Windows that will not boot, and the recovery tools in the order they help

Why this matters

A machine that will not start is the highest-pressure fault in this domain: the user cannot work, cannot help you, and cannot see what you are doing. It is also the fault where guessing is most expensive, because several of the available tools destroy data.

The good news is that this is one of the most diagnosable faults there is. The boot process happens in stages, each stage looks different when it fails, and what appears on the screen tells you which stage you are in. Get that right and the tool chooses itself; get it wrong and you are running startup repair on a machine whose problem is a firmware setting.

The lesson

Telling firmware, bootloader, driver and desktop failures apart by what you see

Four stages, four appearances. Identifying the stage is the whole diagnosis.

Firmware. Nothing recognisable happens: no manufacturer logo, or a logo then nothing, or a message about no bootable device. The operating system has not been reached at all. Causes: boot order, a disk the firmware cannot see, firmware mode changed, secure boot, or genuinely failed hardware. Check the firmware settings before anything else, and check whether the disk is listed there.

Bootloader. The firmware handed over and the loader failed: an error naming the boot configuration data, a missing operating system, or an inaccessible boot device. The operating system files are usually intact. This is the recovery environment's territory and the repair is rebuilding boot configuration.

Kernel and drivers. Windows starts loading and fails: a stop error with a code, a restart loop, or a spinner that never finishes. Usually a driver, an update, or file system damage. Safe mode is the tool, because it loads a minimal driver set.

Desktop. You sign in and get a black screen, an empty desktop, or an immediate sign-out. The operating system is running; the shell or the profile is not. Causes: a corrupted profile, a failed shell, or something set to run at logon. A second account is the fastest test in this whole lesson.

The question that separates the last two: can you get to a sign-in screen? If yes, the kernel and drivers are fine and the problem is above them.

Safe mode and the diagnostic startup, and what each one excludes

Safe mode starts Windows with the minimum needed to run, and its value is that it excludes things.

• Safe mode — basic drivers, no third-party services or startup items, no network.
• Safe mode with networking — the same plus network drivers, for when you need to download something or reach a share.
• Safe mode with command prompt — no desktop shell, for when the shell itself is the problem.

What it proves: if the machine works in safe mode, the fault is in something safe mode excluded — a third-party driver, a service, or a startup item. That is an enormous narrowing from one restart.

Clean boot is the more precise version for a machine that does start: disable all non-Microsoft services and all startup items, restart, confirm the fault is gone, then re-enable in halves until it returns. Half a dozen restarts identifies one item exactly, and it is the right tool when safe mode says "third-party something" and you need to know which.

Two practical notes. Reaching safe mode on a modern machine is not a key press at boot: hold shift while choosing restart, or interrupt the boot three times to force the recovery environment, and select it from there. And safe mode is where malware removal happens for the reasons the security domain gave — fewer things running means fewer things interfering.

The recovery environment: startup repair, restore points, and the command prompt

The recovery environment is a separate small Windows that lives in its own partition, and it is where most of this lesson's repairs happen.

Getting there: shift-restart, three interrupted boots, or boot from installation media and choose repair. The third is the one to remember, because it works when the recovery partition is damaged.

What it offers, and when each is right:

• Startup Repair. Automated, tries the common bootloader and configuration problems. Cheap to run, frequently works, and worth trying first for a bootloader-stage fault. When it reports failure, the log it names occasionally identifies the cause.
• System Restore. Rolls system files, drivers and registry back to a restore point. The right answer when the fault started after an update, a driver or an installation. It does not touch user documents. It is also unavailable if protection was off — which is why turning it back on after a malware removal matters.
• Uninstall Updates. Removes the most recent quality or feature update specifically, which is more surgical than a restore point.
• Command Prompt. The one that matters most. From here you can run disk repairs, rebuild boot configuration, inspect and copy files, and disable a driver. It is also how you get the user's data off a machine you are about to rebuild.
• Reset this PC. The last resort, covered below.

The order to work in: restore point if one exists and the fault has a start date; startup repair for a boot-stage fault; command prompt for everything else.

Rebuilding boot configuration, and repairing a disk that will not mount

Two repairs cover most of what startup repair cannot do automatically, and both run from the recovery command prompt.

Rebuilding boot configuration. The sequence is bootrec /fixmbr, bootrec /fixboot, bootrec /scanos, bootrec /rebuildbcd. On a UEFI machine the EFI system partition may need mounting and the boot files recreating with bcdboot, pointing at the Windows folder. The symptom that calls for this is an error naming the boot configuration data, or a machine that reports no operating system while the disk is clearly present and readable.

Repairing a disk that will not mount. chkdsk /f on the volume, from the recovery prompt where nothing is using it. If the volume shows as RAW, stop: formatting is offered and it destroys everything. A volume that was NTFS and is now RAW has file system damage, and the right order is to image the disk first and attempt repair on the copy.

Two cautions that matter more than the commands:

• Confirm which disk and which volume. Drive letters in the recovery environment are not the letters the installed system uses. diskpart with list volume takes thirty seconds and prevents the worst mistake available here.
• Get the data off first whenever the disk is suspect. A failing disk can survive one read of the user's documents and not survive a full chkdsk /r. Copy first, repair second.

Reset and reinstall as the last option, and what to rescue first

Reset and reinstall come last, and what you rescue first is the part that matters.

Before anything destructive:

• Copy the user's data from the recovery command prompt, or by attaching the disk to another machine. The obvious folders, plus browser profiles, mail stores, application data and the desktop.
• Retrieve the BitLocker recovery key if the volume is encrypted. Without it, none of the above is possible at all — which is the encryption lesson's point arriving at the worst possible moment.
• Note the licence position for installed software.
• Note the machine's configuration: printers, drives, VPN, certificates.

Then choose:

• Reset keeping files — reinstalls Windows, keeps documents, removes applications. Useful for a corrupted installation on a machine whose data is intact and whose applications are easy to reinstall.
• Reset removing everything — a clean machine. The correct choice after a confirmed compromise, and before a machine changes hands.
• Clean install from media — the most predictable, and the only option when the recovery image itself is damaged.

Two last points. A repair install — setup from media, keep files and applications — sits between all of this and a reset, and it resolves a surprising share of these faults without losing anything; it needs a machine that still boots, which is why it belongs to the earlier lesson rather than this one. And restoring a backup is faster than any of them when a backup exists, which is the argument the last domain of this course makes at length.