1. Troubleshooting Startup Issues
Module 2
Presentation: 75 minutes
Lab: 90 minutes
After completing this module, students will be able to:
Describe the Windows 10 startup architecture.
Optimize and troubleshoot startup settings.
Troubleshoot Windows 10 operating system services.
Recover drives encrypted with Windows BitLocker Drive Encryption.
Required materials
To teach this module, you need the Microsoft Office PowerPoint file 10982B_02.pptx.
Preparation tasks
To prepare for this module, you should:
Read all of the module’s materials.
Practice performing the demonstrations and labs.
Work through the Module Review and Takeaways section to determine how you will use the information to reinforce student learning and promote knowledge transfer to on-the-job performance.
As you prepare for this class, it is imperative that you complete the labs yourself. This gives you an understanding of how the labs work and the concepts that each covers, so that you can provide meaningful hints to students who might have issues. Furthermore, it will help guide your lecture to ensure that you discuss the concepts that the labs cover.
Troubleshooting Startup Issues

2. Recovering BitLocker-Protected Drives
Module Overview
2: Troubleshooting Startup Issues
Recovering BitLocker-Protected Drives
Provide an overview of the module.

3. Lesson 1: Overview of the Windows 10 Startup Recovery Environment
10982B
Lesson 1: Overview of the Windows 10 Startup Recovery Environment
2: Troubleshooting Startup Issues
Overview of System Restore
Provide an overview of the lesson.
Question
During the Windows 10 startup process, which file reads the boot configuration data from the system volume?
( ) Option 1: Winload.exe
( ) Option 2: NTLDR
( ) Option 3: Winresume.exe
(√) Option 4: BOOTMGR
( ) Option 5: Boot.ini

4. Windows 10 Startup Architecture
10982B
Windows 10 Startup Architecture
2: Troubleshooting Startup Issues
Native UEFI or BIOS
Windows 10 OS Loader
Windows core, Kernel, Antimalware
Go through the numbered steps in the handbook while referencing the slide. Consider using a virtual machine to demonstrate. You can use the Microsoft Hyper-V pause feature during the computer’s startup sequence, so that you have time to discuss each phase as it occurs.
Consider opening the registry and showing students various devices that relate to the early and later startup phases (note that you will be discussing the registry in a later module, so make this a high-level overview).
For example, in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services, open ATAPI (a start 0 driver), and then explain that it is part of group SCSI miniport. Then locate CDROM, and show the students that it has a start value of 1. These load after the kernel has initialized. Show the students CDFS, and indicate it is dependent on group SCSI CDROM Class, of which CDROM is a driver member.
Next, switch to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control, and locate Session Manager. Show the students the Bootexecute value, and then discuss it. Locate the Memory Management folder, and then discuss the values with the students. Finally, locate the SubSystems folder, and point out the Windows value. It is at this point that the screen switches to a GUI.
Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon. Explain what these values do during startup.
Third-party drivers
Windows logon

5. Windows Startup and Recovery Options
10982B
Windows Startup and Recovery Options
2: Troubleshooting Startup Issues
Windows 10 provides a number of startup recovery tools:
Windows RE
Automatic failover to startup recovery
Advanced startup settings
Emphasize that students should be selecting the least invasive tool to perform a given task. Clearly, performing a complete computer reset is excessive when rolling back a driver would do the job. Try to provide guidance on which tool to use during this topic and subsequent topics. Consider mentioning to students that the option for recovery by using the last known good configuration no longer exists in Windows 10.
Note: Some computers do not include a setup disk, and therefore the process of accessing the Windows Recovery Environment (Windows RE) might vary from the steps provided in this topic.

6. Recovery Tools Available in Windows RE
2: Troubleshooting Startup Issues
Consider performing a demonstration of launching these tools as you discuss them. Use the steps from the practice session that follows for guidance.
Windows RE provides access to six recovery tools:
Reset this PC
System Restore
System Image Recovery
Startup Repair
Command Prompt
Go back to previous build
Use Startup Repair first, then try System Restore before attempting any of the more invasive recovery tools listed

7. Overview of System Restore
10982B
Overview of System Restore
2: Troubleshooting Startup Issues
System Restore takes snapshots of your computer system, and then saves them as restore points
You can use System Restore to:
Perform driver rollback
Protect against accidental program deletion
Roll back the computer’s entire configuration
Give a brief, high-level overview of System Restore. Students will use System Restore to perform a recovery in the next topic.

8. Lesson 2: Troubleshooting Startup Settings
2: Troubleshooting Startup Issues
Advanced Startup Options in Windows 10
Provide an overview of the lesson.
Question
Changes made to the startup environment of a Windows 10 computer by using System Configuration are always persistent.
(√) False
( ) True

9. Windows 10 startup options
10982B
Windows 10 BCD Store
2: Troubleshooting Startup Issues
The BCD store is an extensible database of objects and elements that can include information about:
The hibernation image
Windows 10 startup options
Alternate startup options for Windows operating systems
The BCD store is stored as a registry hive
For BIOS-based systems, the BCD registry file is located in the active partition\Boot directory
Describe the Boot Configuration Data (BCD) store, and ensure that students who have some knowledge about earlier Windows operating systems can compare this to Boot.ini. The upcoming lab requires that students are familiar with the BCD store, so make sure they understand this topic and the next one.

10. Configuring the BCD Configuration Settings
2: Troubleshooting Startup Issues
Use the BCDEdit command-line tool to make changes to the BCD store, such as removing entries from the list of displayed Windows operating systems
You can use other tools to modify the BCD:
Startup and recovery
Msconfig.exe
BootRec.exe
In the following practice session, your students will modify BCD settings.
You can use the steps provided in this demonstration to walk through the process of configuring the BCD.
Provide examples of when you have needed to edit the BCD, such as when you are adding a new hard disk, configuring multiboot computer environments, or enabling the boot store on newly deployed computers.
This practice session does not use the MSConfig tool, so consider showing it to the students as you discuss that bulleted item.

11. Configuring Environments with the System Configuration Tool
10982B
Configuring Environments with the System Configuration Tool
2: Troubleshooting Startup Issues
Note: This topic has three additional slides.
Consider demonstrating the System Configuration tool.

12. Configuring Environments with the System Configuration Tool 2 of 4
10982B
Configuring Environments with the System Configuration Tool 2 of 4
2: Troubleshooting Startup Issues

13. Configuring Environments with the System Configuration Tool 3 of 4
10982B
Configuring Environments with the System Configuration Tool 3 of 4
2: Troubleshooting Startup Issues

14. Configuring Environments with the System Configuration Tool 4 of 4
10982B
Configuring Environments with the System Configuration Tool 4 of 4
2: Troubleshooting Startup Issues

15. Advanced Startup Options in Windows 10
10982B
Advanced Startup Options in Windows 10
2: Troubleshooting Startup Issues
Windows 10 provides the following advanced startup options:
Enable boot logging
Enable debugging
Enable low-resolution video
Enable Safe Mode
Enable Safe Mode with networking
Enable Safe Mode with command prompt
Disable driver signature enforcement
Disable early-launch anti-malware protection
Disable automatic restart on system failure
Consider demonstrating these options as you discuss them with your students.

16. Lab A: Troubleshooting Startup Issues
Exercise 2: Resolving a Startup Issue (2)
Be prepared to discuss other possible solutions in addition to the solution that the students use. For example, discuss why a particular solution worked while others did not. Once they realize what the problem is, ask students if any other solutions might have worked.
Exercise 1: Resolving a Startup Issue (1)
Adam tried to install an additional operating system on his computer to run a specific line-of-business application. He did not get far in the installation process before abandoning the attempt. Since then, Adam receives an error message on startup that begins with, “Your PC/Device needs to be repaired. The Boot Configuration Data file is missing some required information.”
Logon Information
Virtual machines: B-LON-DC1
10982B-LON-CL1
User name: Adatum\Administrator
Password: Pa$$w0rd
Estimated Time: 45 minutes
(More notes on the next slide)

17. 2: Troubleshooting Startup Issues
Incident Record
Incident Reference Number:
Date of Call
Time of Call
User
Status
August 30
13:30
Chris Sells (Research Department)
OPEN
Incident Details
Chris contacted the help desk after attempting to install a new hard disk driver.
Following the attempt, his computer does not start correctly.
Additional Information
Help desk staff recorded the following message:
: (
Your PC ran into a problem and needs to restart. You can restart.
If you’d like to know more, you can search online later for this error: INACCESSIBLE_BOOT_DEVICE
Plan of Action
Resolution
(More notes on the next slide)

18. 10982B
Lab Scenario
2: Troubleshooting Startup Issues
A number of users have reported problems starting up their computers, you must investigate these problems and attempt resolutions

19. 10982B
Lab Review
2: Troubleshooting Startup Issues
What was your approach to the second scenario? How did your approach differ from the class?
Question
What was your approach to the first scenario? How did your approach differ from the class?
What was your approach to the second scenario? How did your approach differ from the class?

20. Lesson 3: Troubleshooting Operating System Service Issues
2: Troubleshooting Startup Issues
Disabling Services
Provide an overview of the lesson.
Question
Which of the following command-line tools can you use to manage services from the Command Prompt recovery tool? Choose all that apply.
(√) Option 1: Net.exe
( ) Option 2: Msconfig.exe
(√) Option 3: Sc.exe
( ) Option 4: Services.msc
(√) Option 5: Regedit.exe

21. Operating System Services
10982B
Operating System Services
2: Troubleshooting Startup Issues
Operating system services:
Load and run in the background without user intervention
Support application requests, for example, when an application needs to open a file, it relies on a system service to retrieve that file from the disk
Can make calls to device drivers when a request is sent to a physical device
Remind students of the operating system architecture that you discussed in Module 1. If necessary, show them the architectural slide again.

22. Identifying Failed Services
10982B
Identifying Failed Services
2: Troubleshooting Startup Issues
Windows 10 provides a number of ways of locating service-related problems:
Event Viewer
Log files
Stop codes
Action Center
Consider demonstrating Event Viewer and Action Center. Students have seen or will see the other tools mentioned on the slide.

23. System Configuration tool
10982B
Disabling Services
2: Troubleshooting Startup Issues
Depending on the circumstances, you can disable a service in one of the following ways:
Safe mode
Command Prompt
System Configuration tool
If time allows, demonstrate one or two of these options with the students. Ensure that students are aware of each tool’s limitations. For example, if the computer cannot load at all, then accessing the Advanced Boot Options menu might be impossible.

24. Lesson 4: Recovering BitLocker-Protected Drives
2: Troubleshooting Startup Issues
BitLocker To Go
Provide an overview of the lesson.
Question
In order to use BitLocker, your computer must be equipped with a TPM of at least version 1.2.
(√) False
( ) True

25. Provides offline data protection
10982B
Overview of BitLocker
2: Troubleshooting Startup Issues
BitLocker encrypts the computer’s operating system and data that is stored on the operating system volume
Provides offline data protection
Protects all other applications installed on the encrypted volume
Includes system integrity verification
Verifies integrity of early boot components and boot configuration data
Ensures the integrity of the startup process
Mention to students that the improved BitLocker functionality in Windows 10 includes:
Ability to right-click a drive to enable BitLocker protection.
Automatic creation of the required hidden boot partition upon installation.
Data recovery agent support for all protected files.
Enhanced protection against data theft and exposure with BitLocker To Go, which extends BitLocker support to removable storage devices.

26. Enhancing protection to mitigate offline software- based attacks
BitLocker and TPMs
2: Troubleshooting Startup Issues
BitLocker uses the TPM to verify the integrity of the startup process by:
Providing a method to verify that early boot file integrity has been maintained
Enhancing protection to mitigate offline software- based attacks
Locking the system when it is tampered with
Begin this topic by explaining that a Trusted Platform Module (TPM) is a specialized chip that computer manufacturers can install on a personal computer’s motherboard for the purpose of hardware authentication. The TPM authenticates the computer rather than the user by storing information specific to the host system, such as encryption keys, digital certificates, and passwords.
When reviewing the first block of text on the slide, point out that TPM is not required. On computers that do not have TPM version 1.2, you can still use BitLocker to encrypt the Windows operating system volume. You can do this by inserting a USB startup key to start the computer or resume from hibernation. This process does not provide the prestartup system-integrity verification that BitLocker offers when it works with a TPM.
Finally, mention to students that using a TPM-only method enables BitLocker and the encryption tool only. However, if you use a TPM and user PIN (or USB), this adds the user authentication component to the startup process. TPM-only mode offers the least amount of protection. As such, you should use it only for computers in a physically secure location and for situations where unattended restart is required, such as when servers in remote locations use Wake On LAN.

27. Recovering a BitLocker-Encrypted Drive
2: Troubleshooting Startup Issues
When a BitLocker-enabled computer starts:
BitLocker checks the operating system for conditions indicating a security risk, if a condition is detected:
BitLocker enters recovery mode and keeps the system drive locked
The user must enter the correct recovery password to continue
The BitLocker recovery password is:
A 48-digit password used to unlock a system in recovery mode
Unique to a particular BitLocker encryption
Can be stored in AD DS
If stored in AD DS, search for it by using either the drive label or the computer’s password
Discuss the information on the slide. The slide describes what happens when a BitLocker-enabled computer starts up. In this case, the recovery password is linked to a particular TPM or computer, and not to individual users. Typically, a recovery password does not change.
Next, discuss how to locate a BitLocker recovery password. If the password is stored in Active Directory Domain Services (AD DS), you can locate it in the Active Directory Users and Computers module.
Note: Point out to students that after you have located a recovery password, you should make sure that it matches the Password ID that the user provides. Performing this check helps to verify that you have obtained the unique recovery password.

28. 10982B
BitLocker To Go
2: Troubleshooting Startup Issues
BitLocker To Go provides enhanced protection against data theft and exposure by extending BitLocker to removable storage devices
When securing a removable drive, you can choose to unlock the drive with either:
A password
A smart card
If you have a laptop with you, consider demonstrating the use of BitLocker To Go.

29. Lab B: Recovering BitLocker-Encrypted Drives
2: Troubleshooting Startup Issues
Exercise 2: Creating a New BitLocker Password
Students cannot complete this lab unless they have already completed the practice session from the previous lesson, and they must have left their virtual machines in the same state. If they have done this, then they should now have a BitLocker-encrypted drive on LON-CL1 with which to complete the lab.
Exercise 1: Recovering a BitLocker-Encrypted Drive
Dan cannot start his computer. He has logged a call with the help desk. Your job is to resolve the incident. A work colleague has determined a plan of action. You must attempt a resolution based on this plan.
Logon Information
Virtual machines: B-LON-DC1
10982B-LON-CL1
User name: Adatum\Administrator
Password: Pa$$w0rd
Estimated Time: 45 minutes
(More notes on the next slide)

30. 2: Troubleshooting Startup Issues
Instructor Note: If your students become stuck while performing the lab, this time they cannot simply revert their virtual machines to resolve the issue as they did before. This is because that action would result in them no longer having an encrypted drive. You must provide guidance where necessary.
Exercise 2: Creating a New BitLocker Password
To help Dan, you decide to generate a new BitLocker password.

31. 10982B
Lab Scenario
2: Troubleshooting Startup Issues
A user contacts the help desk explaining that he cannot start his computer. You identify the problem as relating to BitLocker. You must visit the user’s computer and attempt to recover the hard drive so that the user can start his computer. After recovery, you must provide new BitLocker keys and passwords.

32. 10982B
Lab Review
2: Troubleshooting Startup Issues
What was your approach to the first scenario? How did your approach differ from the class?
Question
What was your approach to the first scenario? How did your approach differ from the class?

33. Module Review and Takeaways
10982B
Module Review and Takeaways
2: Troubleshooting Startup Issues
Review Questions
Review Questions
Question
The startup environment of a user’s computer is corrupt, and you suspect a virus. Before you can run virus removal tools, first you must recover the startup environment. What command-line tools could you use?
Your user adds a new hard disk to the computer, which changes the computer’s partition numbering. To enable the computer to start, the user needs you to change the BCD. What tool would you use?
After installing a new video driver, your user’s computer becomes unstable and will not start correctly. What would you try first to resolve this problem?