How To Enable Boot Logging For Fixing Startup Problems in Windows
When facing a system crash or startup up problems on Windows Computers, troubleshooting the problem can be difficult to resolve. The first step with recovery is to use Windows Safe Mode option during startup. One Safe Mode option that will help troubleshoot boot problems is to enable Boot Logging which will create a log and help identify the device or driver that is causing the problem during startup.
When Boot Logging is enable, Windows boots normally, until the device or driver that is causing the problem either crashes the system or completes starting up but causes an error message in the Event Log. While booting, Windows creates a log file that lists every step processed that is attempted and completed.
You can then reboot in to Safe Mode and review the log file named ntbootlog.txt. The log is stored in the %SYSTEMROOT% directory (normally C:\Windows or C:\WINNT folder). Below is an example of ntbootlog.txt log file on Windows XP (Vista log is similar):
Service Pack 2 5 4 2007 10:45:44.500
Loaded driver \WINDOWS\system32\ntkrnlpa.exe
Loaded driver \WINDOWS\system32\hal.dll
Loaded driver \WINDOWS\system32\KDCOM.DLL
Loaded driver \WINDOWS\system32\BOOTVID.dll
Loaded driver ACPI.sys
Loaded driver \WINDOWS\System32\DRIVERS\WMILIB.SYS
Loaded driver pci.sys
Loaded driver isapnp.sys
Loaded driver compbatt.sys
Loaded driver \WINDOWS\System32\DRIVERS\BATTC.SYS
Loaded driver intelide.sys
Loaded driver \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
Loaded driver MountMgr.sys
Loaded driver ftdisk.sys
Loaded driver dmload.sys
Loaded driver dmio.sys
Loaded driver PartMgr.sys
Loaded driver VolSnap.sys
Loaded driver atapi.sys
Loaded driver vmscsi.sys
Loaded driver \WINDOWS\System32\DRIVERS\SCSIPORT.SYS
Loaded driver disk.sys
Loaded driver \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
Loaded driver fltmgr.sys
Loaded driver sr.sys
To enable Boot Logging on Windows XP and Vista, boot your Computer, and during startup continually press F8 until the menu screen appears:
NOTE: screen shot is from XP. Vista menu will look slightly different than XP.
Press F8 to display the Advanced Menu screen and select Enable Boot Logging
You will be returned to the menu screen and you should see Enable Boot Logging in blue displayed at the bottom of the screen (don't worry if this screen is not displayed and Windows starts to boot):
If the problem does not cause Windows to crash, and after startup has completed, you can review the ntbootlog.txt file. Look for any signs of problems loading device drivers. If you find problems, go into Device Manager and disable the device or uninstall the program, then reboot again. If the problem does not occur then you know it was that device and you should check the vendor website for new drivers or known issues.
If your problem does cause Windows to crash, reboot into Safe mode by selecting Safe Mode from the Advanced Menu screen. When reviewing ntbootlog.txt file, look for events that were attempted to load but not completed. More than likely the problem will be toward the end of the file (since that was the last item logged before crashing). When you identify the problem, either uninstall the application or go in to Device Manager and disable the device. Reboot your Computer and see if the problem still exist. If it boots without crashing, check the vendor website for new drivers or known issues.
If you are still having problems, enable Boot Logging again to see if new events are logged after you have disabled the device or uninstalled the program. If you are unable to fix the problem, you may need to have a Computer shop troubleshoot the problem for you.
Notes on Boot Logging:
- Boot Logging can only be enabled from Safe Mode. Once it is enabled, it only logs during the current boot. It will not log during the next reboot unless you enable it again from Safe Mode.
- If an existing ntbootlog.txt files exist, the next time Boot Logging is enabled, Windows will append to the existing log file.
- It is a good idea to have Windows create a new log when there are no problems or after you have added new devices. This will allow full logging to occur and will let you compare with a log when problems exists.
Filed under Windows Tips by Watching The Net
Comments on How To Enable Boot Logging For Fixing Startup Problems in Windows »
Think you for this I was struggling on my assignment I finally got an idea on what I was looking for.
@Joe
Glad to help out!
I'm running windows Vista Ultimate 64bit and i get a blue screen at start up now and then seem only to be when the pc has ben off for a while.
I've tried using boot logging but i cant find the file in windows can you please help me out
Cheers
Kenny
@kenny
I'm not sure why you can't find the file, other than it's not being created.
Another option you may want to try is to disable automatic reboot option when a blue screen of death occurs. This will allow you to see the stop error message.
- just right click on the Computer icon and choose Properties
- click on Advanced system settings (in left navigation pane)
- click on the Advanced tab
- click on Settings button next to "Startup and Recovery"
- then under the System failure section, uncheck the option for Automatically restart
- click OK all the away back to the desktop
Next time you get a blue screen, you can make note of the error and Google it for a solution…hopefully
Have you resolved this issue? I am having the same problem. The only time I get it is when I have had my notebook turned off for hours…It is a new HP…it has done this since day one…It is under warranty..but just thought if I could resolve the issue myself I wouldn't have to send it off for weeks
i have been having problem with my computer during startup after logging in the computer automatically log's out and return to ctrl+alt+del where by asking for my user name and password. I will be grateful if you can help me with this the system is in a domain controller
@suleiman rahman
You mentioned that the computer is a Domain Controller. Are you the Administrator of the domain and do you have rights to log on?
Okay, Well I recently formatted after a bar partition problem, And install went fine, I left my computer on while it was downloading WoW, Ect.. ect.. and after I got home from school, I decided to restart which I usually do.
Well, I realized how long it took for the BIOS (Asus M2n-e) to continue after their splash screen, It took about 5 minutes, Which this has never happened, Well I thought well maybe its just being stupid, So I thought nothing of it, Continuing on i waited some more, A black screen came on and there was just a blinking "_" without quotes for like another minute, After that the windows xp splash came up, Another minute added on. Okay finally it gets to my desktop and everything runs fast, smooth, and right.
Can someone help? This is the first time its happened.
MOBO: Asus M2n-E (not oc'd)
GFX: NVIDIA GEFORCE 7300 GS (manufactured oc'd)
HDD: WSC WD2500JB-00GVC0
PROCESSOR: AMD athlon 64(x2) dual core 6000+
my desktop is giving me problems when i reboot the computer cause the moment windows is start loading the blue screen of death appers nd suddenly make the computer to restart again.this blue screen of dearth appears in a fraction of a second and I'm afraid of loosing my important school information .
WHAT SHOULD I DO?
I am having problems with the XP flash screen starts with the 3 blue lights going accross but it then just won't advance from this stage.
I can get in to safe mode and have switched on boot enabling but still cant find
ntbootlog.txt anywhere.
What might be causing the sytem just to get here and no further?
TIA
@UKSBD
Many things can cause boot problems. To start have you:
- just installed software before the problem occurred - if so, boot into safe mode and uninstall the program from Add/Remove in the Control Panel
- installed new hardware before the problem occurred - again, if you did, boot into Safe Mode and disable the device in Device Manager
- updated drivers - sometimes updating drivers will cause problems. you can roll back drivers from Device Manager (boot into safe mode)
- recently ran Windows update, if you did, you can remove updates from Add/Remove Programs (you know the drill, boot into Safe Mode….)
While you are in Safe Mode, take a look at the Event Log for any errors (click on Start / Run and enter eventvwr.msc), also run a virus check with your anti virus software.
Other than that, it's possible may hardware that is becoming faulty and will require your local Computer Tech service to take a look at it.
Anyone resolve the issues using this log file? if so, please post ur comments.
BTB, the file name was ntbtlog.txt in my box. it may help other users who looking for a file with name ntbootlog.txt.
Ram.
The file name is actually NTBTLOG.TXT and is located in the %systemroot% (C:\Windows) folder.
very useful,thanks a lot mate