BSOD — Blue Screen of Death
The Blue Screen of Death (BSOD) is a stop error — Windows has encountered a critical problem it cannot recover from and has halted to prevent further damage or data corruption. In Windows 10 and 11 the screen turns blue and displays a sad face emoji with a stop code. In older Windows versions it displayed hexadecimal error codes.
The stop code is the most important piece of information. Windows also writes a memory dump file (minidump) to C:\Windows\Minidump\ that captures the system state at the moment of failure. Tools like WinDbg or WhoCrashed can analyse the dump file to identify which driver or component caused the crash.
| Stop Code | Common Cause | First Step |
|---|---|---|
| IRQL_NOT_LESS_OR_EQUAL | Faulty driver accessing invalid memory address | Check recently installed drivers; update or roll back |
| PAGE_FAULT_IN_NONPAGED_AREA | RAM failure or driver trying to access paged-out memory | Run Windows Memory Diagnostic; check drivers |
| SYSTEM_SERVICE_EXCEPTION | Corrupted system file or driver | Run sfc /scannow; check for Windows updates |
| CRITICAL_PROCESS_DIED | Critical Windows process terminated unexpectedly | Run sfc /scannow and DISM; check for malware |
| KERNEL_SECURITY_CHECK_FAILURE | Memory corruption — RAM, driver, or malware | Test RAM; check for malware; update drivers |
| NTFS_FILE_SYSTEM | Corrupt NTFS file system or failing storage drive | Run chkdsk /f /r; check S.M.A.R.T. data on drive |
| DPC_WATCHDOG_VIOLATION | Driver not responding in time; SSD/driver issue | Update SSD firmware and storage drivers |
| WHEA_UNCORRECTABLE_ERROR | Hardware failure — CPU, RAM, or overclocking instability | Check CPU/RAM temps; reset overclocking; test hardware |
The A+ exam doesn't require you to memorise every stop code, but you should know the general approach: (1) Note the stop code. (2) Check if it happens after a recent change (driver install, Windows update, new hardware). (3) Boot into Safe Mode — if it doesn't BSOD in Safe Mode, a third-party driver or startup program is the cause. (4) If hardware-related codes appear (memory, disk), test hardware. (5) Use sfc /scannow and DISM to repair corrupted system files.
Safe Mode
Safe Mode starts Windows with only the minimum required drivers and services: the basic display driver, keyboard, mouse, and essential Windows services. Third-party drivers, startup programs, and non-essential services are not loaded. This makes Safe Mode invaluable for troubleshooting because:
If a problem does not occur in Safe Mode → a third-party driver or startup program is the cause. Enable programs one by one (using msconfig) to identify the culprit. If the problem still occurs in Safe Mode → the cause is in the core Windows components, hardware, or system files — not third-party software.
Method 1 — From Settings: Settings → System → Recovery → Advanced startup → Restart now → Troubleshoot → Advanced options → Startup Settings → Restart → press 4 for Safe Mode or 5 for Safe Mode with Networking.
Method 2 — Shift+Restart: Hold Shift while clicking Restart from the Start menu or login screen. This boots into WinRE where you can access Startup Settings.
Method 3 — msconfig: Run msconfig → Boot tab → check "Safe boot" → restart. (Remember to uncheck this after troubleshooting.)
Method 4 — If Windows won't boot: Interrupt boot 3 times in a row (power off during Windows logo). Windows automatically enters Automatic Repair / WinRE.
Safe Mode with Networking loads the same minimal environment as Safe Mode but adds network drivers, allowing internet access. Use this when you need Safe Mode but also need to download drivers or run online malware scans. Safe Mode with Command Prompt opens a command prompt instead of the Windows desktop — for advanced repairs.
Windows Recovery Environment (WinRE)
WinRE is a special pre-OS recovery environment stored on a hidden recovery partition. It boots automatically when Windows fails to start twice, or when you access it manually. WinRE provides several repair tools:
sfc /scannow, chkdsk, bootrec, bcdedit. The most powerful repair option for advanced troubleshooting.Key Windows Repair Commands
| Command | What It Does | When to Use |
|---|---|---|
| sfc /scannow | System File Checker — scans all protected Windows system files and replaces corrupted ones from a cached copy | Suspected corrupted system files; after malware removal; frequent crashes |
| DISM /Online /Cleanup-Image /RestoreHealth | Repairs the Windows component store (which sfc uses as its source) — downloads clean files from Windows Update | Run before sfc if sfc reports it cannot fix errors; deep corruption |
| chkdsk C: /f /r | Checks and repairs file system errors (/f) and scans for bad sectors (/r) on the drive | Disk errors, slow performance, filesystem corruption, drive-related BSODs |
| bootrec /fixmbr | Repairs the Master Boot Record of the system disk | Windows won't boot; "Operating system not found" error |
| bootrec /fixboot | Writes a new boot sector to the system partition | Boot sector corruption; "Bootmgr is missing" error |
| bootrec /rebuildbcd | Scans all disks for Windows installations and rebuilds the BCD (Boot Configuration Data) store | Multiple Windows installations; BCD corruption |
| bcdedit | Views and edits the Boot Configuration Data store directly | Advanced boot configuration changes; fixing dual-boot issues |
| msconfig | System Configuration — manages startup programs, services, boot options including Safe Mode | Identifying startup programs causing issues; enabling Safe Mode; clean boot |
When repairing Windows system files, run them in this order: DISM first, then sfc. DISM repairs the component store that sfc uses as its repair source. If sfc runs first and the component store is corrupted, sfc will report errors it cannot fix. After DISM repairs the store, sfc can successfully replace corrupted files. Both commands should be run from an elevated (Administrator) command prompt.
System Restore
System Restore creates and manages restore points — snapshots of Windows system files, the registry, and installed programs at a specific point in time. Windows automatically creates restore points before significant system changes (Windows updates, driver installs, program installs). You can also create restore points manually.
Restoring to a restore point reverts Windows back to that state: registry settings, system files, and installed drivers/programs revert. Personal files (documents, photos, videos) are not affected. This is the critical A+ exam distinction — students confuse System Restore with a file backup. It is not a file backup; it only protects system configuration.
Access System Restore from: WinRE → Troubleshoot → Advanced options → System Restore, or from Windows: Control Panel → Recovery → Open System Restore, or by running rstrui.exe.
Windows Boot Process and Boot Failures
Understanding the Windows boot sequence helps diagnose where a failure occurs:
1. UEFI/BIOS POST → hardware check → finds bootable drive. 2. Windows Boot Manager (bootmgr) loads from the system partition. 3. Windows Boot Loader (winload.exe) loads the Windows kernel. 4. Windows kernel initialises, loads HAL, and starts Windows services. 5. Login screen appears.
Common boot failure messages and causes: "Bootmgr is missing" → Boot sector or MBR corrupt → run bootrec /fixmbr and bootrec /fixboot from WinRE Command Prompt. "Operating system not found" → BIOS can't find a bootable partition → check boot order in BIOS, check drive connection. "Inaccessible Boot Device" → Windows can't access the drive during startup → storage driver issue or corrupted BCD → run Startup Repair.
Event Viewer
Event Viewer (eventvwr.msc) is the primary Windows log viewer. It records detailed information about every significant system event — errors, warnings, and informational events from the OS, applications, and security subsystem. For A+ troubleshooting, the most important logs are:
Windows Logs → System: hardware errors, driver failures, service failures, unexpected shutdowns. Windows Logs → Application: application crashes and errors. Windows Logs → Security: login events, account changes, security policy changes. Event Viewer is your first stop when investigating a recurring problem — look for Error-level events that correspond to the time the problem occurred.
Exam Scenarios
Preparing for CompTIA A+ Core 2?
220-1202 is 30% Operating Systems — check the full A+ study guide.