Core 2 · Chapter 7
Troubleshooting OS and Security
Methodology, Safe Mode, BSOD, CLI tools, malware steps, Task Manager, mobile issues.
Methodology and Safe Mode
- 1 Identify → 2 theory → 3 test theory → 4 plan/implement → 5 verify and document.
- Ask questions before changing things.
- Safe Mode (minimal): drivers only. With networking: drivers + network. With Command Prompt: minimal + cmd.
- Win10/11: Shift+Restart → Troubleshoot → Advanced → Startup Settings → F4/F5/F6.
Boot recovery hierarchy and BSOD
- Order: Startup Repair → System Restore → bootrec → SFC → Reset this PC → reimage.
- Note the stop code. Safe Mode → roll back driver → uninstall recent software → restore → memory diagnostic.
- DRIVER_IRQL_NOT_LESS_OR_EQUAL → bad driver. PAGE_FAULT → RAM. SYSTEM_SERVICE_EXCEPTION → service crash.
CLI tools and network flowOften missed
| Tool | Use |
|---|---|
| ipconfig /all | IP, DHCP server, DNS |
| ipconfig /release && /renew | New DHCP lease |
| ping | Connectivity |
| nslookup | DNS query |
| tracert | Path only |
| pathping | Path plus packet loss |
| netstat | Connections and ports |
| arp -a | MAC/IP cache |
| chkdsk /F | Fix disk errors |
| sfc /scannow | Repair system files |
| DISM ... RestoreHealth | Repair Windows image |
| tasklist / taskkill | List or end processes |
ipconfig /all 169.254.x.x → DHCP failed → release/renew ping 8.8.8.8 works, sites fail → DNS (nslookup) ping 8.8.8.8 fails → network/firewall/ISP
Malware, AV, SFC vs regedit, activationOften missed
Malware order: identify/verify first, then quarantine, remediate, educate. Do not skip identify.
- Antivirus definitions: daily, not weekly. New malware is constant.
- SFC repairs system files. regedit edits the registry. Do not use regedit to “fix” SFC-class corruption.
- Unactivated Windows: personalization (wallpaper) limited. Apps, updates, and browsing still work.
Task Manager, performance, mobile
- Tabs: Processes, Performance, App History, Startup, Services, Details.
- High CPU/RAM: identify in Processes, end or uninstall. 100% disk: check indexing, search, failing HDD, or missing TRIM on SSD. Network spike: identify the process.
- Battery drain: limit background apps. Overheating can throttle or shut down. WWAN is cellular; Wi-Fi is local wireless. Auto-connect to open Wi-Fi is a risk.