Fix boot problems: WinRE, Safe Mode, Recovery

Windows opens its own recovery environment after two failed starts in a row, so the first screen a worried user describes is often a recovery menu and not the fault. A laptop that restarts into Automatic Repair, a laptop that asks for a 48-digit key and a Mac that stops at a blank screen are three different problems, and each one wants a different first move.

You will place a failed start on the boot path from firmware to sign-in, reach the Windows Recovery Environment and use its tools from least to most disruptive, explain what quick machine recovery does and when it is switched on, and bring a Mac back with safe mode, First Aid and Recovery. A short Linux section covers the GRUB menu and the previous boot’s log.

A failed start has a place on the boot path

A start is five handovers in a row, and the symptom on the screen tells you which one failed. The firmware lists the disks and checks signatures. The boot manager reads the boot configuration databoot configuration data: The store (BCD) that tells the Windows boot manager which operating systems and boot options exist. If it is missing or damaged, WinRE may be out of reach and recovery media is needed. and opens an encrypted system volume. The OS loader verifies and loads the kernel, the kernel starts the boot drivers, and last the sign-in screen appears and the startup items run. A tool that helps at one stage does nothing at another: Startup RepairStartup Repair: The WinRE tool that diagnoses and repairs a Windows installation that cannot start. Started automatically it repairs only operating system and driver files that the boot logs point to. cannot mend a PC whose firmware never lists the disk. Step through a start and note which symptom each stage produces:

Microsoft’s article on securing the Windows boot process describes the same chain from the security side. Secure Boot checks the boot loader, Trusted Boot checks the kernel and, in its words, “every component of the startup process” after it, early-launch anti-malware checks each boot driver before it loads, and Measured Boot logs the whole start. A file that fails one of these checks is refused at that stage, which is why the stage of a failure narrows the cause so quickly.

One screen on this path needs care. The BitLocker recovery screen is not a disk fault: it appears when the TPM will not release the key, because something it measures has changed. Microsoft’s recovery overview lists causes such as a firmware upgrade, a change to the boot manager, clearing the TPM, moving the drive into another computer and entering the wrong PIN too many times. The way through is the recovery key, handed over only after the caller’s identity is checked; that process has its own lesson, BitLocker and FileVault recovery keys.

Ten symptoms from Windows, macOS and Linux sit on the path below, each with the first tool to try and the reason. The table is MySmartCoPilot’s rule of thumb; the facts under it are Microsoft’s and Apple’s. Press Edit, change a stage or a tool, and run it again:

# Ten start-up symptoms placed on the boot path, each with the tool to try first and the reason.
# The table is MySmartCoPilot's triage rule of thumb; the facts under it come from Microsoft's and Apple's pages.
STAGES = ["firmware", "boot manager", "OS loader", "kernel and drivers", "sign-in"]

SYMPTOMS = [
    ("No bootable device found", "firmware", "firmware setup",
     "no boot files have been handed over yet; check the disk is listed and first in the boot order"),
    ("Secure Boot violation message", "firmware", "firmware setup",
     "the firmware refused a loader or driver; read the Secure Boot state and what changed"),
    ("Windows asks for the BitLocker recovery key", "boot manager", "recovery key",
     "the volume is still locked here; only the key gets past this screen, after the caller's identity is checked"),
    ("Boot configuration data missing or damaged", "boot manager", "recovery media",
     "the on-disk recovery tools may be out of reach, so start from a USB drive"),
    ("Restarts into Automatic Repair after an update", "OS loader", "WinRE: undo the recent change",
     "start with the least disruptive rung: point-in-time restore or Uninstall updates"),
    ("Blue screen with a stop code soon after the logo", "kernel and drivers", "WinRE: undo the recent change",
     "a driver or update loaded at this stage is the usual suspect; undo it before anything bigger"),
    ("Black screen after sign-in", "sign-in", "safe mode",
     "safe mode loads a limited set of drivers and startup items, so it separates them from the rest"),
    ("Mac login window loops or apps quit at start", "sign-in", "Mac safe mode",
     "safe mode stops login items and non-essential extensions from loading"),
    ("Mac stops at a question mark or a blank screen", "boot manager", "Mac Recovery: First Aid",
     "Recovery runs without the startup disk, and First Aid checks the disk first"),
    ("Linux black screen after a kernel update", "OS loader", "GRUB: older kernel",
     "the GRUB menu is still reachable, and an older kernel entry usually sits under Advanced options"),
]


def main():
    print("Symptom".ljust(50), "Stage".ljust(19), "Try first")
    for symptom, stage, tool, _why in sorted(SYMPTOMS, key=lambda row: STAGES.index(row[1])):
        print(symptom.ljust(50), stage.ljust(19), tool)
    print()
    for stage in STAGES:
        names = [row[0] for row in SYMPTOMS if row[1] == stage]
        print(f"{stage}: {len(names)} symptom(s)")
    tools = {row[2] for row in SYMPTOMS}
    print(f"\n{len(SYMPTOMS)} symptoms, {len(tools)} different first tools")
    print("Why the recovery key comes first:", SYMPTOMS[2][3])


main()

Symptom                                            Stage               Try first
No bootable device found                           firmware            firmware setup
Secure Boot violation message                      firmware            firmware setup
Windows asks for the BitLocker recovery key        boot manager        recovery key
Boot configuration data missing or damaged         boot manager        recovery media
Mac stops at a question mark or a blank screen     boot manager        Mac Recovery: First Aid
Restarts into Automatic Repair after an update     OS loader           WinRE: undo the recent change
Linux black screen after a kernel update           OS loader           GRUB: older kernel
Blue screen with a stop code soon after the logo   kernel and drivers  WinRE: undo the recent change
Black screen after sign-in                         sign-in             safe mode
Mac login window loops or apps quit at start       sign-in             Mac safe mode

firmware: 2 symptom(s)
boot manager: 3 symptom(s)
OS loader: 2 symptom(s)
kernel and drivers: 1 symptom(s)
sign-in: 2 symptom(s)

10 symptoms, 8 different first tools
Why the recovery key comes first: the volume is still locked here; only the key gets past this screen, after the caller's identity is checked

Three of the ten symptoms sit at the boot manager, more than at any other stage, and the firmware has two. Ten symptoms need only eight different first tools, because a stage can share a tool: the firmware setup answers both firmware rows, and one undo step in WinRE answers an update loop and a blue screen after the logo. Write the stage in the ticket before the tool, so that the next person can check the reasoning and not only the result.

Two failed starts open WinRE on their own

Windows does not need to understand a failure to react to it. When Windows starts, the loader sets a status flag that says start-up has begun, and Windows clears that flag before the sign-in screen appears. If the start fails, the flag is never cleared; at the next start the loader finds it, assumes a start-up failure and starts the recovery environment instead of Windows. Step through that one mechanism, because it explains both the helpful behaviour and the false alarm:

The test watches whether start-up finished, not whether an error was reported, so a boot loopboot loop: A start that fails and restarts again and again, never reaching the sign-in screen. Windows may count it as repeated failures and open WinRE, but a power cut can look the same. and a power cut can look alike. Microsoft’s technical reference lists what starts the Windows Recovery EnvironmentWindows Recovery Environment: A small Windows kept on the PC (WinRE) that repairs systems that cannot start. It opens by itself after repeated failed starts, or on purpose from Advanced startup or recovery media. (WinRE) automatically:

• two consecutive failed attempts to start Windows;
• two consecutive unexpected shutdowns within two minutes of the start finishing;
• two consecutive restarts within two minutes of the start finishing;
• a Secure Boot error, except issues with the Bootmgr.efi file;
• a BitLocker error on a touch-only device.

A user can also open it on purpose. From the sign-in screen, hold Shift and choose Restart under the power button. From a working desktop, go to Settings, System, Recovery, and select Restart now beside Advanced startup. Boot from recovery media, or press the recovery button some manufacturers build in. All four end at the same Advanced startup menu, which also offers the firmware settings on UEFI PCs.

Some failures put WinRE out of reach, because the automatic route depends on the boot manager and the boot loader. Microsoft names three: damaged disk metadata in the MBR (the disk’s first sector), the partition table or the boot sector of the WinRE partition, a boot manager that is missing or corrupted, and a boot configuration data store that is missing or corrupted. In each case the user has to start from bootable recovery media, which is why a recovery USB drive belongs in every support kit. When Windows only fails to write its flag, the Boot Options menu can still open the on-disk WinRE by hand.

Two commands tell you where you stand, and one of them needs respect. reagentc /info reports whether WinRE is enabled and where its image is. bcdedit /enum lists the boot entries. Reading the store is harmless; changing it with bcdedit /set is a repair of last resort, because that store is what tells the boot manager what to start, and Microsoft’s reference requires administrator rights to modify it.

In WinRE, work from the least disruptive tool

Microsoft’s own page for a PC that will not start lists the tools in an order, least disruptive first, and tells the reader to try the next only if needed. First comes point-in-time restorepoint-in-time restore: A Windows 11 24H2 and later tool that rolls apps, settings and personal files back to a recent automatic restore point, kept for up to 3 days. Changes made after the point are lost., new in Windows 11 24H2: it rolls back apps, settings and personal files to a recent automatic restore point, and only changes after that point are lost. Restore points are kept for up to 3 days. Second is Uninstall updates, which removes the update you pick and leaves files, apps and settings alone, though some updates cannot be uninstalled. Third is Reset this PC, which reinstalls Windows and removes apps and settings whatever you choose about files. Last is reinstalling from recovery or installation media.

Two more tools sit beside that list. System RestoreSystem Restore: A Windows tool that rolls back system files and settings to an earlier restore point without touching personal files. It reaches back further than the 3 days of point-in-time restore. rolls back system files and settings, not personal files, and covers restore points older than 3 days or a PC without point-in-time restore. Startup Repair, called Automatic Repair when it starts by itself, runs after the second failed start; when it starts that way, Microsoft says it only repairs operating system and driver files that the boot logs or a crash dump point to. If the BitLocker recovery key is needed, WinRE asks for it first.

Safe modesafe mode: A start that loads only a limited set of files and drivers, to show whether default settings and basic drivers cause a problem. Windows and macOS both have one, reached differently. is a different kind of tool: it repairs nothing and shows whether the basics work. In WinRE choose Troubleshoot, Advanced options, Startup Settings, then Restart, and pick a mode on the next screen. Safe mode starts Windows with a limited set of files and drivers; if the fault does not appear there, the default settings and basic drivers are not the cause. Safe Mode with Networking adds the network drivers, Safe Mode with Command Prompt replaces the desktop with a command window, and one setting stops Windows restarting after a failure, for a PC stuck in a loop.

Pick a tool by the facts of the PC in front of you. The table shows what each tool keeps and undoes, and four questions rule options out: change an answer and watch which rows change.

Quick machine recovery fetches a fix for many PCs at once

When thousands of PCs fail the same way, walking to each one is the slow part. Quick machine recoveryquick machine recovery: A Windows 11 feature that, after repeated failed starts, boots into WinRE, connects to a network and applies a fix from Windows Update. It is best effort and does not reset the PC or touch files. lets a Windows 11 device with version 24H2 or later do the first step by itself: after repeated failed starts it boots into WinRE, connects to a network, checks Windows Update for a fix from Microsoft and applies it. The fix does not reset the PC or touch its files, apps or settings. Microsoft calls it a best-effort feature, so a device may find nothing, and the other tools stay needed. Step through one recovery and watch the two side arrows, the outcomes where no fix is found and where a fix fails:

Whether it runs depends on the PC’s state. Cloud remediation, the part that uses Windows Update, is on by default with a one-time scan on Home edition and on Pro devices that are not domain joined and not managed by an organisation. It is off by default on Enterprise and Education devices and on managed Pro devices, so that the organisation chooses. Only wired networks and WPA or WPA2 password Wi-Fi are supported, so a PC that must complete a sign-in page in a browser before it has internet access is unlikely to reach Windows Update from WinRE.

The settings are an XML file, applied with reagentc.exe /setrecoverysettings and read with /getrecoverysettings. The program below reads the file Microsoft documents, whose Wi-Fi name and password are Microsoft’s placeholders, prints what it means and applies the documented defaults to four devices:

# Reads a quick machine recovery settings file in the XML shape Microsoft documents (the Wi-Fi name and password
# are Microsoft's own placeholders), prints what it means, and applies the documented defaults to four devices.
import xml.etree.ElementTree as ET

SETTINGS = """<?xml version='1.0' encoding='utf-8'?>
<WindowsRE>
  <WifiCredential>
    <Wifi ssid="ContosoWiFi" password="ContosoWiFiPassword" />
  </WifiCredential>
  <CloudRemediation state="1" />
  <AutoRemediation state="1" totalwaittime="2400" waitinterval="120" />
</WindowsRE>
"""


def describe(xml_text):
    root = ET.fromstring(xml_text)
    cloud = root.find("CloudRemediation").get("state") == "1"
    auto = root.find("AutoRemediation")
    wifi = root.find("WifiCredential/Wifi")
    total = int(auto.get("totalwaittime"))
    every = int(auto.get("waitinterval"))
    print("Cloud remediation:", "on" if cloud else "off")
    print("Auto remediation:", "on" if auto.get("state") == "1" else "off")
    print(f"Wi-Fi network: {wifi.get('ssid')} (password of {len(wifi.get('password'))} characters, not shown)")
    print(f"Waits up to {total} minutes = {total / 60:g} hours")
    print(f"Looks for a fix every {every} minutes = {total // every} checks")


def default_state(edition, managed):
    """Microsoft's defaults: on for Home and for unmanaged Pro, off for enterprise-managed devices."""
    if edition == "Home" or (edition == "Pro" and not managed):
        return "cloud remediation on, one-time scan"
    return "cloud remediation off, Startup Repair only"


describe(SETTINGS)
print()
for edition, managed in [("Home", False), ("Pro", False), ("Pro", True), ("Enterprise", True)]:
    label = f"{edition}, {'managed' if managed else 'unmanaged'}"
    print(f"{label:20} {default_state(edition, managed)}")

Cloud remediation: on
Auto remediation: on
Wi-Fi network: ContosoWiFi (password of 19 characters, not shown)
Waits up to 2400 minutes = 40 hours
Looks for a fix every 120 minutes = 20 checks

Home, unmanaged      cloud remediation on, one-time scan
Pro, unmanaged       cloud remediation on, one-time scan
Pro, managed         cloud remediation off, Startup Repair only
Enterprise, managed  cloud remediation off, Startup Repair only

The settings wait 2,400 minutes, which is 40 hours, and look for a fix every 120 minutes, so a device that has not recovered checks 20 times before it restarts. The program prints the length of the password, never the password itself: a Wi-Fi password in a settings file is a secret, and a log or a ticket must not carry it. A fix that was applied shows in Settings, Windows Update, Update history, under Quality updates.

A Mac starts in safe mode, then First Aid, then Recovery

A Mac that starts but misbehaves is handled differently from a PC, and the first rung is safe mode. Apple lists what it does: it stops login items, extensions macOS does not need and fonts it did not install from loading; it runs a basic check of the startup disk, like a lighter First Aid; and it clears some system caches. Before using it, Apple’s advice is to install the latest updates and unplug nonessential devices. With Apple siliconApple silicon: Apple's own processors for the Mac, reported as arm64 by uname -m. Such a Mac starts macOS Recovery from its power button, and its firmware can be revived or restored from a second Mac. More in “Install, reinstall and erase macOS” the steps are: turn the Mac off, press the power button and keep it down until “Loading startup options” shows, select the startup disk, then hold Shift and click Continue in Safe Mode. An Intel Mac needs only Shift, held from the moment it turns on until the login window appears. An Intel Mac with a firmware password cannot start in safe mode.

How do you know which mode a Mac is in? Apple’s answer is the Boot Mode line of System Information, and the read-only session below prints that line, the macOS version and the startup disk on the Mac used for this lesson:

from session import run

# What to read on a Mac before deciding how to recover it: the processor family, the boot mode the running system
# reports (Apple's page says to look for "Boot Mode: Safe" when you are unsure), and the startup disk's own details.
# Every command here only reads the system; nothing is repaired, erased or restarted.
run("""
uname -m
system_profiler SPSoftwareDataType | grep -E 'System Version|Boot Volume|Boot Mode'
diskutil info / | grep -E 'File System Personality|Solid State|Device Location'
""")

$ uname -m
arm64
$ system_profiler SPSoftwareDataType | grep -E 'System Version|Boot Volume|Boot Mode'
      System Version: macOS 26.7.1 (25G241)
      Boot Volume: Macintosh HD
      Boot Mode: Normal
$ diskutil info / | grep -E 'File System Personality|Solid State|Device Location'
   File System Personality:   APFS
   Device Location:           Internal
   Solid State:               Yes

The Mac in the session reports Boot Mode: Normal on an internal solid-state APFS disk. In safe mode the same line reads Safe, and the login window shows Safe Boot in red. Restart normally and compare: if the fault is gone, the disk check or the cleared caches may have fixed it; if it returns, something that safe mode held back is the cause, so remove login items or test with a new user account. Step through the whole ladder:

When a Mac cannot reach safe mode, or the fault continues there, the next rung is macOS Recovery, which the macOS lesson explains key by key. Inside it, run First AidFirst Aid: The Disk Utility function on a Mac that checks a volume, a container or a whole storage device for errors and repairs what it can. Apple's order is each volume, then the container, then the device. in Disk Utility on each volume, then the container, then the storage device itself, because the disk is checked from the outside in. If the issue continues in safe mode, Apple calls reinstalling macOS the easiest and most likely fix, and a reinstall does not remove personal files. Only when First Aid cannot repair the disk does the last rung apply: back up as much as possible, reformat, reinstall and restore.

A Linux desktop keeps its menu and its last boot log

A Linux desktop has two advantages over a PC with a damaged loader: the GRUB menu is usually still reachable, and the system keeps the log of earlier boots. On a UEFI machine press Esc, possibly several times, as the firmware finishes, and on a BIOS machine hold Shift. The Ubuntu wiki’s route is to choose Advanced options, then the line ending in recovery mode, and from the menu that follows choose Drop to root shell prompt. The root file system is mounted read-only at that point, and mount -o remount,rw / makes it writable. The same Advanced options list holds older kernel versions, which is the quick answer when a kernel update broke the display or a driver. The table pairs four needs at the help desk with the place to go and what you will see there:

The offset in journalctl -b -1 is the systemd manual’s own example of “the boot before last”, which for a machine you just restarted is the failed one. Deeper repair, such as rebuilding GRUB or checking a file system, belongs to the Linux track; at the help desk the aim is to get a user working or to bring back a precise description of where the start stops.

Practise: the first tool for a start-up failure

The rules of the first section fit in one function: look at how far the start got, whether a key is asked for and whether the trouble followed an update, and return a single tool. Write first_tool(facts) for a PC, a Mac and a Linux desktop. The rule order matters: the key prompt comes before everything, because nothing else gets past that screen, and an unknown value raises an error, so a typo never selects a tool.

def first_tool(facts):
    """Return the first recovery tool to try for one start-up failure."""
    return "winre-startup-repair"

from first_tool import first_tool

BASE = {"os": "windows", "reached": "logo", "key_prompt": False, "boot_files_missing": False, "after_update": False}


def test_a_key_prompt_comes_before_everything():
    """asks for the recovery key whatever the system and however far the start got"""
    assert first_tool(dict(BASE, key_prompt=True)) == "recovery-key"
    assert first_tool(dict(BASE, os="mac", reached="firmware", key_prompt=True)) == "recovery-key"


def test_windows_that_never_reaches_a_logo():
    """sends a Windows PC that stops in the firmware to firmware setup"""
    assert first_tool(dict(BASE, reached="firmware")) == "firmware-setup"


def test_windows_with_missing_boot_files():
    """starts from recovery media when the boot configuration data is missing"""
    assert first_tool(dict(BASE, boot_files_missing=True)) == "recovery-media"
    assert first_tool(dict(BASE, boot_files_missing=True, after_update=True)) == "recovery-media"


def test_windows_that_fails_after_the_logo():
    """undoes the recent change after an update and runs startup repair otherwise"""
    assert first_tool(dict(BASE, after_update=True)) == "winre-undo-recent-change"
    assert first_tool(BASE) == "winre-startup-repair"


def test_windows_that_reaches_sign_in():
    """uses safe mode when the failure is after sign-in"""
    assert first_tool(dict(BASE, reached="sign-in")) == "safe-mode"


def test_macs_and_linux():
    """picks the Mac and Linux tools by how far the start got"""
    assert first_tool(dict(BASE, os="mac", reached="sign-in")) == "mac-safe-mode"
    assert first_tool(dict(BASE, os="mac", reached="logo")) == "mac-recovery-first-aid"
    assert first_tool(dict(BASE, os="linux", reached="firmware")) == "firmware-setup"
    assert first_tool(dict(BASE, os="linux")) == "grub-older-kernel"


def test_unknown_values_are_refused():
    """raises ValueError for an os or a stage it does not know"""
    for bad in (dict(BASE, os="beos"), dict(BASE, reached="halfway")):
        try:
            first_tool(bad)
        except ValueError:
            continue
        raise AssertionError(f"first_tool({bad}) should raise ValueError")

The self-check that follows asks about the stages, the WinRE triggers, the order of the tools and the defaults of quick machine recovery, with a reason on every answer.

Interview questions

Warm-up (fresher): a user says their laptop “opened a blue menu by itself”. Is something wrong with it?

Not necessarily. Windows opens its recovery environment automatically after two consecutive failed starts, two unexpected shutdowns shortly after starting, or a Secure Boot error, and the trigger is a flag that is not cleared, not a diagnosis. A power cut during a healthy start can set it. I would ask what happened just before, let Automatic Repair finish, and restart once; if it comes back, the next tools are in the menu. I would also check that a BitLocker recovery key can be retrieved before trying anything, because most WinRE options ask for it.

Warm-up (fresher to 2-5 years): in what order do you try the recovery tools on a Windows 11 PC that will not start?

From the one that changes least. Point-in-time restore on Windows 11 24H2 or later if a restore point from the last 3 days exists, then Uninstall updates if an update started the trouble, then Reset this PC, then reinstalling from recovery or installation media. System Restore covers older restore points, and safe mode is a way to look rather than a repair. Each step down loses more of the user’s setup, so I stop at the first one that works and write down which it was.

Two harder calls follow, one about a whole floor of laptops and one about a Mac with unsaved work. Decide your first move and the reason before you open the model answer:

Key takeaways

• A failed start has a place on the boot path, from firmware through the boot manager, loader, kernel and drivers to sign-in, and the stage of the symptom decides which tool to try first.
• Windows sets a flag at the start of a boot and clears it before sign-in, so two failed starts open WinRE by themselves, and a power cut can open it too.
• Most WinRE options need the BitLocker recovery key, so the key has to be retrievable before the PC is in recovery.
• In WinRE work from the least disruptive tool: point-in-time restore on 24H2 or later, Uninstall updates, then Reset this PC or recovery media, with safe mode as a way to look.
• Quick machine recovery lets a Windows 11 PC fetch a fix from Windows Update after repeated failed starts; it is on by default for Home and unmanaged Pro and off by default on managed devices.
• A Mac is handled in order: safe mode, then Recovery with First Aid, then a reinstall that keeps files, and a Linux desktop starts from the GRUB menu and journalctl -b -1.