Mode with Command Prompt.
Last Known Good Configuration (LKGC): Uses the registry configuration from the last successful logon. Effective for driver or service issues that prevent logon. Not available if the system has been booted successfully since the problem began.
The exam tests that LKGC does not help with file corruption or malware; it only reverts registry changes.
Boot Logging and Event Viewer
Boot logging: Enabled via msconfig or bcdedit /set {identifier} bootlog Yes. Creates %SystemRoot%\Ntbtlog.txt listing loaded and failed drivers.
Event Viewer: Under Windows Logs > System, filter by source 'Boot' or 'Winlogon' to see boot-related errors.
The exam expects you to use boot logging to identify a failing driver.
Summary of Exam-Critical Points
The boot process order: POST -> Boot Manager -> Boot Loader -> Kernel -> SMSS -> Winlogon.
Common error codes and their phases.
Recovery tools: WinRE, Startup Repair, bootrec, bcdedit, sfc, DISM.
Differences between UEFI and BIOS boot processes.
Safe Mode and LKGC use cases.
When to use each tool based on error.
1. Identify the Boot Failure Symptom
Observe the exact error message, stop code, or behavior (e.g., blank screen, continuous reboot, 'Bootmgr is missing', or a BSOD with code 0xc000000f). Note whether the error appears before or after the Windows logo. This tells you which boot phase failed. For example, 'Bootmgr is missing' indicates the Boot Manager phase. '0xc0000001' after the logo indicates a driver issue in kernel loading. Document the exact code—many exam questions hinge on the specific error.
2. Boot into Windows Recovery Environment
Access WinRE by booting from Windows installation media and selecting 'Repair your computer', or by pressing F11 during startup (if available). On a working system, you can also use Shift + Restart to boot into WinRE. WinRE provides access to Startup Repair, System Restore, Command Prompt, and other tools. If you cannot access WinRE, the firmware or disk may be failing—check hardware first.
3. Run Startup Repair
Select Troubleshoot > Advanced Options > Startup Repair. Windows will scan for common boot issues such as corrupted BCD, missing boot files, or driver problems. It automatically attempts to fix them and may log the results. If Startup Repair succeeds, the system should boot. If it fails, note the error details—they guide the next steps. Startup Repair is the first-line tool because it is non-destructive and automated.
4. Use Bootrec Commands for BCD/MBR Issues
If Startup Repair fails or you see BCD-related errors, open Command Prompt from WinRE and run bootrec commands. For BIOS systems, run `bootrec /fixmbr` then `bootrec /fixboot` to repair the MBR and boot sector. Then run `bootrec /rebuildbcd` to scan for Windows installations and rebuild the BCD. For UEFI systems, you may need to use `bootrec /fixboot` only (which repairs the boot manager) and `bootrec /rebuildbcd`. Confirm the repaired BCD with `bcdedit /enum`.
5. Repair System Files with SFC and DISM
If bootrec does not resolve the issue, system file corruption may be the cause. Run `sfc /scannow` from the Command Prompt. If SFC finds corruption but cannot fix it, run `DISM /Online /Cleanup-Image /RestoreHealth` (requires internet or a Windows image source). Note: In WinRE, the OS drive may be D: or another letter; use `sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows` to target the offline installation. Corrupted ntoskrnl.exe or winload.exe can cause '0xc0000225' errors.
6. Boot into Safe Mode for Driver Issues
If the error occurs after the Windows logo (kernel phase), a faulty driver is likely. Boot into Safe Mode via WinRE > Troubleshoot > Advanced Options > Startup Settings > Restart > press 4 for Safe Mode. In Safe Mode, use Device Manager to roll back, disable, or update problematic drivers. Alternatively, use Driver Verifier Manager to identify the culprit. If Safe Mode fails, try Last Known Good Configuration from the same menu.
7. Perform System Restore or Reset
If all else fails, use System Restore from WinRE to revert system files and registry to a previous state (choose a restore point before the issue began). If no restore point exists, consider using 'Reset this PC' (keep files or remove everything) from WinRE. Note: Reset requires Windows installation media if the recovery partition is missing. This is a last resort because it may remove installed applications.
In enterprise environments, boot failures are common after Windows updates or driver deployments. For example, a company rolls out a new video driver via SCCM, and the next day, 20% of workstations fail to boot with a BSOD 'VIDEO_TDR_FAILURE'. The helpdesk must remotely diagnose and fix these systems. Using WinRE via PXE boot (Windows Deployment Services), technicians can run 'DISM /Remove-Package' to uninstall the problematic update, or boot into Safe Mode and roll back the driver. Without WinRE, they would need to physically visit each machine.
Another scenario: a server in a data center fails to boot after a power outage, displaying '0xc0000225'. The administrator boots from a USB Windows installation media, runs 'bootrec /rebuildbcd', and discovers the BCD is empty. After rebuilding, the server comes online. The root cause was a corrupted BCD due to improper shutdown. In production, administrators often create a bootable USB with WinRE and scripts to automate repairs.
A third scenario: a laptop with BitLocker encryption fails to boot and shows the BitLocker recovery screen. The user has forgotten the recovery key. The IT admin uses a domain-joined account to retrieve the key from Active Directory, enters it, and the system boots. This highlights the importance of managing BitLocker keys in enterprise environments.
Performance considerations: Startup Repair can take 5-15 minutes. In large-scale deployments, using DISM with a local source (e.g., a network share with Windows image) speeds up repairs. Common misconfigurations include forgetting to enable boot logging before a problem occurs, or not having restore points enabled via Group Policy. The exam tests that you know to check for BitLocker recovery before assuming a boot failure.
The 220-1102 exam tests troubleshooting Windows boot failures under Objective 3.1. Key areas:
Identify the phase from the error: 'Bootmgr missing' = Boot Manager phase; '0xc0000001' = kernel/driver phase.
Know the tools: Startup Repair, bootrec, bcdedit, sfc, DISM, Safe Mode, LKGC, System Restore.
UEFI vs BIOS: UEFI uses GPT, ESP, bootmgfw.efi; BIOS uses MBR, bootmgr. 'bootrec /fixmbr' works only on BIOS.
BitLocker: A locked drive after boot may require recovery key; this is not a boot file issue.
Stop codes: 0xc0000428 = driver signature; 0xc000000f = BCD; 0xc0000225 = missing file.
Common wrong answers: 1. 'Use System Restore' for a missing bootmgr file. Wrong: System Restore does not fix missing boot files; use bootrec. 2. 'Run sfc /scannow' for a BCD error. Wrong: sfc scans system files, not BCD; use bootrec /rebuildbcd. 3. 'Select Last Known Good Configuration' for a corrupted user profile. Wrong: LKGC only reverts registry changes, not profile corruption. 4. 'Disable driver signature enforcement' for a BSOD with code 0xc0000001. Wrong: 0xc0000001 is missing driver, not signature; 0xc0000428 is signature.
Numbers and values:
BCD store location: \Boot\BCD (active partition).
bootrec commands: /fixmbr, /fixboot, /scanos, /rebuildbcd.
Safe Mode access: F8 (if enabled) or WinRE > Startup Settings.
DISM: /Online /Cleanup-Image /RestoreHealth.
Edge cases:
Dual-boot systems: bootrec may not detect both OSes; manual bcdedit may be needed.
UEFI + GPT: The ESP must be FAT32 and at least 100 MB.
Virtual machines: Boot failures may be due to missing integration services (VMware Tools, Hyper-V Integration Services).
The exam loves to ask: 'A user reports that their computer displays "Bootmgr is missing" after a power outage. What is the first step?' The correct answer is to boot from Windows installation media and run Startup Repair. A trap answer is 'Replace the hard drive'.
Boot process order: POST -> Boot Manager -> Boot Loader -> Kernel -> SMSS -> Winlogon.
Error 'Bootmgr is missing' points to boot manager phase; use bootrec /fixmbr and /fixboot (BIOS).
Error 0xc000000f indicates corrupted BCD; use bootrec /rebuildbcd.
Error 0xc0000428 is driver signature enforcement failure; disable in Startup Settings or update driver.
Safe Mode loads minimal drivers; use for driver-related BSODs.
Last Known Good Configuration reverts registry; does not fix file corruption.
Startup Repair is first-line tool; if it fails, use bootrec, sfc, DISM.
UEFI systems require GPT and ESP; bootrec /fixmbr does not work on UEFI.
BitLocker recovery key may be needed if drive is locked; not a boot file issue.
Always check hardware (disk connections, firmware settings) before assuming OS corruption.
These come up on the exam all the time. Here's how to tell them apart.
UEFI Boot
Uses GPT partitioning
Boot manager file: bootmgfw.efi
Stored in EFI System Partition (FAT32)
Requires 64-bit OS
Supports Secure Boot
Legacy BIOS Boot
Uses MBR partitioning
Boot manager file: bootmgr
Stored in active partition's boot sector
Supports 32-bit and 64-bit OS
No Secure Boot
Mistake
Startup Repair always fixes boot issues.
Correct
Startup Repair is automated but cannot fix all problems, especially hardware failures, corrupted user profiles, or missing system files that require manual replacement. It is effective for BCD corruption and boot sector issues.
Mistake
Last Known Good Configuration can fix any boot problem.
Correct
LKGC only reverts the registry hive from the last successful logon. It does not fix missing or corrupted files, malware, or hardware issues. It is only useful for driver or service misconfigurations that prevent logon.
Mistake
Safe Mode loads all drivers but in a limited way.
Correct
Safe Mode loads only essential drivers (keyboard, mouse, display, mass storage). It does not load network drivers unless you choose 'Safe Mode with Networking'. This design isolates faulty third-party drivers.
Mistake
bcdedit /rebuildbcd will always fix a missing BCD.
Correct
If the BCD store is completely missing or the partition is corrupted, /rebuildbcd may fail. You may need to use `bcdedit /create` manually or recreate the BCD from scratch using `bcdedit /createstore`.
Mistake
A '0xc000000f' error always means the BCD is corrupted.
Correct
While often BCD corruption, it can also indicate a missing or inaccessible boot device, such as a disconnected hard drive or a failed disk controller. Always check hardware connections first.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
bootrec /fixmbr writes a new master boot record to the system partition, repairing the MBR code that points to the active partition. It does not affect the partition table. bootrec /fixboot writes a new boot sector to the system partition, which contains the code to load bootmgr. On UEFI systems, /fixboot repairs the EFI boot manager. Use /fixmbr for MBR corruption (e.g., 'Invalid partition table'), and /fixboot for boot sector corruption (e.g., 'Bootmgr is missing').
No. System Restore reverts system files and registry to a previous point, but it does not repair the boot sector or master boot record. For 'Bootmgr is missing', you need to use bootrec commands or Startup Repair. System Restore is useful for issues caused by driver updates or registry changes that prevent logon, not for boot loader problems.
If Windows fails to boot, access WinRE by booting from Windows installation media and selecting 'Repair your computer'. Then go to Troubleshoot > Advanced Options > Startup Settings > Restart. After restart, press 4 for Safe Mode, 5 for Safe Mode with Networking, or 6 for Safe Mode with Command Prompt. Alternatively, on some systems, pressing F8 during boot may work if the boot configuration data allows it.
Error 0xc0000225 indicates that a required file is missing or corrupted. This is often ntoskrnl.exe, winload.exe, or a boot-critical driver. It can also occur if the BCD entry points to a nonexistent path. To fix, boot from installation media and run sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows (adjust drive letter). If that fails, use DISM /Image:D:\ /Cleanup-Image /RestoreHealth. You may also need to replace the missing file from another system.
This error occurs when the Windows boot loader cannot access the boot volume, usually because the storage driver (e.g., SATA or NVMe driver) is missing or incompatible. Boot into Safe Mode, which uses a generic driver, and roll back the driver in Device Manager. If Safe Mode fails, use Last Known Good Configuration. In severe cases, you may need to use WinRE to restore the original driver.
The EFI System Partition (ESP) is a small (100 MB or larger) FAT32 partition on a GPT disk that stores the UEFI boot loaders (e.g., bootmgfw.efi) and boot configuration data. Without it, a UEFI system cannot boot Windows. If the ESP is corrupted or missing, you can recreate it using diskpart: select disk, create partition efi size=100, format quick fs=fat32, assign letter=S. Then use bcdboot to copy boot files.
If /rebuildbcd does not detect your Windows installation, you can manually recreate the BCD. First, use diskpart to find the Windows partition letter. Then run: bcdedit /createstore C:\boot\BCD (backup old BCD first). Then: bcdedit /store C:\boot\BCD /create {bootmgr} /d 'Windows Boot Manager'. Next: bcdedit /store C:\boot\BCD /set {bootmgr} device partition=C:. Finally, create an OS entry: bcdedit /store C:\boot\BCD /create /d 'Windows 10' /application osloader. Note the GUID and set the device, osdevice, path, and systemroot. This is complex; prefer using bootrec or bcdboot.
You've just covered Troubleshoot: Windows Boot Failures — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?