{"id":3796,"date":"2026-11-02T20:06:00","date_gmt":"2026-11-02T20:06:00","guid":{"rendered":"https:\/\/leinss.com\/blog\/?p=3796"},"modified":"2026-11-02T22:32:33","modified_gmt":"2026-11-02T22:32:33","slug":"bsodview-lies-and-damn-lies","status":"publish","type":"post","link":"https:\/\/leinss.com\/blog\/?p=3796","title":{"rendered":"BlueScreenView: Lies and Damned Lies"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">My Plex server running Windows 11 decided to go into a boot loop with a PAGE_FAULT_IN_NONPAGED_AREA BSOD over the weekend.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I could, however, boot into safe mode just fine. In years past, you could spam the F8 key<br>and get into safe mode, but no more. In order to get into safe mode, I had to boot to a WinPE disc and run<code> bcdedit \/set {default} safeboot network<\/code> and restarted the computer. To remove it booting into safe mode: <code>bcdedit \/deletevalue {default} safeboot<\/code>. Picking a system restore point to a few days ago did nothing to resolve the problem and for some reason, dism wasn&#8217;t playing ball with me (<em>it kept claiming it couldn&#8217;t find the installation source files for the repair<\/em>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I suspected some type of hardware problem after running BlueScreenView on C:\\windows\\memory.dmp and having it point to ntoskrnl.exe as being<br>the problem, but then AI told me that BlueScreenView can be inaccurate and to try WinDBG. Unforunately, I could not install WinDBG in safe mode, but found a way around this using this Powershell script to download and extract the WinDBG binaries:<br><a href=\"https:\/\/gist.github.com\/lzybkr\/a39f6c07be4891ee9fac6bf6eb13893e\">https:\/\/gist.github.com\/lzybkr\/a39f6c07be4891ee9fac6bf6eb13893e<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After running !analyze -v, I finally got the culprit: fortfw.sys! This is a driver from Fort Firewall, a 3rd party firewall program. I uninstalled the program in safe mode, restarted and viola, Windows now boots into normal mode without BSODing.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img data-recalc-dims=\"1\" decoding=\"async\" width=\"525\" height=\"221\" data-attachment-id=\"3797\" data-permalink=\"https:\/\/leinss.com\/blog\/?attachment_id=3797\" data-orig-file=\"https:\/\/i0.wp.com\/leinss.com\/blog\/wp-content\/uploads\/2026\/11\/blog.png?fit=898%2C378&amp;ssl=1\" data-orig-size=\"898,378\" data-comments-opened=\"1\" data-image-title=\"blog\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/leinss.com\/blog\/wp-content\/uploads\/2026\/11\/blog.png?fit=525%2C221&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/leinss.com\/blog\/wp-content\/uploads\/2026\/11\/blog.png?resize=525%2C221&#038;ssl=1\" alt=\"\" class=\"wp-image-3797\" srcset=\"https:\/\/i0.wp.com\/leinss.com\/blog\/wp-content\/uploads\/2026\/11\/blog.png?w=898&amp;ssl=1 898w, https:\/\/i0.wp.com\/leinss.com\/blog\/wp-content\/uploads\/2026\/11\/blog.png?resize=300%2C126&amp;ssl=1 300w, https:\/\/i0.wp.com\/leinss.com\/blog\/wp-content\/uploads\/2026\/11\/blog.png?resize=768%2C323&amp;ssl=1 768w\" sizes=\"(max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The lesson here is don&#8217;t rely on BlueScreenView results alone, especially if it points to ntoskrnl.exe as being the problem. You may also need to turn on full memory dumps by running sysdm.cpl>Advanced>Startup and Recovery>Settings>Write debugging information. Change to Complete Memory Dump from Small Memory Dump and then you should find MEMORY.DMP in C:\\windows.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Soli Deo Gloria<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>My Plex server running Windows 11 decided to go into a boot loop with a PAGE_FAULT_IN_NONPAGED_AREA BSOD over the weekend. I could, however, boot into safe mode just fine. In years past, you could spam the F8 keyand get into safe mode, but no more. In order to get into safe mode, I had to &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/leinss.com\/blog\/?p=3796\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;BlueScreenView: Lies and Damned Lies&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[4,7],"tags":[],"class_list":["post-3796","post","type-post","status-publish","format-standard","hentry","category-operating-system","category-tech-tips"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7wiG8-Ze","jetpack-related-posts":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/3796","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3796"}],"version-history":[{"count":19,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/3796\/revisions"}],"predecessor-version":[{"id":3819,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/3796\/revisions\/3819"}],"wp:attachment":[{"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/leinss.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}