Boot issues on 2 year old build...Any further suggestions?

GaryP

Helping my son with his two year old gaming pc build. He recently got a ...\efi\microsoft\boot\cipolicies...\.cip (I left off a lot of the text in the filename) is corrupt. Several reinstalls of Windows, including a complete hard drive wipe and fresh install and the problem came back. This time however I didn't try and go through all the DOS commands to rebuild the master boot record. The computer did lock up twice when the computer went into sleep mode and wouldn't come out of it. Since then I've turned off Sleep mode and Display sleep. I have been able to update the BIOS to the latest version.

Current equipment includes: ASUS X570 Tuf Gaming motherboard with WiFi, AMD Ryzen 7 3700 processor, 32GB Gskill RAM, Samsung Evo 1TB SSD, Corsair cooling System, Corsair gaming keyboard, Steel Series mouse, StreamDeck

The problem mainly occurs during startup. The initial TUF logo appears, keyboard and mouse lights go on. Logo disappears, keyboard and mouse lights go off, machine freezes. I'll shut down and restart and mostly it boots up completely. I have run the bootlog and the following lines seem to be where things go awry:

BOOTLOG_LOADED \SystemRoot\System32\drivers\disk.sys

BOOTLOG_NOT_LOADED @hal.inf,%acpi_amd64.devicedesc%;ACPI x64-based PC

BOOTLOG_NOT_LOADED @oem17.inf,%devicedescription%;NvModuleTracker Device

BOOTLOG_NOT_LOADED @cpu.inf,%amdppm.devicedesc%;AMD Processor

BOOTLOG_NOT_LOADED @msports.inf,%*pnp0500.devicedesc%;Communications Port

BOOTLOG_NOT_LOADED @oem19.inf,%nvidia_dev.1e84.4001.1458%;NVIDIA GeForce RTX 2070 SUPER

Originally, I thought this was a software issue with Windows, now I'm leaning toward hardware or driver issue. I've updated all the drivers I've been able to from the manufacturer's sites, but am still getting these log entries. Also, no new hardware has been added.

My question is does anyone have any suggestions of diagnostic software that is free and I can run here, or ideas as to what is going on. The nearest MicroCenter is 100 miles from my house, so I'd like to do as much as I can before taking it in, but I'm getting to the end of my skills. This was our first gaming build and most of my working background was with end user training a long time ago (I use to teach intro to DOS to company employees if that gives you any idea how old my knowledge is).

Appreciate any advice or insights the community can share. Gary

GoatForHire

If you have clean installed Windows and ensured all drivers are up to date, that really rules out it being software related.

You'd probably want someone to diagnose the PC in person cause this is going to point to hardware.

PowerSpec_MikeW

@GaryP

We need to isolate the problem. You said you noticed issues on sleep, so lets kill hibernate and see if it's related to S4. See if the issue still happens on startup if you're not coming out of S4, and instead coming out of S5.

From elevated command prompt type: powercfg -h off

Second, lets see what you have in this folder: C:\Windows\System32\CodeIntegrity\CiPolicies

Third, and I might hold off on this. In search type 'core' and turn off memory integrity. I suspect this may bypass the issue entirely, but if so I'd still like to get to the bottom of what's exactly causing this. It sounds like you're probably pulling some drivers from Windows Update, memory integrity is auto enabling and you're running into this issue. That's my first theory at least.

GaryP

OK, Ran the powercfg command as an administrator. Went into Settings and changed to hibernate in 3 minutes. Computer hibernated after 3 min. Pressed keys to wake...nothing worked. Had to power down. Computer didn't power back up. After several tries got the Repair screen and the *,cip was corrupt. Used advanced troubleshooting from Repair screen to boot to Safe Mode. It booted to safe mode. Went to Power and restarted. Computer started fine.

Went into CiPolicies Folder. There were three folders (Active, Internal, Staged). All were empty.

Thoughts?

GaryP

Update...Stepped away from the computer and forgot to change the power setting to never sleep. Computer froze on sleep. Restarted via Power button on PC and started up without issue. Boot log still shows all issues from my first post.

PowerSpec_MikeW

@GaryP

Sounds like it's not just S4, must be S3 as well. System has never frozen or BSOD apart from when it's either powered on or in sleep, correct?

Check the contents of this folder: C:\Windows\Boot\EFI\CIPolicies\Active

GaryP

https://community.microcenter.com/discussion/comment/42930#Comment_42930

Correct. Only those two things freeze it and can cause BSOD. Active folder has three CIP files from 6/13/2022 all dated at 10AM.

Question: I'm not familiar with S4, S3, etc. After some brief reading and learning that it refers to sleep states, I'm left wondering if this is a software issue with Windows or some type of hardware issue with the motherboard or power supply. I'm probably getting ahead of myself.

PowerSpec_MikeW

@GaryP

Sounds normal. Please post the size of the files.

Also, run bluescreenview and screenshot the results: https://www.nirsoft.net/utils/bluescreenview-x64.zip

That might give us some information as well. It almost sounds like on wake it can't read the HDD, but it's odd that it's consistently settling on the CIPolicies. I'm wondering if this is partially cached and that's creating an issue. Are you on Windows 10 or 11?

To address your question, the blue screen logs may help. Generally software failures are consistent, and hardware failures are not. I'm leaning towards hardware at this point but the memory dumps if present would really help.

GaryP

Two files are 11KB and one is 28KB. We are running Windows 11.

I tried running the bluescreenview program but it was looking for a Minidump folder, but there doesn't seem to be a folder on the hard drive with that name. I did a search of dmp files on my drive and found these:

Will any of these dmp files provide any insights?

PowerSpec_MikeW

@GaryP

You have a dump file, which can be parsed with windbg. One more question and one thing we may try. You said you've reinstalled several times. Have you tried testing for the freeze before you connect to the internet?

Second, I'm leaning towards a drive issue given the issue and the lack of minidumps. is there any chance you have another SSD or HDD you can install an OS on to test?

GaryP

i do have a spare SSD, not the right size though. Are you suggesting cloning the hard drive and then running off the clone, or a fresh install on a different hard drive?

As for testing before connecting to the internet...No, haven't tried that. I could unplug the ethernet and try that way. Would that work as a test?

PowerSpec_MikeW

@GaryP Yes and yes.

GaryP

OK did the tests.

Disconnected network cable and started PC. Got the same startup issue. Had to reboot till I got the Repair screen. Booted to Safe Mode and then restarted. On the second restart the computer came up just fine.

Created a clone of my hard drive. Installed and started PC. Got the same issues on startup as listed above. When I did get into Windows I set the hibernate mode to 1 & 5 minutes. Tested both times and was able to wake from sleep mode using both the mouse and keyboard.

So, with the new clone hard drive the hibernate mode problem goes away, but the initial boot startup hasn't changed (with or without internet).

Sounds like we have two separate issues?...one hard drive, and one something else.

Next steps?

PowerSpec_MikeW

@GaryP

Could be some corrupted data cloned over. Can you try a clean install on the new HDD?

GaryP

yes, will do and report back

GaryP

Tried a clean install on my spare HDD. The hibernate issue dis not reappear. The startup problem is still there. During the install I did encounter a few problems that required starting over or rebooting. Two errors that came up were a problem with NETWTW08.SYS and "Kmodule expecption not handled". Eventually I was able to fully install Windows and tried the system without loading any additional programs or drivers. Same startup issue. I then installed all necessary Windows Updates and the problem remained.

PowerSpec_MikeW

@GaryP

BSOD on install, sounds like random instability. Lets create a bootable flash drive with memtest86 and test the RAM: https://www.memtest86.com/

GaryP

Currently running 60% complete on Pass 2 of 4. So far no errors. It has taken over an hour and half to get to this stage. Should I run the entire 4 passes?

PowerSpec_MikeW

@GaryP

No, I think we would of seen something by now if memory were a factor. Lets check some BIOS settings. Is secure boot enabled? It most likely is not. You'll find the setting under Boot and Secure Boot. Should be set to "Other OS" if it's off. Also, lets go under advanced and see if TPM is enabled. You wouldn't have been able to install if it weren't. It'll be listed as Firmware TPM. Try switching it to 'discrete TPM' and see if you can boot normally.

Beyond that, lets use the clue we have from the KMODE Exception. I don't recall where the setting is, but lets try to disable the ethernet controller in the BIOS and see if that has any effect.

Edit: Actually disable the wireless controller. Realtek LAN controller on that board, NETWTW08.SYS is an Intel network adapter. It'd be the wireless card on that board.

GaryP

Secure Boot was listed as "User", Platform Key was "Loaded" and OS Type was set to "Windows UEFI mode"

Set TPM to discrete and booted it several times. It started fine once or twice on the first try, once on the second try and had Repair mode once.

I looked around on the BIOS screen but didn't see an ethernet controller. The KMODE only came up once that I recall. It may have been while I was trying to boot to Safe Mode or restarting from Safe Mode.

PowerSpec_MikeW

@GaryP

"Windows UEFI Mode" means in enabled in user mode. Set that to "Other OS" and see if the problem persists.

GaryP

Switched to "Other OS". Same boot up issue.

PowerSpec_MikeW

@GaryP

This should have been covered earlier but lets try it a different way. Control Panel - Hardware and Sound - Power Options - Choose what the power buttons do - Change Settings that are currently unavailable - Uncheck "Turn on Fast Startup".

Lets see if the issue remains. Maybe it is two different issues.

GaryP

Unfortunately, made the change but no luck.

PowerSpec_MikeW

@GaryP

Still a mystery as to why changing the drive solved the sleep issue. I assume the original drive was NVME. Was the replacement drive SATA? Or was the port it's installed in change?

One more thing going back to the KMODE BSOD. Try in the BIOS, Advanced - Onboard Device Configuration. I assume this is the ASUS X570 TUF Gaming Plus WIFI. Disable wireless and bluetooth. Try once more.

GaryP

No, actually the Boot drive was a SATA (Samsung EVO 870 SSD). There is a NVME in as storage. The replacement boot drive was a SanDisk SATA SSD.

My new problem was a mistake I made today when making the new drive. I thought I had disconnected the boot drive, but had mistakenly disconnected a data drive. When I went to make the new boot drive, Windows saw two drives that had Windows on it (My Sandisk had been used for something else and I wasn't worried about losing data on it). Unfortunately, It saw the other drive, my original boot, Long story short...My original HDD had the partition changed to inactive. When I went to install it and try and boot up, it isn't recognized. I tried reading it by connecting the drive to a SATA/USB cable and then to another computer. I can see the data on the drive, but doesn't show as Active in Disk Management and I can't change it either there or through Command Prompt. There is a bunch of user configuration info on there that we don't want to lose and I would prefer not to reformat. I tried changing the partition to Active, but received a "Not a MBR disk" message.

Is there a way to recover the drive without losing data? If need be I did run a Seagate Backup Plus on the C: this morning before I started all of this.

PowerSpec_MikeW

@GaryP

It's not MBR, it's GPT. You can confirm that from DiskPart by typing 'list disk'. Basically you need to find the windows volume letter then just type: bcdboot <letter>:\Windows

It should recreate the boot entry. Sometimes you'll get an access denied. In that case you need to mount the system partition and navigate to EFI\Microsoft\Boot and rename the BCD file so that you can write a new one, since it's denying you access to overwrite the existing one.

GaryP

Got the original HDD back and operational. Ended up having to reboot multiple times to get the computer to boot to Windows, but was finally able to get the computer back to it's original state before we started with the new HDD.

As for WiFi and Bluetooth. Disabled those before recovering the original HDD. No success.

While getting the original HDD up and running, I found a *.dmp file from yesterday. Maybe it did create the dump file but it went to a drive I couldn't get to at the time. Is there a way to attach a dmp file? I tried but it said it wasn't supported.

Looking at the first line, I do remember that coming up. I think it was during the creation of the test HDD. Here's a bit of a screen shot:

I'm really quite stumped at this point. The process is always the same when starting.

1. Logo Screen comes on with "Press Esc or F2 for startup..." text underneath
2. keyboard and mouse light up
3. Logo screen goes away and keyboard and mouse light also go out briefly.
4. Logo appears again with circling dots below.
5. Keyboard Lights come back on.
6. This is where we can go in two directions.
7. Logo disappears and screen is blank. If it is successful you get an indicator on the monitor and then the Windows screen starts to appear. The keyboard lights might go out briefly but will come right back on. If it is an unsuccessful boot, the Logo disappears and the screen goes dark, the keyboard and mouse lights go out and never come back on. It does sound like the fans kick into a higher gear if it doesn't boot up, but not totally sure.

Looking at the dump file, the second and fourth lines look familiar. They appear in my original list from my bootlog of things not loading. Driver issue?

I'm not going to be able to do any additional work today on the computer but hope to get back to it later tomorrow. I haven't said it yet, but the amount of help you have provided is Amazing and is Greatly Appreciated! Thanks.

PowerSpec_MikeW

@GaryP

Unfortunately I'm just seeing system files, it's not pointing us towards anything specific. We are at least down to a hardware problem. Lets keep ruling out what we can with that. Are you able to swap in another GPU to test?

GaryP

Yes, I can take one out of my computer and use it. It's much more basic than the 2070. I'll use the new HDD drive you had me make. I'll be able to test that Monday, most likely.

Should I keep the Secure boot at "Other OS" and the WiFi and Bluetooth to disabled, or go back to defaults and test.

PowerSpec_MikeW

@GaryP

Lets go back to defaults. Other OS should be the default though.