An old primary school friend has asked me to look at a 2021 desktop PC with a 4 minute boot up time. There are no saved restore points. The problem was first noticed after the 12 year old grandson had downloaded some games.
I have run a check with malwarebytes which was installed and windows shows it is up to date with security. It is a bit slow loading programs but chrome works as do video and audio files.
I have removed Roblox and Discord from the start up menu.
I'm thinking a back up of files and re install is called for but need advice, I haven't used windows for 20 years and am used to just backing up Home in Linux.
Is appears to be a March 2021 shop installed Windows 10 home 22H2 edition. Asus motherboard and a pentium G3320 3GHz processor with 8GB of ram booting with UEFI windows boot manager.
Also I have some much older windows back ups done with a program called Ghost. Is there a way of unzipping the files without Ghost?
A Pentium G3320 is from the year 2013. If the motherboard is UEFI,
it's an earlier version of UEFI, but should still work. There won't be
a TPM (just a header to plug it in, on consumer devices of that era).
The TPM available at the time might have been version 1.4 or so.
In the WinXP era, there was Bootvis, which was a tool humans could use.
You could get a bootup trace from it.
The tools now are like this, but even this may have been
discontinued at some point.
I:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\xbootmgr.exe <=== trace capture
I:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\xperf.exe <=== view the trace graphical output
You could make a folder anywhere for output, and C:\TEMP is being used here.
This should cause the machine to reboot, and do a trace of activity.
xbootmgr -trace boot -traceFlags BASE+CSWITCH+DRIVERS+POWER -resultPath C:\TEMP
*******
If that requires WADK, don't panic. There should be a dialog with tick
boxes, and all that needs to be ticked in the download suite, is the
Windows Performance Toolkit or similar. The other parts of WADK are independent
and not needed. It should only take five minutes to download the utilities,
and check to see if xbootmgr and xperf are in that version.
https://www.elevenforum.com/t/analysing-boot-behaviour-something-is-slowing-down-windows-loading-by-at-least-30-seconds.11825/
The problem with WPA as a tool, is it reboots the machine a whole bunch of times
and collects a lot of traces. It's an IT tool for evaluating performance, and
it isn't all that prepared for "the little people", the end users, to get a simple
answer. It does have the advantage that the viewing tool, if you open a trace
like from xbootmgr, it has potentially richer graphics. The trick if using
that, is there are triangle icons on the display and when you "twiddle" one,
it opens up a pane with some information in it. I missed that at first,
and couldn't figure out where my output was supposed to be.
The baffling ones, are when there is a 50 second slice of time
on the screen, with no activity at all from anything. That seems
to involve a scan of system memory by some process, like perhaps
it is encrypting system memory or initializing system memory.
When there is no activity in view, it's pretty hard to "blame" a process.
That's a limitation of the concept. But as long as an activity is a
"visible" one, such as something a rogue game could be doing, that
may leave footprints on the screen as to who is doing it.
Long delays at boot, can be due to permanently mounted file
shares, and the file share is no longer available. That can cause
a ten minute delay at startup. But we know it isn't that.
It could be CHKDSK, but we know that has a specific screen output,
and you would know it was going on.
Another way to do a boot trace, is with Sysinternals Process Monitor.
But I've had some degree of trouble getting that to start and
do the trace at startup. That leaves a DLL like "procmon23.dll"
as a hidden file in System32. Using "dir /ah" in Command Prompt,
when cd'ed to System32, might help you see that it is present. The
program does not have a means to remove it. Normally, it does no harm
sitting there. That is just so you have some idea, how it can be
doing a boot trace, right after autochk or so. Autochk is just before
the C: partition mounts.
*******
If the previous section made your eyes glaze over, there are
easier things to attempt, with less assurance of perfection
as a result. There is "Repair Install" as an attempt at a solution.
Start : Run : winver.exe
That's a program that shows you the current Windows version. Maybe
it is Win10 22H2 19045.xxxx or so. If you have the ISO file for the
installer DVD, you can right click the ISO and select "Mount". when the
virtual DVD drive appears in File Explorer or Disk Management, you
can run "setup.exe" off the root level of the virtual DVD, and
that kicks off a Repair Install. You would want to "match" the version
of OS. If Winver reported 22H2 as the version, then the current
download of Win10 materials is also 22H2. I usually change the
file name on my ISO files, so I know which one is 22H2. Sometimes,
the tools make a file "Windows.iso" which tells us nothing.
I change the name to "windows10-22H2-x64.iso".
Doing a Repair Install, should report it is keeping your Programs
and your User Data. It will try to do Windows Update, to at least
make the Windows Update components current. Even if you think
the OS is up to date, the stupid thing will waste time updating.
Then, finally, it will run the install. You need maybe 40GB of
slack space on C: , for a Repair Install to take place. There
will be a C:\Windows.old folder if the installation was
successful, and you don't throw that folder away by hand.
The second level of Cleanmgr.exe can remove it. I prefer to use
a system tool for this, because there have been a couple nasty
bits of business in C: on some older versions of Win10, that a manual
command will foul up (unprintable UTF-8 characters).
That is typically a "least effort" approach to repair, for an end user.
You don't have to know how to do anything, except click the "Setup.exe"
on the virtual DVD and run it. On the other hand, it doesn't remove
Malware, and it doesn't flush garbage out of the Registry particularly.
It's also possible you could receive a warning to remove a program
or two, if they are a known source of mischief at the beginning of
the install. For example, I removed VirtualBox 5 and installed VirtualBox 6
to get past one of those warnings.
Summary: A Repair Install is the less adventurous way to try to fix it.
Other methods, have a learning curve, but at least you should
know there are some things that an intermediate level person
can do.
You do a Repair Install from a running OS. If the OS won't run
at all, that is no longer an option for you. Doing it from Safe Mode,
there might not be enough subsystems running for that to work.
To use Task Manager to analyze what is going on, sure, that's a
good suggestion "if you know what normal looks like". It's not always
easy to spot stuff which is totally off the wall in there. If you see
six "run something or other" in there, is that normal ? To be honest
with you, I don't know the answer, but I've seen that. Some activities
do not seem normal, but they are likely just regular maintenance.
Paul