Windows Diagnostic Glossary
Essential Windows diagnostic terms, tools, and commands explained. Each entry links to related troubleshooting guides, automated repairs, and error code references.
Blue Screen of Death(BSOD)
A critical system error screen displayed by Windows when a fatal kernel-level failure occurs. The blue screen shows a stop code that identifies the type of failure.
BSODs are caused by driver conflicts, hardware failures, corrupted system files, or memory errors. The stop code (e.g., CRITICAL_PROCESS_DIED, IRQL_NOT_LESS_OR_EQUAL) identifies the root cause.
Deployment Image Servicing and Management(DISM)
A Windows command-line tool that services Windows images and repairs the component store. DISM can fix corruption that SFC cannot repair on its own.
DISM /Online /Cleanup-Image /RestoreHealth downloads fresh copies of corrupted components from Windows Update. It is the prerequisite repair step before running SFC.
System File Checker(SFC)
A built-in Windows utility (sfc /scannow) that scans and repairs protected system files by replacing corrupted copies with cached originals from the component store.
SFC relies on a healthy component store (WinSxS). If the component store itself is corrupted, DISM must be run first. SFC is one of the most commonly recommended Windows repair steps.
Check Disk(CHKDSK)
A Windows utility (chkdsk /f /r) that scans hard drives and SSDs for file system errors, bad sectors, and metadata corruption. It can repair logical file system issues.
CHKDSK is critical for diagnosing disk-related BSODs, slow performance, and file access errors. The /r flag also checks for bad physical sectors. Runs at next boot on the system drive.
Windows Management Instrumentation(WMI)
The Windows infrastructure for managing system data and operations. WMI provides a standardized interface for scripts, management tools, and enterprise platforms to query system information.
WMI corruption causes SCCM/Intune failures, broken PowerShell queries (Get-WmiObject), high CPU from WmiPrvSE.exe, and Event Viewer errors (ID 10, 13). The repository can be salvaged or rebuilt.
Background Intelligent Transfer Service(BITS)
A Windows service that manages asynchronous file transfers between machines using idle network bandwidth. Windows Update, Microsoft Store, and SCCM all depend on BITS.
When BITS fails, Windows Update downloads hang at 0%, Store apps won't install, and enterprise software deployment breaks. BITS errors include 0x80070424 and stuck transfer jobs.
Windows Component Store(WinSxS)
The side-by-side assembly store (C:\Windows\WinSxS) that contains all Windows system files, manifests, and component versions. It is the source SFC uses for repairs.
Component store corruption prevents Windows Update, SFC, and optional feature installation. DISM /RestoreHealth repairs it by downloading fresh components. The folder can grow large but should not be manually deleted.
Boot Configuration Data(BCD)
A firmware-independent database that stores boot-time configuration for the Windows Boot Manager. It replaced the legacy boot.ini file starting with Windows Vista.
BCD corruption causes boot failures, boot loops, and "missing operating system" errors. The bcdedit command manages BCD entries. bootrec /rebuildbcd can repair a damaged BCD store.
Windows Update Agent(WUA)
The client-side component of Windows Update that detects, downloads, and installs updates. It works with BITS, Cryptographic Services, and the SoftwareDistribution folder.
WUA failures cause update errors (0x80070005, 0x80240034, 0x80070643), stuck downloads, and failed installations. Resetting the SoftwareDistribution folder and restarting update services usually resolves issues.
Print Spooler
A Windows service (spoolsv.exe) that manages print jobs by queuing them in memory and sending them to the printer. It handles print queue management and driver communication.
Print Spooler crashes cause "Printer Offline" errors, stuck print jobs, and inability to add new printers. Clearing the spool folder (C:\Windows\System32\spool\PRINTERS) and restarting the service usually resolves issues.
Winsock
The Windows Sockets API — the interface between Windows networking applications and the underlying TCP/IP protocol stack. Winsock catalog corruption breaks all network connectivity.
"netsh winsock reset" rebuilds the Winsock catalog to its default state. This fixes "connected but no internet" issues, DNS resolution failures, and applications unable to reach the network.
Device Manager
A Windows MMC snap-in (devmgmt.msc) that displays all hardware devices and their driver status. Yellow warning icons indicate driver problems; red X icons indicate disabled devices.
Device Manager is the primary tool for diagnosing driver issues, updating drivers, rolling back problematic driver updates, and disabling/enabling hardware. Error codes in Device Manager (Code 10, 28, 31, 43) indicate specific driver failures.
Windows Registry
A hierarchical database that stores configuration settings for Windows, applications, hardware, and user preferences. Organized into hives (HKLM, HKCU, HKCR, HKU, HKCC).
Registry corruption causes system instability, broken services, incorrect default apps, and boot failures. The Registry Editor (regedit) should be used cautiously — incorrect edits can prevent Windows from booting.
Safe Mode
A Windows diagnostic startup mode that loads only essential drivers and services. Safe Mode is used to troubleshoot problems that don't occur with minimal drivers loaded.
If a problem disappears in Safe Mode, it's caused by a third-party driver, service, or startup program. Safe Mode with Networking adds network support. Access via Settings > Recovery or by holding Shift + Restart.
System Restore
A Windows feature that creates snapshots (restore points) of system files, drivers, and registry settings. Restoring to a previous point reverts system changes without affecting personal files.
System Restore is critical for recovering from bad driver updates, failed Windows updates, and software installations that break the system. RescuePC creates a restore point before every repair.
Event Viewer
A Windows MMC snap-in (eventvwr.msc) that displays detailed logs of system events, application errors, security audits, and service failures. Essential for diagnosing intermittent issues.
Event Viewer logs are organized into Application, Security, System, and Setup channels. Critical and Error events (red icons) identify the exact time, source, and error code of failures. Filter by Event ID for targeted diagnosis.
Task Manager
A Windows system monitor (taskmgr.exe or Ctrl+Shift+Esc) that displays running processes, CPU/memory/disk/network usage, startup programs, and services.
Task Manager is the first-line diagnostic tool for performance issues. The Details tab shows per-process resource usage. The Startup tab controls auto-start programs that slow boot time.
Windows Subsystem for Linux(WSL)
A compatibility layer that enables running Linux binary executables natively on Windows. WSL 2 uses a real Linux kernel in a lightweight VM for better performance and compatibility.
WSL requires the Virtual Machine Platform and Windows Subsystem for Linux optional features enabled. Issues include WSL not starting, distro installation failures, and networking problems inside WSL.
Hyper-V
Microsoft's native hypervisor for running virtual machines on Windows. Hyper-V is available on Windows 10/11 Pro, Enterprise, and Education editions.
Hyper-V requires hardware virtualization (VT-x/AMD-V) enabled in BIOS. It conflicts with some third-party hypervisors (VirtualBox, VMware older versions). WSL 2, Windows Sandbox, and Docker Desktop all depend on Hyper-V.
Group Policy(GPO)
A Windows management infrastructure that controls user and computer settings via policies. Available on Pro/Enterprise editions via gpedit.msc (Local Group Policy Editor).
Group Policy affects Windows Update behavior, security settings, user restrictions, and application configurations. Enterprise environments use Active Directory GPOs for centralized management.
Explore by Topic
Browse all troubleshooting guides organized by category: