1
00:00:06,578 --> 00:00:08,610
- [Instructor] Okay, BSODs.

2
00:00:08,610 --> 00:00:11,130
The BSOD, or the Blue Screen of Death,

3
00:00:11,130 --> 00:00:14,460
is more accurately known
as a Windows stop error.

4
00:00:14,460 --> 00:00:18,030
That's what it'll be
referred to as in Windows.

5
00:00:18,030 --> 00:00:19,320
And we have an example here.

6
00:00:19,320 --> 00:00:22,560
You see the blue screen
with all the code on there.

7
00:00:22,560 --> 00:00:27,300
So if you see this, you're gonna
need to restart the system.

8
00:00:27,300 --> 00:00:30,060
If the error doesn't come up again,

9
00:00:30,060 --> 00:00:31,620
then you're in good shape usually.

10
00:00:31,620 --> 00:00:34,650
Sometimes it's just a freak occurrence,

11
00:00:34,650 --> 00:00:39,650
but if you see it again,
two, three, four times,

12
00:00:39,840 --> 00:00:41,190
then you're gonna need to troubleshoot

13
00:00:41,190 --> 00:00:43,530
and find out what the problem is.

14
00:00:43,530 --> 00:00:45,120
And a problem's usually divided into one

15
00:00:45,120 --> 00:00:46,080
of two different things.

16
00:00:46,080 --> 00:00:47,853
They can be driver related.

17
00:00:49,260 --> 00:00:51,060
Actually, the first blue screen we showed

18
00:00:51,060 --> 00:00:54,150
was driver related, and
this one is as well.

19
00:00:54,150 --> 00:00:56,400
There's a list of drivers
that are loaded up here,

20
00:00:56,400 --> 00:00:59,340
starting with ntoskrnl.exe.

21
00:00:59,340 --> 00:01:01,200
And that is the core.

22
00:01:01,200 --> 00:01:03,300
That is the kernel file for Windows.

23
00:01:03,300 --> 00:01:04,950
Without it you can't do anything.

24
00:01:05,790 --> 00:01:08,220
And then all these other
drivers are loaded up.

25
00:01:08,220 --> 00:01:09,873
And then the second column here,

26
00:01:10,890 --> 00:01:12,780
you'll see ones that fail quite often,

27
00:01:12,780 --> 00:01:17,460
hal.dll, keyboard class.

28
00:01:17,460 --> 00:01:20,583
Srv.sys, this is a common one.

29
00:01:21,750 --> 00:01:25,170
I've got a bunch of BSODs
saved from virtual machines

30
00:01:25,170 --> 00:01:29,490
that I've either created
myself or seen over the years,

31
00:01:29,490 --> 00:01:32,460
and srv.sys, this is a kind of common one.

32
00:01:32,460 --> 00:01:37,460
That's the system file that
underlies the server service.

33
00:01:38,130 --> 00:01:41,310
Without it, you can't have
anybody connect to your system

34
00:01:41,310 --> 00:01:45,270
to view documents or take
remote control of your system

35
00:01:45,270 --> 00:01:46,370
or that type of thing.

36
00:01:47,430 --> 00:01:49,620
So, this guy will fail sometimes.

37
00:01:49,620 --> 00:01:53,790
And what you're looking for is
the last driver on the list.

38
00:01:53,790 --> 00:01:55,740
That's the one that failed.

39
00:01:55,740 --> 00:01:58,410
Then that information about that failure

40
00:01:58,410 --> 00:02:03,410
and all the contents of memory
will be dumped into a file.

41
00:02:04,410 --> 00:02:05,250
You can see here.

42
00:02:05,250 --> 00:02:07,230
Here's the beginning of the
dump of physical memory.

43
00:02:07,230 --> 00:02:09,960
You can actually debug from that file

44
00:02:09,960 --> 00:02:11,820
from those file contents.

45
00:02:11,820 --> 00:02:14,190
So it could be a driver that's an issue.

46
00:02:14,190 --> 00:02:16,140
And that could be the file failed

47
00:02:16,140 --> 00:02:17,970
'cause of a hard drive problem,

48
00:02:17,970 --> 00:02:22,950
or possibly the file was
manipulated in some way.

49
00:02:22,950 --> 00:02:25,290
So, watch out for driver issues.

50
00:02:25,290 --> 00:02:27,720
The other possibility is it
could be hardware related.

51
00:02:27,720 --> 00:02:29,940
And if you see a blue screen like this,

52
00:02:29,940 --> 00:02:33,060
it could actually be
hardware or software related.

53
00:02:33,060 --> 00:02:36,630
But generally I see a
hardware issue if I see this.

54
00:02:36,630 --> 00:02:38,430
A device might be failing.

55
00:02:38,430 --> 00:02:40,590
it might have an electrical short,

56
00:02:40,590 --> 00:02:42,930
or it might need to be updated,

57
00:02:42,930 --> 00:02:44,553
as far as the driver goes.

58
00:02:45,780 --> 00:02:47,790
The RAM might have failed.

59
00:02:47,790 --> 00:02:50,250
There's a lot of
possibilities here with this.

60
00:02:50,250 --> 00:02:52,470
And you might have to get
more into the nitty gritty

61
00:02:52,470 --> 00:02:55,860
and actually open the system
and do some swapping of parts

62
00:02:55,860 --> 00:02:57,180
if that's the case.

63
00:02:57,180 --> 00:02:58,500
So, it could be driver related,

64
00:02:58,500 --> 00:03:00,660
or it could be hardware related,

65
00:03:00,660 --> 00:03:03,510
and, indirectly, this could
also be software related.

66
00:03:03,510 --> 00:03:06,310
A device might need a new
driver or something like that.

67
00:03:08,070 --> 00:03:09,840
And so what you can do is you can check

68
00:03:09,840 --> 00:03:12,240
the System log in the Event Viewer.

69
00:03:12,240 --> 00:03:14,703
That is, if you can get into the system.

70
00:03:15,930 --> 00:03:17,160
If it happens once or twice

71
00:03:17,160 --> 00:03:18,690
and you can still get into Windows,

72
00:03:18,690 --> 00:03:20,250
try checking the System log,

73
00:03:20,250 --> 00:03:22,680
and you do that in the Event Viewer.

74
00:03:22,680 --> 00:03:25,590
You can open this by
going to the search field

75
00:03:25,590 --> 00:03:30,097
or go into the Run prompt
and typing eventvwr.msc.

76
00:03:32,580 --> 00:03:34,140
That brings up the Event Viewer.

77
00:03:34,140 --> 00:03:38,100
You can go to Windows Logs
and then go to System.

78
00:03:38,100 --> 00:03:41,430
And what you're looking for
is any exclamation points

79
00:03:41,430 --> 00:03:45,570
that might have logged what
happened with the system.

80
00:03:45,570 --> 00:03:48,030
Okay, this is just an
error with the service

81
00:03:48,030 --> 00:03:49,080
that failed to start.

82
00:03:49,080 --> 00:03:52,350
And that's actually 'cause
I turned it off in MSConfig.

83
00:03:52,350 --> 00:03:54,870
That's one of the drawbacks of MSConfig

84
00:03:54,870 --> 00:03:57,570
is that some of the things
that don't start in there

85
00:03:57,570 --> 00:03:59,880
might actually show up as a system error.

86
00:03:59,880 --> 00:04:01,923
But you might see the error here,

87
00:04:02,760 --> 00:04:04,410
and you can find out
more information about it

88
00:04:04,410 --> 00:04:05,460
by double clicking on it.

89
00:04:05,460 --> 00:04:08,130
And we'll double click
on any one of these here.

90
00:04:08,130 --> 00:04:11,400
And that'll bring up the
event properties for that.

91
00:04:11,400 --> 00:04:12,233
And here we go,

92
00:04:12,233 --> 00:04:15,240
the Windows Modules
Installer service terminated.

93
00:04:15,240 --> 00:04:17,580
The module couldn't be found.

94
00:04:17,580 --> 00:04:20,130
And that is actually an
issue on this system.

95
00:04:20,130 --> 00:04:24,570
But I know about it, and I'll
fix it when I get a chance.

96
00:04:24,570 --> 00:04:27,150
It's not really necessary
for this particular computer,

97
00:04:27,150 --> 00:04:30,150
but you would wanna fix this.

98
00:04:30,150 --> 00:04:31,740
And this could be fixed in a couple ways.

99
00:04:31,740 --> 00:04:33,930
You could actually
download this specifically

100
00:04:33,930 --> 00:04:38,130
from the TechNet, or you
could update the software

101
00:04:38,130 --> 00:04:40,353
and hope that that does the fix for you.

102
00:04:41,940 --> 00:04:43,500
But you're gonna wanna take
a look at those errors.

103
00:04:43,500 --> 00:04:48,180
Maybe the crash, the BSOD
will actually show up here.

104
00:04:48,180 --> 00:04:50,070
It may not though.

105
00:04:50,070 --> 00:04:51,720
And then you may have to go further.

106
00:04:51,720 --> 00:04:54,900
If necessary, check the dump file

107
00:04:54,900 --> 00:04:57,960
with the Windows Debugger
or the Kernel Debugger.

108
00:04:57,960 --> 00:05:00,000
If you don't have the Windows
Debugger on your system,

109
00:05:00,000 --> 00:05:03,270
you can download that from
the Microsoft support page.

110
00:05:03,270 --> 00:05:04,500
Just do a search on their page

111
00:05:04,500 --> 00:05:06,330
and you'll be able to download that.

112
00:05:06,330 --> 00:05:11,330
And then you can view the
contents of that BSOD,

113
00:05:12,540 --> 00:05:15,360
that dump file that it created from there,

114
00:05:15,360 --> 00:05:17,580
the contents of RAM.

115
00:05:17,580 --> 00:05:20,430
That's gonna be very code oriented.

116
00:05:20,430 --> 00:05:22,950
So, you're gonna have to
take your time with that.

117
00:05:22,950 --> 00:05:27,930
But that all assumes that you
have a dump file to look at,

118
00:05:27,930 --> 00:05:30,690
and that has to be
turned on in the system.

119
00:05:30,690 --> 00:05:32,730
So, that's always
something to take a look at

120
00:05:32,730 --> 00:05:34,260
when you're looking at systems.

121
00:05:34,260 --> 00:05:36,900
I'm in the System Properties window here,

122
00:05:36,900 --> 00:05:39,180
which you can get from the system window,

123
00:05:39,180 --> 00:05:42,393
or you can type directly
from the run prompt.

124
00:05:43,290 --> 00:05:45,570
What you wanna go to is the Advanced tab.

125
00:05:45,570 --> 00:05:47,670
And from the Run prompt, you
can do this automatically.

126
00:05:47,670 --> 00:05:51,187
You can type systempropertiesadvanced.exe.

127
00:05:52,830 --> 00:05:54,420
That's all one word.

128
00:05:54,420 --> 00:05:56,010
And from that Advanced tab,

129
00:05:56,010 --> 00:05:57,690
you'll go to Startup and Recovery,

130
00:05:57,690 --> 00:05:58,743
go to Settings,

131
00:06:00,510 --> 00:06:03,450
and we're running Windows 7 here.

132
00:06:03,450 --> 00:06:05,610
And then down here,
you see System Failure.

133
00:06:05,610 --> 00:06:08,670
That's that stop error or system failure.

134
00:06:08,670 --> 00:06:10,380
You wanna make sure that this is set,

135
00:06:10,380 --> 00:06:12,810
first of all, to write an
event to the system log,

136
00:06:12,810 --> 00:06:14,910
as we mentioned before.

137
00:06:14,910 --> 00:06:17,410
If it's not check marked,
it's not gonna be there.

138
00:06:18,480 --> 00:06:20,250
And if it's a really bad failure,

139
00:06:20,250 --> 00:06:22,260
it may not write it to there anyway.

140
00:06:22,260 --> 00:06:25,560
It depends on how low level
the file was that failed,

141
00:06:25,560 --> 00:06:27,480
or if hardware that failed.

142
00:06:27,480 --> 00:06:30,840
You also want to have
Automatically Restart check marked.

143
00:06:30,840 --> 00:06:32,880
And this way, if there is a BSOD,

144
00:06:32,880 --> 00:06:35,100
it'll do a countdown,
then restart the system.

145
00:06:35,100 --> 00:06:37,920
'Cause again, quite
often you'll get a BSOD,

146
00:06:37,920 --> 00:06:39,520
but then you won't see it again.

147
00:06:40,620 --> 00:06:44,400
And then you write the debugging
information to a dump file.

148
00:06:44,400 --> 00:06:46,530
For example, you could
do the kernel memory dump

149
00:06:46,530 --> 00:06:48,510
or a smaller memory dump.

150
00:06:48,510 --> 00:06:50,550
You should really keep
it as kernel memory dump.

151
00:06:50,550 --> 00:06:53,220
Most networks, especially
enterprise networks,

152
00:06:53,220 --> 00:06:54,540
you wanna have this.

153
00:06:54,540 --> 00:06:57,420
And that's gonna save that file here.

154
00:06:57,420 --> 00:07:01,320
So if you can't boot
the system, you can use

155
00:07:01,320 --> 00:07:05,400
the Windows Debugger
software on another computer,

156
00:07:05,400 --> 00:07:07,320
or you could boot with
third-party software

157
00:07:07,320 --> 00:07:09,480
to view this memory dump.

158
00:07:09,480 --> 00:07:12,363
You could boot to a
disk or USB flash drive.

159
00:07:13,200 --> 00:07:15,240
And you would want to
get administrative access

160
00:07:15,240 --> 00:07:20,220
one way or another from the
drive here in the system root,

161
00:07:20,220 --> 00:07:23,340
which is gonna be the
Windows folder by default.

162
00:07:23,340 --> 00:07:26,760
And then look for that memory.dmp
file and then analyze it.

163
00:07:26,760 --> 00:07:28,560
That's where the fun begins.

164
00:07:28,560 --> 00:07:30,240
You're gonna want to access the TechNet

165
00:07:30,240 --> 00:07:32,400
to see a lot of the codes and see what

166
00:07:32,400 --> 00:07:34,050
you're actually looking at.

167
00:07:34,050 --> 00:07:37,560
This stuff is normally enabled by default

168
00:07:37,560 --> 00:07:40,920
in Windows Vista, 7, 8, et cetera.

169
00:07:40,920 --> 00:07:43,320
But you never know, it
might have been turned off

170
00:07:43,320 --> 00:07:46,230
as a a part of a policy,

171
00:07:46,230 --> 00:07:50,670
or it could be that
the user turned it off.

172
00:07:50,670 --> 00:07:52,260
Who knows?

173
00:07:52,260 --> 00:07:56,070
So if you do get a BSOD on the screen,

174
00:07:56,070 --> 00:08:00,270
and the system reboots, and it
still works okay afterwards,

175
00:08:00,270 --> 00:08:02,790
go in here and check this
and make sure that these

176
00:08:02,790 --> 00:08:06,360
are check marked and that you
have a full memory dump set up

177
00:08:06,360 --> 00:08:08,430
so that you can view that information

178
00:08:08,430 --> 00:08:10,590
if it does happen again.

179
00:08:10,590 --> 00:08:12,090
Always check that.

180
00:08:12,090 --> 00:08:15,510
So, a little bit about
Blue Screens of Death.

181
00:08:15,510 --> 00:08:16,770
Again, these are failures

182
00:08:16,770 --> 00:08:19,740
or Windows stop errors or boot failures.

183
00:08:19,740 --> 00:08:21,270
That's what they're gonna
be called by Microsoft.

184
00:08:21,270 --> 00:08:24,360
But they're more
affectionately known as BSODs.

185
00:08:24,360 --> 00:08:27,330
And that blue screen, you're
gonna wanna check that out

186
00:08:27,330 --> 00:08:31,140
and find out whether it's driver
related, hardware related,

187
00:08:31,140 --> 00:08:35,250
and use your tools to see
what exactly the problem was

188
00:08:35,250 --> 00:08:37,083
and why the failure occurred.