Disk Cleanup and Windows 10 boot Blue Screen / Critical Service Failed – Disable drivers signature enforcement, Unsigned Drivers

Quick Post & surprising follow up to the workaround for Windows 10 Critical Service Failed Boot Blue Screen (Recovering from Windows 10 boot Blue Screen, Critical Service Failed, Disable drivers signature enforcement, Unsigned Drivers)

*update 2017-05-19, found this thread on reddit with a safer fix/workaround: seems installing the new Windows creators update fixes the issue, so would advise for that first!*

Just received great feedback/hint from Eric E Swanson (see here) -while applying the described workaround successfully  (great to know!). From his reply:

“…This problem happened to me when I used the Disk Cleanup utility and removed Old Windows installations and/or Temporary Windows Update files (not sure on the exact verbage, but it was part of the list when you click on System clean up)…”

I did a few tests on my own (yes, I had that problematic folder properly backed up, and a full OS partition image also, just in case) and…

Turns out a surprising operation that can cause the Windows Critical Service Failed boot BlueScreens is really…. Windows Disk Cleanup Tool…

image

Just tested and really something strange is happening with Disk Cleanup. First time I ran it, left the default few options (sorry didn’t proper screenshot that), confirm delete, wait a few seconds, nothing. Everything still the same on C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} 4.586 files from my last restore (note: these are driver signatures that Windows checks if drivers are properly signed)

image

Ok, I don’t give up easily…. 2nd run,this time selecting Clean System Files, then leaving the only default option checked, Temporary  Files. Also strange that it mentioned ~20GB of cleaning (that folder is around ~100MB total)

image

But this time a few files were actually removed from C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} . 

image

Ok a few files removed… strange, so ran it again, same options, selecting Clean System Files, then Temporary Files. Also strange that now seems to mark only ~15GB to “clean”. Swear probably it’s the last I use this tool…..

clip_image001

So, this time, after cleanup, these were the only files left: (67 files only!) Almost the entire driver signature folder completely removed:

image

So, testing the boot right? Back to the old boot BSOD/Critical Service Again (at least that makes sense!). Now much quicker to recover, as described in previous post, just pasted the files again from a backup folder (after disable boot option, drivers signature enforcement).

Boot again with the folder recovered, no more blue screens or issues with unsigned drivers!

Even strangest, tried several times after that, even with a few reboots, can’t seem to replicate it now using Disk Cleanup. Folder steady at the 4.586 files.

After all this, also strange than I got now ~5 GB (keeps changing?) yet to be cleaned no matter how many times I try. Meantime, I can confirm I have around more ~15GB free space on the win partition. What files has cleanup removed? Don’t have a clue and it’s kinda freaking me out….. tool from hell. Smile (which btw remind me the BOFH immortal words… “Well, let’s see, you have 4 Meg available" …)

image

image

Searching online there are several help requests regarding this kind of Blue Screen , and even a few mentioning Disk Cleanup as a possible cause. (see below)

Didn’t found any official/tek details info from msft , seems lacking proper awareness & follow-up from msft support teams honestly (yes, if not already, someone should really be looking into this).

How can such annoying, frustrating boot Blue Screen  keep appearing online and being so difficult for users getting proper solution beyond the typical- format & start again? (seems also something is lacking on the startup logs/troubleshoot process, are we not in the age of big data?…)

So, hope this helps,(helped two of us any way Smile )

Rui

Similar issues mentioned online

Reddit-Windows 10 Critical Service Failed BSOD reboot loop. Boot fine with driver signature enforcement disabled.
(mentions installing creators update as a fix, better one I would say)

All System32 drivers are suddenly unsigned in Windows 10
(thread where I posted the workaround and got the Disk Cleanup hint from Eric E Swanson )

Disk Cleanup causing Windows 10 to go into BSOD loop

Windows suddenly won’t boot, “CRITICAL_SERVICE_FAILED”

Windows could not load properly after disk cleanup

Windows 10: Disk Cleanup is causing a Blue Screen

OS is going to blue screen after disk cleanup

Advertisements

Recovering from Windows 10 boot Blue Screen, Critical Service Failed, Disable drivers signature enforcement, Unsigned Drivers

In case it helps someone, worked for me in a recent very annoying BSOD in my Windows 10
(instead of a full refresh or fresh install, don’t settle easily for that, usually try to dig a little bit and see what I can find…).

*update 2017-05-19, found this thread on reddit with a safer fix/workaround: seems installing the new Windows creators update fixes the issue, so would advise for that first!*

*update 2017-05-19, please read the part II for additional info and possible issue with Disk Cleanup tool: Disk Cleanup and Windows 10 boot Blue Screen / Critical Service Failed – Disable drivers signature enforcement, Unsigned Drivers *

Please note: It’s been stable and no problem with restarts for a few days now, but not saying it’s a permanent fix or better than a clean install. Will update if something changes. (probably something on my system is triggering this and will happen again)

My advice also before testing any kind of changes or emergency repairs, keep calm, don’t make it worst, backup the data you want safe before anything else.

My setup

  • Dual boot, default Win10 enterprise and an old Win81 legacy boot partition I still use occasionally
    (ex: when I get a recurring Blue Screen on boot !), no bitlocker
  • Separated Data drive, with bitlocker
  • Win10 Build 14393.1066 Version 1607
  • Single SSD, 3 main partitions

Symptoms

  • On restart and before my dual boot selection screen I get the Blue Screen,
    detail message is Critical Service Failed
  • Image result for critical service failed windows 10
  • Suspect this usually happens after major updates, I have the bad habit of never restart and always hibernate…
  • The system is bootable if you choose the “Disable drivers signature enforcement” on the troubleshoot / AdvancedOptions / Startup settings screens (usually option 7 when you restart)
  • Image result for Disable drivers signature enforcement
  • After restart with “Disable drivers signature enforcement” windows works pretty much as normal
  • But every restart you will get the same Blue Screen as this option is not permanent (nor advised), and I end up having to do two restarts to enable the option again, better than nothing but annoying
  • Running sigverif  tool (after booting with  “Disable drivers signature enforcement” to get Windows working) showed a huge number of “not signed” drivers??
  • image
  • in Event log (Application and Services Logs > Microsoft > Windows > CodeIntegrity > Operational I see a lot of errors when windows tries to load driver signature files needed, seems suddenly all drivers are being marked as not signed and Windows won’t allow it, except for enabling the “Disable drivers signature enforcement” boot option, also errors pointing to files I don’t have in C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
  • image
  • Drivers then get marked as not signed! not good…
  • image
  • When compared to similar setup from another win10 same build, the number of files on my C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} is very low (~1600 vs ~6000 files in the working win10), only two files starting with M… on my folder?
  • image

What worked for me (use as is, as a last resource, no guarantees whatsoever, do your backups!):

After checking my win 10 build, got a zip with all the files in C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} from a “healthy and compatible donor” Smile (thx António) and pasted the missing ones on my system. Being cautious not to overwrite any file just in case and doing a backup of my folder (obviously!).

check the build numbers, *probably* they should match your win build version, ex 14393

image

Restart, now the boot selection appears, choose win10, everything working. sigverif tool now only complains about few files that seem not critical, previous Eventlog CodeIntegrity errors also clear.

Now, what I really have a hard time to accept is why do we contribute with so much data, diagnostic & logging information these days, and still no sign of minor “windows data intelligence” suggestions to help with a problem that for sure I’m not the only to experience…

Thx also to Pedro Sousa and José António Silva and our Help Desk for their tips & guidance.

Yet again I skipped that clean install! Winking smile 

Some references with similar problems

Critical_service_failed BSOD restart loop windows 10

All System32 drivers are suddenly unsigned in Windows 10

(Which reminds that one of these days I probably should share some thoughts on bitlocker, efs and …backups, do your backups! and be sure to test them!)

Rui