7 Core 2: Software Troubleshooting

A repeatable troubleshooting process

Software troubleshooting is an evidence-driven process: isolate the cause, make the smallest appropriate correction, and confirm that the problem is resolved. Symptoms may point to software, hardware, a user profile, a recent change, or a security incident. Treat an initial theory as something to test, not as an established fact.

A repeatable process is:

1. Identify the problem. Ask what changed, when the issue began, which users or devices are affected, and whether it happens every time. Record exact messages and symptoms.

2. Establish a probable cause. Consider recent updates or installations, configuration changes, low disk space, permissions, damaged files, incompatible software, and malware.

3. Test the theory. Change one variable at a time. Use Safe Mode, a clean boot, another user account, or another file to help isolate the cause.

4. Plan and implement a solution. Choose a fix that addresses the likely cause and protects user data. Back up important data before recovery or reset operations.

5. Verify functionality. Reproduce the original task, test related functions, and confirm that security protections are active.

6. Document the result. Record symptoms, findings, actions, and the outcome so the fix can be repeated or escalated.

Diagnosing operating-system problems

Begin with low-risk checks: restart if appropriate, note recent changes, confirm available disk space, and check whether updates are pending or failed. Use Task Manager to identify unusually high CPU, memory, disk, or network use. Event Viewer can provide application and system error details; compare event timestamps with when the issue occurred.

Match the diagnostic approach to the symptom

• Slow startup or login: Check startup apps and resource use. Compare normal startup with Safe Mode or a clean boot. If the system starts normally in a clean environment, re-enable items systematically to isolate a conflict.

• Blue screen, freeze, or repeated restart: Record the stop code and timing. Consider a recent driver, update, or application change, check event records, and use Windows Recovery Environment if Windows will not start.

• Missing or damaged system files: Use Windows repair tools only when symptoms suggest corruption, and run them from an elevated terminal.

• Repeated update failure: Record the error code and check connectivity, available space, and whether the update is pending or partially installed before attempting repairs.

• Problem affecting one user: Test with another authorized account. If the second account works, investigate the first user’s settings or profile rather than changing system-wide settings.

Repairing suspected system-file corruption

For suspected Windows system-file corruption, run DISM followed by System File Checker in an elevated Command Prompt or Terminal. Allow both commands to finish, then restart and retest.

DISM repairs the Windows component image. System File Checker checks protected system files and attempts to replace incorrect versions. These commands address particular corruption problems, not every crash or slow computer.

Safe Mode starts Windows with a limited set of drivers and services. If the symptom disappears there, a driver, service, or startup application becomes more likely. A clean boot provides a controlled way to test background services and startup apps; track changes and restore normal startup afterward.

If Windows cannot start, Startup Repair and other options are available in Windows Recovery Environment. Avoid boot-repair commands or system resets unless evidence supports them and important data is protected.

Diagnosing application problems

When an application crashes, freezes, fails to install, or behaves incorrectly, first determine whether the issue affects one app, one file, one user, or the whole system. Check the application’s error message, system requirements, available disk space, permissions, and compatibility with the operating-system version. Install updates from a trusted source. If the problem began immediately after an update or plug-in installation, test whether reverting that change resolves it.

Useful isolation tests include:

• Open a different file in the same application. If only one file fails, the file may be damaged.

• Try the application under another authorized user profile to distinguish a profile-specific configuration problem from a system-wide one.

• Close or temporarily remove recently added extensions or plug-ins, following organizational policy.

• Use the application’s Repair option when available. Consider the effect on saved settings and data before using Reset. Reinstall only after confirming that required files, licenses, and configuration can be restored.

On a Mac, force-quit an unresponsive app if necessary, then check compatibility, updates, the file being opened, and recently attached peripherals. Force-quitting can lose unsaved work.

Do not disable security software as a routine troubleshooting shortcut. If a security product appears to block a legitimate app, verify the app and publisher first, then use approved allow-list or support procedures.

Recognizing and responding to malware

Possible warning signs include unexpected pop-ups or redirects, unfamiliar programs or browser extensions, changed settings, unexplained performance or network activity, disabled security tools, or files becoming inaccessible or renamed. These signs are not proof of malware; confirm with security tools and other evidence.

Choose a response appropriate to the device

Stop using an affected device for sensitive activity and notify the responsible IT or security team. On a managed or potentially compromised business device, follow incident-response instructions. Do not wipe, reset, power off, or disconnect it unless directed, because responders may need evidence.

On a personal device, use reputable, updated antimalware tools. A full scan or offline scan may help when a threat persists or hides while Windows is running. Review detection results and quarantine or remove threats as appropriate. Restore data from a known-good backup if needed, then update the operating system and applications before returning the device to use.

After suspected credential theft, use a known-clean device to change affected passwords and contact the relevant service or organizational security team. Never allow a detected threat merely to make an alert disappear; verify that the file is trusted before taking that action.

Applying the process to common cases

1. Windows crashes during normal startup after a driver update but works in Safe Mode. Investigate the recently updated driver or a startup component first. Use recovery or Safe Mode to roll back or update the driver, then restart normally and verify the result.

2. An editor crashes on one document but opens others successfully. Test the affected document with an appropriate recovery method or another compatible application. The evidence points more strongly to that file than to a general application failure.

3. A browser redirects, unfamiliar extensions appear, and antivirus protection is disabled. Treat this as a possible security incident. Stop sensitive use, notify the responsible team if the device is managed, preserve the device as directed, and use approved scanning and recovery procedures.

4. DISM and System File Checker finish successfully, but an application still crashes. These checks have not established that Windows system-file corruption caused the issue. Continue isolating the application, affected file, user profile, plug-ins, compatibility, or recent changes rather than repeatedly running the same repair.

Good troubleshooting defines the symptom, tests likely causes one at a time, makes a controlled change, verifies the original task, and documents the outcome. Use Windows tools such as Event Viewer, Safe Mode, clean boot, DISM, and System File Checker when symptoms justify them. For suspected malware, distinguish a warning sign from a confirmed infection and follow the appropriate incident-response process before changing or erasing the device.