Windows 11 fails in predictable ways: corrupted system files, broken Windows Update components, stale drivers, and overloaded startup. Each failure leaves a trace in the Event Log, in CBS.log, or in an error code. This guide maps the most common symptoms to the command that repairs them, in the order that minimizes risk and downtime.
Quick Takeaways
- Run the repair chain in order:
DISMfirst, thensfc /scannow, thenchkdsk. Running them out of order can leave corruption in place. - Update errors like
0x80070002and0x800f0922usually trace to a damaged SoftwareDistribution cache or a full System Reserved partition. - Blue screens are diagnosed from minidumps in C:\Windows\Minidump, not from the stop code alone.
- Back up first. Create a restore point or a system image before changing drivers, registry keys, or boot configuration.
Symptom-to-Fix Reference
| Symptom | Likely Cause | First Fix | Risk |
|---|---|---|---|
| Slow boot | Startup overload, Fast Startup corruption | Task Manager > Startup apps | Low |
0x80070002 on update |
Corrupt update cache | Reset Windows Update components | Low |
0xc000021a BSOD |
Damaged winlogon.exe or csrss.exe |
WinRE + sfc /offline |
Medium |
| Random freezes | Driver or disk fault | chkdsk /f, driver rollback |
Medium |
| No Wi-Fi after update | Network stack corruption | netsh winsock reset |
Low |
| Start menu unresponsive | Corrupt shell packages | Re-register AppX packages | Medium |
Prerequisites
Before you run any repair command:
- Sign in with an administrator account. Most commands below fail silently or with
Access is deniedotherwise. - Open an elevated terminal. Press
Win + Xand select Terminal (Admin). - Create a restore point. Run the following in elevated PowerShell:
Enable-ComputerRestore -Drive "C:\"
Checkpoint-Computer -Description "Pre-Troubleshooting" -RestorePointType "MODIFY_SETTINGS"
Enable-ComputerRestoreturns on System Protection for the drive.Checkpoint-Computercreates the snapshot.-RestorePointType "MODIFY_SETTINGS"labels it as a configuration change.
- Check your build. Run
winveror this command:
Get-ComputerInfo | Select-Object WindowsProductName, OsVersion, OsBuildNumber
This matters because fixes differ slightly between 23H2 and 24H2 builds.
Conceptual Overview: Why Windows 11 Breaks
Windows 11 runs on the NT kernel and depends on three layers that fail independently.
Component Store (WinSxS). Located at C:\Windows\WinSxS, it holds every system component version. DISM repairs it. sfc then restores live system files from it. If the store is damaged, sfc fails.
Servicing stack. TrustedInstaller (TrustedInstaller.exe) and the Windows Modules Installer service apply updates. When the SoftwareDistribution folder or the catroot2 cryptographic cache is damaged, updates loop or fail.
Boot chain. UEFI firmware loads the Windows Boot Manager (bootmgfw.efi) from the EFI System Partition. It then loads winload.efi, the kernel (ntoskrnl.exe), and drivers. A failure at any point produces a distinct stop code or recovery screen.
Understanding which layer fails narrows the fix to one section below.
Step-by-Step: The System File Repair Chain
Use this chain for crashes, missing features, odd app behavior, and unexplained errors.
Step 1: Repair the Component Store with DISM
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
/Onlinetargets the running OS./CheckHealthreads existing corruption flags and takes seconds./ScanHealthscans the store and takes several minutes./RestoreHealthdownloads clean files from Windows Update to replace damaged ones.
If RestoreHealth stalls at 62.3% or fails, point it at a local source:
DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:1 /LimitAccess
D:is a mounted Windows 11 ISO.:1is the image index (verify withDISM /Get-WimInfo /WimFile:D:\sources\install.wim)./LimitAccessblocks Windows Update as a source.
Step 2: Run System File Checker
sfc /scannow
sfc compares protected files against the component store and replaces mismatches. Read the result:
| Result Message | Meaning | Next Action |
|---|---|---|
| No integrity violations | Files are healthy | Look at drivers or apps |
| Found and repaired | Fixed | Reboot and retest |
| Found but unable to fix some | Store still damaged | Rerun DISM, then sfc again |
Review the details in C:\Windows\Logs\CBS\CBS.log. Extract only the sfc entries:
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > "%userprofile%\Desktop\sfclogs.txt"
Step 3: Check the Disk
chkdsk C: /f /r
/ffixes file system errors./rlocates bad sectors and recovers readable data.
Windows schedules this for the next reboot because the system volume is locked. Run Get-PhysicalDisk | Select FriendlyName, HealthStatus, OperationalStatus to check SMART-level health afterward.
Fixing Windows Update Failures
Update failures (0x80070002, 0x80073712, 0x800f0922, 0x8024402c) have three common causes: a corrupt cache, stopped services, or a full EFI partition.
Reset Windows Update Components
Run in an elevated Command Prompt:
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver
net stophalts the services holding locks on the cache folders.renrenames the folders instead of deleting them, so you can roll back.- Windows rebuilds both folders on the next update scan.
Delete the .old folders once updates work again.
Run the Built-In Troubleshooter
msdt.exe /id WindowsUpdateDiagnostic
If msdt is unavailable on your build, go to Settings > System > Troubleshoot > Other troubleshooters > Windows Update.
Fix Error 0x800f0922 (Full EFI Partition)
This error often means the EFI System Partition is too small. Check it:
mountvol S: /S
dir S:\EFI\Microsoft\Boot\Fonts
Deleting unused font files in S:\EFI\Microsoft\Boot\Fonts frees space. Back up the folder first. Then unmount:
mountvol S: /D
Install an Update Manually
Download the .msu from the Microsoft Update Catalog, then run:
wusa.exe C:\Temp\windows11-kb.msu /quiet /norestart
/quietsuppresses prompts./norestartdefers the reboot.
Fixing Slow Boot and Poor Performance
Audit Startup Load
Get-CimInstance Win32_StartupCommand | Select Name, Command, Location | Format-Table -AutoSize
Disable nonessential entries in Task Manager > Startup apps. Focus on items rated High impact.
Measure Real Boot Time
Open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > Diagnostics-Performance > Operational. Filter for Event ID 100. The BootTime value shows boot duration in milliseconds, and Event ID 101 to 110 entries name the apps or drivers that delayed it.
Disable Fast Startup When It Misbehaves
Fast Startup hibernates the kernel instead of shutting it down. Stale kernel state causes odd driver and network faults.
powercfg /h off
This disables hibernation and Fast Startup together and removes C:\hiberfil.sys. To keep hibernation but disable only Fast Startup, set this registry value to 0:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
Check Memory and CPU Hogs
Get-Process | Sort-Object WS -Descending | Select-Object -First 10 Name, Id, @{n="MemMB";e={[math]::Round($_.WS/1MB,1)}}
Look for runaway processes such as SearchIndexer.exe, MsMpEng.exe, or TiWorker.exe.
Fixing Blue Screens (BSOD)
Common Stop Codes
| Stop Code | Typical Cause | Fix |
|---|---|---|
DRIVER_IRQL_NOT_LESS_OR_EQUAL |
Faulty driver | Roll back or update the named driver |
PAGE_FAULT_IN_NONPAGED_AREA |
Bad RAM or driver | Run Windows Memory Diagnostic |
CRITICAL_PROCESS_DIED |
Corrupt system process | DISM + sfc, then WinRE repair |
INACCESSIBLE_BOOT_DEVICE |
Storage driver or BCD fault | Rebuild BCD (see below) |
SYSTEM_SERVICE_EXCEPTION |
Driver or antivirus conflict | Check minidump, remove conflicting software |
KERNEL_SECURITY_CHECK_FAILURE |
Memory corruption, bad driver | Test RAM, update drivers |
Read the Minidump
Windows saves crash data to C:\Windows\Minidump. Install WinDbg from the Microsoft Store and open the .dmp file, then run:
!analyze -v
The output names the faulting module (for example nvlddmkm.sys or rtwlane.sys). That module is your target.
Enable Minidump Collection
wmic recoveros set DebugInfoType = 3
Value 3 writes a small memory dump. Confirm under System Properties > Advanced > Startup and Recovery.
Test RAM
mdsched.exe
Choose Restart now and check for problems. Run it twice if you see intermittent crashes.
Fixing Boot Failures
Boot into WinRE by interrupting boot three times (hold the power button during the Windows logo), or boot from installation media and choose Repair your computer.
Rebuild the BCD Store
From Troubleshoot > Advanced options > Command Prompt:
bootrec /fixmbr
bootrec /fixboot
bootrec /scanos
bootrec /rebuildbcd
/fixmbrwrites a compatible master boot record./fixbootwrites a new boot sector./scanosfinds installed Windows copies./rebuildbcdrebuilds the Boot Configuration Data.
If bootrec /fixboot returns Access is denied on a UEFI system, rebuild the EFI files manually:
diskpart
list disk
sel disk 0
list vol
sel vol 3
assign letter=S:
exit
bcdboot C:\Windows /s S: /f UEFI
- Replace volume
3with the FAT32 volume of roughly 100 to 500 MB. bcdbootcopies fresh boot files and recreates the BCD from the C:\Windows installation.
Repair Offline System Files
When the OS will not boot, run sfc against the offline install:
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
Drive letters differ in WinRE, so confirm the Windows volume with dir C:\ first.
Use Safe Mode to Isolate Drivers
bcdedit /set {default} safeboot minimal
Reboot, remove or roll back the faulty driver, then reverse it:
bcdedit /deletevalue {default} safeboot
Fixing Network and Connectivity Problems
Reset the network stack when Wi-Fi drops, DNS fails, or adapters vanish after an update.
netsh winsock reset
netsh int ip reset
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock resetrestores the Winsock catalog to defaults.netsh int ip resetrewrites TCP/IP registry settings.ipconfig /flushdnsclears the resolver cache.
For a complete reset, run this in PowerShell and reboot:
Get-NetAdapter | Disable-NetAdapter -Confirm:$false
Get-NetAdapter | Enable-NetAdapter -Confirm:$false
If the adapter still fails, remove it in Device Manager, check Delete the driver software, and reboot to reinstall.
Fixing Start Menu, Taskbar, and Shell Issues
When Start, Search, or the taskbar freezes, re-register the built-in AppX packages:
Get-AppxPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
-AllUserscovers every profile.-DisableDevelopmentMode -Registerreinstalls from each package’s manifest without altering user data.
Red error text for some packages is normal. Restart explorer.exe afterward:
taskkill /f /im explorer.exe && start explorer.exe
If the issue affects only one user, create a test profile with net user TestUser /add. A working test profile confirms that the original profile is corrupt.
Fixing Driver Problems
List Third-Party Drivers
Get-WindowsDriver -Online | Select Driver, OriginalFileName, ProviderName, Date, Version | Sort Date -Descending
Remove a Problem Driver
pnputil /enum-drivers
pnputil /delete-driver oem42.inf /uninstall /force
/enum-driverslists installed driver packages withoemXX.infnames./delete-driverremoves the package./uninstallremoves it from devices that use it.
Verify Drivers with Driver Verifier (Advanced)
verifier
Driver Verifier stresses drivers to expose faults, and it can cause boot loops. Use it only after a restore point and with Safe Mode access ready. Disable it with verifier /reset.
Real-World Troubleshooting Scenarios
Scenario 1: Update Stuck at 0% After 24H2 Upgrade
- Run
DISM /Online /Cleanup-Image /RestoreHealth. - Reset update components using the script above.
- Free at least 20 GB on C:. Run
cleanmgr /sageset:1, thencleanmgr /sagerun:1. - Retry through the Installation Assistant or ISO in-place upgrade (
setup.exe /auto upgrade).
Scenario 2: Boot Loop After a Driver Install
- Interrupt boot three times to reach WinRE.
- Open Command Prompt and list drivers:
dism /image:C:\ /get-drivers. - Remove the new one:
dism /image:C:\ /remove-driver /driver:oem42.inf. - Reboot.
Scenario 3: Disk at 100% Usage
- Open Task Manager and sort by Disk.
- Stop the SysMain (Superfetch) service if it dominates on an HDD:
sc stop SysMain
sc config SysMain start= disabled
- Run
chkdsk C: /fand check SMART health. - Consider an SSD upgrade if the system disk is a mechanical drive.
Scenario 4: Corrupt User Profile
Symptoms include “We can’t sign in to your account” and temporary profile warnings.
- Boot with an administrator account.
- Open
regeditand go toHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. - Find the SID key ending in
.bakand rename it by removing the.baksuffix. - Set
Stateto0and reboot.
Scenario 5: Reset Without Losing Files
systemreset -cleanpc
For a non-destructive path, use Settings > System > Recovery > Reset this PC > Keep my files. Back up data first regardless.
Troubleshooting Tools Comparison
| Tool | Best For | Scope | Reboot Needed |
|---|---|---|---|
DISM |
Component store corruption | Image-level | No |
sfc /scannow |
Protected system files | File-level | Sometimes |
chkdsk |
File system and bad sectors | Volume-level | Yes (system volume) |
bootrec / bcdboot |
Boot configuration | Boot-level | Yes |
Reliability Monitor (perfmon /rel) |
Crash and failure timeline | Diagnostic | No |
| System Restore | Reverting config or driver changes | Config-level | Yes |
| In-place upgrade | Deep OS corruption | Full OS | Yes |
Verification Checklist
After any repair, confirm stability:
- Run
sfc /verifyonlyand expect no integrity violations. - Open Reliability Monitor (
perfmon /rel) and verify no new critical events. - Run
Get-HotFix | Sort InstalledOn -Descending | Select -First 5to confirm updates installed. - Check Event Viewer > Windows Logs > System for recurring
CriticalandErrorentries. - Reboot twice and confirm a clean start both times.
FAQ
How do I fix corrupted system files in Windows 11?
Run DISM /Online /Cleanup-Image /RestoreHealth first, then sfc /scannow in an elevated terminal, and reboot. DISM repairs the component store that sfc pulls replacement files from, so the order matters.
Why does Windows 11 keep failing to install updates?
The usual causes are a corrupted SoftwareDistribution cache, stopped update services, low disk space, or a full EFI System Partition. Reset the update components, free at least 20 GB, and rerun the update.
How do I fix a Windows 11 blue screen error?
Note the stop code, then open the minidump in C:\Windows\Minidump with WinDbg and run !analyze -v to identify the faulting driver. Roll back or update that driver, then run DISM and sfc if the code points to system corruption.
Is it safe to reset Windows 11 to fix problems?
Yes, if you back up first. Reset this PC > Keep my files preserves personal data but removes installed apps and settings. Try the DISM and sfc chain, then an in-place upgrade repair, before a reset.




