Clean Boot Troubleshooting: Isolating a Bad Startup Item

When Windows starts slowly, freezes after sign-in, shows repeated error messages or behaves unpredictably, the cause is not always Windows itself.

A third-party service, tray application, hardware utility, security tool or update helper may be loading automatically and interfering with the system. The difficult part is identifying which one.

A clean boot starts Windows with Microsoft services and essential drivers while temporarily disabling most third-party startup software. This creates a controlled environment that helps determine whether a background application is causing the problem.

It is one of the most useful diagnostic techniques available in Windows—but it needs to be performed methodically.

What Is a Clean Boot?

A clean boot is a troubleshooting startup state.

Windows still loads normally, but non-Microsoft services and startup applications are disabled. This removes many background programs from the equation without forcing Windows into Safe Mode.

A clean boot can help investigate:

• Slow startup or sign-in
• Freezing shortly after the desktop appears
• Applications crashing at launch
• Unexpected pop-ups
• High processor or memory use
• Audio, printing or network conflicts
• Installer failures
• File Explorer instability
• Search, Start menu or taskbar problems
• Errors that appear only after Windows finishes starting

The clean boot itself does not fix the problem. It helps prove whether a startup item is involved.

Clean Boot Versus Safe Mode

Clean boot and Safe Mode are not the same.

Safe Mode

Safe Mode starts Windows with a reduced set of drivers, services and visual features. It is useful when Windows cannot start normally or when a driver appears to be causing a serious problem.

Clean boot

A clean boot uses the normal Windows interface and standard Microsoft components, but disables most third-party services and startup applications.

This makes clean boot more useful when the computer works but becomes unstable after sign-in.

A problem that disappears during a clean boot is likely connected to a disabled application or service. A problem that continues may involve Windows, a driver, hardware or the user profile.

Before You Begin

Before changing the startup configuration:

• Save open work
• Make sure you know the administrator password
• Record any important business applications running in the background
• Take screenshots of current settings if helpful
• Create a restore point where appropriate
• Make sure BitLocker recovery information is available on managed devices
• Do not disable security or management tools on a business computer without approval

Some software relies on background services for licensing, encryption, backup, remote access or device management. These may stop temporarily during testing.

Step 1: Open System Configuration

Press:

Windows + R

Enter:

msconfig

Select OK.

The System Configuration window will open.

On the General tab, leave Selective startup selected. Do not manually clear essential boot options unless a support engineer has advised you to do so.

Step 2: Hide Microsoft Services

Open the Services tab.

This is the most important step in the process.

Select:

Hide all Microsoft services

Once Microsoft services are hidden, review the remaining entries.

These are generally services installed by third-party applications, hardware manufacturers or management tools.

Now select:

Disable all

Do not select Disable all before hiding Microsoft services. Disabling essential Microsoft services can create additional problems.

Select Apply, but do not restart yet.

Step 3: Disable Startup Applications

Open the Startup tab in System Configuration and select:

Open Task Manager

Task Manager will display the applications configured to start automatically.

Disable each enabled startup application:

1. Select an item.
2. Choose Disable.
3. Repeat for the remaining enabled entries.

Typical startup items include:

• Cloud storage clients
• Chat applications
• Printer utilities
• Hardware control panels
• Update assistants
• Game launchers
• Audio enhancement tools
• Remote-access software
• Manufacturer support utilities
• RGB lighting software
• Clipboard or productivity tools

Disabling an item here does not uninstall it. It only prevents it from starting automatically during the test.

Close Task Manager and return to System Configuration.

Step 4: Restart Windows

Select OK in System Configuration and restart the computer.

Windows should now start in a clean boot state.

Use the computer normally and attempt to reproduce the original problem.

For example:

• Open the application that was crashing
• Test File Explorer
• Try printing
• Connect to Wi-Fi
• Wait for the point when the computer normally freezes
• Run the installer that previously failed
• Check whether the error message returns

Allow enough time for a meaningful test. Some faults appear immediately, while others occur only after the system has been running for a while.

What the Result Tells You

The problem disappears

This strongly suggests that one of the disabled services or startup applications is responsible.

The next task is to identify which one.

The problem remains

The cause is less likely to be a standard third-party startup item.

Possible alternatives include:

• A Windows component
• A device driver
• Hardware failure
• User-profile corruption
• Storage problems
• Malware
• A scheduled task
• A browser extension
• Damaged system files
• A problem inside the affected application itself

You can still use the clean boot result to rule out a large group of possible causes.

The Fastest Way to Find the Bad Item

Do not re-enable every item one at a time from the beginning. That can take a long time.

Instead, use a process of elimination.

Re-enable half of the disabled services

Return to:

msconfig > Services

Make sure Hide all Microsoft services remains selected.

Enable approximately half of the disabled services, then restart and test again.

If the problem returns

The bad service is probably in the half you just enabled.

Disable half of that group and test again.

If the problem does not return

The bad service is probably in the half that remains disabled.

Enable half of that remaining group and continue testing.

This divide-and-test approach can identify the culprit much faster than checking every entry individually.

Use the same method for Task Manager startup applications.

Keep a Testing Record

Clean boot troubleshooting can become confusing if there are many services and applications.

Record:

• Which services were enabled
• Which startup items were enabled
• Whether the problem occurred
• How long the test ran
• What action triggered the problem
• Any error message displayed

A simple table can prevent repeated tests and mistaken conclusions.

For example:

This narrows the issue to a much smaller set.

Services and Startup Apps Must Be Tested Separately

Do not assume that every automatic program appears in only one place.

Some applications use:

• A Windows service
• A Task Manager startup entry
• A scheduled task
• A browser extension
• A shell extension
• More than one of these at the same time

For clearer results, isolate the categories.

One approach is:

1. Keep all startup applications disabled.
2. Test third-party services in groups.
3. Once services are ruled out, leave them enabled.
4. Test startup applications in groups.

This makes it easier to identify the exact source.

Common Offenders

Many different programs can cause startup conflicts, but common examples include:

Antivirus and security software

Third-party security software operates deeply within Windows and may conflict with:

• Updates
• Applications
• Network traffic
• File access
• Other security products

Never leave business protection disabled after testing.

Printer and scanner software

Old printer utilities can cause:

• Slow login
• Explorer delays
• Spooler errors
• Application freezes
• Pop-ups about unavailable devices

The printer driver may still work even if an unnecessary tray utility is removed.

Audio enhancement software

Audio suites installed by hardware manufacturers can interfere with:

• Sound playback
• Conferencing applications
• Sleep
• Bluetooth
• Microphone access
• System stability

Hardware monitoring and control tools

Fan-control, overclocking, temperature-monitoring and lighting applications may conflict with drivers or firmware.

Cloud-sync applications

Damaged or outdated sync clients can create:

• High processor usage
• File Explorer delays
• Sign-in loops
• Constant disk activity
• Duplicate notifications

Application update helpers

Some applications install separate services purely to check for updates. These may continue running even when the main application is closed.

Legacy business software

Older software may load background components designed for earlier versions of Windows. These can fail after updates or driver changes.

Check the Publisher and File Location

When a suspicious service has been identified, do not delete it immediately.

Research what it belongs to.

In Task Manager, right-click the startup item and use options such as:

• Open file location
• Properties
• Search online, where available

For services, examine:

• Service name
• Display name
• Manufacturer
• Executable path
• Related installed application

Be cautious when a service has:

• No publisher
• A strange name
• An unusual path
• An executable inside a temporary folder
• A file located within a user’s Downloads folder
• Deliberately misspelled system-style naming

These signs do not automatically prove malware, but they justify further investigation.

What to Do After Finding the Culprit

Once you identify the problematic item, you have several options.

Update it

Install the latest supported version from the developer or hardware manufacturer.

This is often the best fix when the problem began after a Windows update.

Repair the application

Open:

Settings > Apps > Installed apps

Select the application and look for Modify, Repair or Advanced options.

Reconfigure it

Some software allows you to disable:

• Automatic startup
• Hardware acceleration
• Background updates
• Overlay features
• Shell integration
• Automatic scanning
• Notifications
• Device monitoring

Turning off the troublesome feature may allow the rest of the application to remain installed.

Reinstall it

Uninstall the application, restart Windows and install a fresh copy.

Before doing so, back up any local settings, templates, licences or data associated with it.

Remove it

If the software is unnecessary, unsupported or no longer used, uninstalling it may be the safest choice.

Do not remove business-critical applications, management agents or security software without checking their purpose.

How to Return Windows to Normal Startup

After testing, restore the normal configuration.

Open:

msconfig

On the General tab, select:

Normal startup

Alternatively, return to the Services tab and re-enable the required services manually.

Open Task Manager and re-enable the startup applications that should load automatically.

Restart the computer.

Confirm that:

• Security software is running
• Backup services have resumed
• Cloud-sync tools are connected
• Printers work
• VPN and remote-access software function
• Business management tools have restarted
• The original problem remains resolved

Do not leave the computer permanently in an undocumented clean boot state.

A Service Will Not Start Again

If a service was disabled in System Configuration and does not resume:

1. Open msconfig.
2. Re-enable the service.
3. Restart Windows.
4. Open services.msc.
5. Locate the service.
6. Check its startup type.
7. Start it manually where appropriate.

Some services are set to Manual or Automatic (Trigger Start) and may not run continuously. That is normal.

Do not force every service to Automatic.

Clean Boot Does Not Disable Everything

A clean boot does not necessarily stop:

• Scheduled tasks
• Browser extensions
• Device drivers
• Microsoft Store background components
• Per-user scripts
• Group Policy actions
• Windows management agents
• Firmware utilities
• Malware using other persistence methods

If the fault remains, additional investigation may be required.

Check Task Scheduler

Some applications launch through Task Scheduler rather than Task Manager startup entries.

Open:

taskschd.msc

Review the Task Scheduler Library for third-party tasks that run:

• At sign-in
• At startup
• When the computer becomes idle
• At regular intervals

Do not disable unfamiliar Windows tasks at random.

Focus on tasks belonging to the software already suspected or installed around the time the problem began.

Review Reliability Monitor

Reliability Monitor can help match crashes with applications, updates and driver installations.

Search for:

View reliability history

Look for red error symbols around the dates and times the issue occurred.

Select an event to see:

• The failing application
• The faulting module
• Installation history
• Windows failures
• Driver problems
• Update activity

This can provide valuable context before or during clean boot testing.

Use Event Viewer for Repeated Failures

Open Event Viewer and review:

Windows Logs > Application

Windows Logs > System

Look for repeated errors involving:

• The suspected executable
• Service Control Manager
• Application Error
• Windows Error Reporting
• Device drivers
• Disk or file-system events

A single error may not be significant. Repeated errors at the exact time the problem occurs are more useful.

Run System File Repairs When Needed

If the problem continues even in a clean boot, check Windows system files.

Open Terminal as administrator and run:

DISM /Online /Cleanup-Image /RestoreHealth

Then run:

sfc /scannow

Restart after both commands have completed.

These tools repair Windows components, but they do not directly fix faulty third-party software.

Test Another User Profile

Startup behaviour can sometimes be specific to one user account.

If the computer works correctly in another profile, the cause may involve:

• A per-user startup entry
• Corrupt application settings
• User-specific scheduled tasks
• Shell extensions
• Registry settings
• Damaged profile data

Creating a clean test account can help distinguish between a system-wide conflict and a profile-specific one.

When a Clean Boot Is Not Appropriate

Do not rely on clean boot troubleshooting when:

• The computer cannot start normally
• The disk is failing
• Windows repeatedly crashes before sign-in
• BitLocker recovery is already being requested
• There are signs of active ransomware or data loss
• The device is controlled by an organisation and changes are restricted
• Essential remote-access software must remain running
• The problem clearly began after physical damage

In these situations, Safe Mode, hardware diagnostics, recovery tools or professional support may be more appropriate.

A Sensible Clean Boot Process

Use this order:

1. Record the original symptoms.
2. Back up important work.
3. Hide Microsoft services.
4. Disable remaining third-party services.
5. Disable startup applications.
6. Restart and reproduce the problem.
7. Re-enable items in halves.
8. Test after every change.
9. Identify the specific application or service.
10. Update, repair, reconfigure or remove it.
11. Restore normal startup.
12. Verify that security and business services are running.

The key is controlled testing. Changing multiple unrelated settings at once makes the result much harder to interpret.

Need Help Identifying a Problem Startup Item?

A clean boot can reveal whether third-party software is causing slow startup, crashes or instability, but identifying the exact service is often time-consuming. On business computers, disabling the wrong application can also interrupt security, backups, remote management or Microsoft 365 services.

Hamilton Group can diagnose Windows startup problems, isolate conflicting software and apply a permanent fix without unnecessarily rebuilding the computer.

Call 0330 043 0069 or visit hgmssp.com to speak with one of our IT experts.