- [Instructor] Okay, BSODs.
The BSOD, or the Blue Screen of Death,
is more accurately known as a Windows stop error.
That's what it'll be referred to as in Windows.
And we have an example here.
You see the blue screen with all the code on there.
So if you see this, you're gonna need to restart the system.
If the error doesn't come up again,
then you're in good shape usually.
Sometimes it's just a freak occurrence,
but if you see it again, two, three, four times,
then you're gonna need to troubleshoot
and find out what the problem is.
And a problem's usually divided into one
of two different things.
They can be driver related.
Actually, the first blue screen we showed
was driver related, and this one is as well.
There's a list of drivers that are loaded up here,
starting with ntoskrnl.exe.
And that is the core.
That is the kernel file for Windows.
Without it you can't do anything.
And then all these other drivers are loaded up.
And then the second column here,
you'll see ones that fail quite often,
hal.dll, keyboard class.
Srv.sys, this is a common one.
I've got a bunch of BSODs saved from virtual machines
that I've either created myself or seen over the years,
and srv.sys, this is a kind of common one.
That's the system file that underlies the server service.
Without it, you can't have anybody connect to your system
to view documents or take remote control of your system
or that type of thing.
So, this guy will fail sometimes.
And what you're looking for is the last driver on the list.
That's the one that failed.
Then that information about that failure
and all the contents of memory will be dumped into a file.
You can see here.
Here's the beginning of the dump of physical memory.
You can actually debug from that file
from those file contents.
So it could be a driver that's an issue.
And that could be the file failed
'cause of a hard drive problem,
or possibly the file was manipulated in some way.
So, watch out for driver issues.
The other possibility is it could be hardware related.
And if you see a blue screen like this,
it could actually be hardware or software related.
But generally I see a hardware issue if I see this.
A device might be failing.
it might have an electrical short,
or it might need to be updated,
as far as the driver goes.
The RAM might have failed.
There's a lot of possibilities here with this.
And you might have to get more into the nitty gritty
and actually open the system and do some swapping of parts
if that's the case.
So, it could be driver related,
or it could be hardware related,
and, indirectly, this could also be software related.
A device might need a new driver or something like that.
And so what you can do is you can check
the System log in the Event Viewer.
That is, if you can get into the system.
If it happens once or twice
and you can still get into Windows,
try checking the System log,
and you do that in the Event Viewer.
You can open this by going to the search field
or go into the Run prompt and typing eventvwr.msc.
That brings up the Event Viewer.
You can go to Windows Logs and then go to System.
And what you're looking for is any exclamation points
that might have logged what happened with the system.
Okay, this is just an error with the service
that failed to start.
And that's actually 'cause I turned it off in MSConfig.
That's one of the drawbacks of MSConfig
is that some of the things that don't start in there
might actually show up as a system error.
But you might see the error here,
and you can find out more information about it
by double clicking on it.
And we'll double click on any one of these here.
And that'll bring up the event properties for that.
And here we go,
the Windows Modules Installer service terminated.
The module couldn't be found.
And that is actually an issue on this system.
But I know about it, and I'll fix it when I get a chance.
It's not really necessary for this particular computer,
but you would wanna fix this.
And this could be fixed in a couple ways.
You could actually download this specifically
from the TechNet, or you could update the software
and hope that that does the fix for you.
But you're gonna wanna take a look at those errors.
Maybe the crash, the BSOD will actually show up here.
It may not though.
And then you may have to go further.
If necessary, check the dump file
with the Windows Debugger or the Kernel Debugger.
If you don't have the Windows Debugger on your system,
you can download that from the Microsoft support page.
Just do a search on their page
and you'll be able to download that.
And then you can view the contents of that BSOD,
that dump file that it created from there,
the contents of RAM.
That's gonna be very code oriented.
So, you're gonna have to take your time with that.
But that all assumes that you have a dump file to look at,
and that has to be turned on in the system.
So, that's always something to take a look at
when you're looking at systems.
I'm in the System Properties window here,
which you can get from the system window,
or you can type directly from the run prompt.
What you wanna go to is the Advanced tab.
And from the Run prompt, you can do this automatically.
You can type systempropertiesadvanced.exe.
That's all one word.
And from that Advanced tab,
you'll go to Startup and Recovery,
go to Settings,
and we're running Windows 7 here.
And then down here, you see System Failure.
That's that stop error or system failure.
You wanna make sure that this is set,
first of all, to write an event to the system log,
as we mentioned before.
If it's not check marked, it's not gonna be there.
And if it's a really bad failure,
it may not write it to there anyway.
It depends on how low level the file was that failed,
or if hardware that failed.
You also want to have Automatically Restart check marked.
And this way, if there is a BSOD,
it'll do a countdown, then restart the system.
'Cause again, quite often you'll get a BSOD,
but then you won't see it again.
And then you write the debugging information to a dump file.
For example, you could do the kernel memory dump
or a smaller memory dump.
You should really keep it as kernel memory dump.
Most networks, especially enterprise networks,
you wanna have this.
And that's gonna save that file here.
So if you can't boot the system, you can use
the Windows Debugger software on another computer,
or you could boot with third-party software
to view this memory dump.
You could boot to a disk or USB flash drive.
And you would want to get administrative access
one way or another from the drive here in the system root,
which is gonna be the Windows folder by default.
And then look for that memory.dmp file and then analyze it.
That's where the fun begins.
You're gonna want to access the TechNet
to see a lot of the codes and see what
you're actually looking at.
This stuff is normally enabled by default
in Windows Vista, 7, 8, et cetera.
But you never know, it might have been turned off
as a a part of a policy,
or it could be that the user turned it off.
Who knows?
So if you do get a BSOD on the screen,
and the system reboots, and it still works okay afterwards,
go in here and check this and make sure that these
are check marked and that you have a full memory dump set up
so that you can view that information
if it does happen again.
Always check that.
So, a little bit about Blue Screens of Death.
Again, these are failures
or Windows stop errors or boot failures.
That's what they're gonna be called by Microsoft.
But they're more affectionately known as BSODs.
And that blue screen, you're gonna wanna check that out
and find out whether it's driver related, hardware related,
and use your tools to see what exactly the problem was
and why the failure occurred.