How to access ntbtlog.txt of a failed startup from safe mode (only starts in safe mode)?

[Kapetan]

I have a computer that no longer starts up Windows 10. It freezes on startup, during the Windows logo and spinning circles screen. After a bit of time it turns to BSOD that says it is gathering data and will restart but it remains at 0% and I have to restart it. Most often the stop code is WHEA_UNCORRECTABLE_ERROR, but I've seen KERNEL_SECURITY_CHECK_FAILURE and MEMORY_MANAGEMENT.

In any case, the system boots fine into Safe Mode with Networking (I am writing this from it). I wish to see the ntbtlog.txt from a failed attempt but it is not preserved when the computer boots into safe mode again (or even command prompt). This is with an on-board m.2 SSD (Corsair MP500) so I can't easily take it out and connect it elsewhere (I have nothing I could use for that).

As I took the graphics card out, disconnected all external devices and disabled most of the services and drivers I still see the issue and would like to understand what it is. Windows update does not work (does nothing, spins continuously), nor does System Restore, yet disc checking does not discover errors.

*EDIT* Even if I boot from a USB stick I still don't see the ntbtlog.txt at c:\Windows\. What gives?

Please help!

 

[Saltgrass]

The file is not created unless you have enabled that option using msconfig.exe.

With msconfig.exe open, check out the diagnostic capabilities that will allow only certain processes to start. You may be able to selectively start certain items and work down to the problem process.

Start with loading just Microsoft stuff and see if it boot normally that way. Then allow other items to see if it starts having a problem again... Of course, keep close track of which ones are selected.

No dump files being created? Check Windows\LiveKernelReports for files.

Does the Event Viewer work in safe mode?

 

[Kapetan]

I already disabled everything (including Microsoft) that was not running in Safe Mode ... that I could (some cannot be disabled). This includes services, startup items and even drivers that I don't need. Event Viewer works but I didn't find anything that would point me to being useful or related to startup. There is an error logged with raid0 controller but I am not booting from and the storage is just fine and accessible from safe mode.

Pasting screenshots here... hope that works...

 

[Saltgrass]

You did not give any info regarding whether you saw any changes in your system reliability. Did anything help?

On the first screen, it has the Diagnostic option. Does your system boot into normal mode if that is checked?

You have a lot of stuff on your system, so many possibilities for driver problems.

 

[Kapetan]

Sorry for being unclear. Those screens show how I already tried it before I posted to this forum. It did not help. I will try diagnostic.

 

[Saltgrass]

My bootlog show up normally. But I did have to restart twice since the first time I did not hit the Apply button the first time..

If you can't boot into your normal Windows install with the Diagnostic option checked, then a basic problem is probably causing the problem. You might try running the memory diagnostic.

 

[Kapetan]

Diagnostic startup didn't help.

ntbtlog.txt does show up in safe mode... but it is from the safe mode boot, not the previous failed one that I need to examine.

Why would memory be fine in safe mode but not in normal mode?

 

[Saltgrass]

Why would memory be fine in safe mode but not in normal mode?

Maybe memory management is handled differently in normal mode.

 

[Kapetan]

Progress made.

I didn't have time to do things one by one, so I am not sure exactly which bit happened, but:

1. I uninstalled few additional bits of software I was reluctant to uninstall initially - Bitdefender (Total Security) and ASUS motherboard software.
2. I shut the computer down and completely powered it off.
3. I removed one of two memory modules, to check if memory module (or controller) is causing the issue.
4. The computer restarted in normal mode (still most services and drivers disabled as per previous runs).
5. I shut the computer again.
6. I put back the memory module I removed (to have both modules back on board).
7. The computer started fine again.

Based on this it seems to be either:

1. One of those two bits of software (Bitdefender Total Security or ASUS motherboard software)
2. A transient memory-related error that got reset/cleared by removing the module.

 

[Kapetan]

So... technically... I no longer have the problem which caused me to be concerned about ntbtlog.txt ... But I still don't see how can one get access to failed boot logs, critical to figuring out what is going on...

 

[Saltgrass]

I always use ASUS boards for my desktop systems. I never use the software which comes with them...

If you have not yet gone back to a normal boot in msconfig, you may still have a problem with something there.

If you want to reinstall Bit Defender and you don't have other anti-virus, make sure and have the latest version.

Reseating the memory could very well have had an effect.

 

[Kapetan]

I am back to normal boot, as indicated. BitDefender confirmed they are aware of the issue and have already fixed it, which is why my reinstall worked.

However, that still leaves the main question unanswered. How does one diagnose a failed boot if there is no way to get logs from it?