When Windows suddenly disappears from the boot menu, the root cause is rarely the destruction of the operating system itself. In many production incidents, the system volumes remain entirely healthy, but the BCD (Boot Configuration Data) has lost its reference to the OS loader, or the Boot Manager has been corrupted, preventing the correct entries from being displayed.
This article serves as a complete operational runbook for boot recovery. It details step-by-step diagnostic workflows for disk and firmware configurations, mandatory backup steps, manual BCD reconstruction, and automated boot repair using the bcdboot utility.
1) Initial diagnosis and WinRE access#
Before executing any commands on the boot sector, access the Windows Recovery Environment (WinRE) to obtain a secure command prompt.
Methods to access WinRE:#
- Option 1 (Shift + Restart): Hold down the
Shiftkey while clicking "Restart" in the Windows Start menu. - Option 2 (GUI): Go to Settings → Update & Security → Recovery and click "Restart now" under Advanced startup.
- Option 3 (Command line): If Windows is bootable but unstable:
shutdown /r /o /t 0- Option 4 (External Media): Boot the computer using a Windows installation USB/DVD. On the installer welcome screen, select Repair your computer in the bottom-left corner.
Creating recovery media:#
If local WinRE is corrupted, create a bootable recovery USB from another Windows host using the Create a recovery drive menu in the search bar, or download the Media Creation Tool:
- Official download portal: Microsoft Software Download
To check and enable the local WinRE configuration:
# Verify the current status of WinRE
reagentc /infoTypical expected console output:
Windows Recovery Environment (Windows RE) that is installed on this computer:
Windows RE status: Enabled
Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
Boot Configuration Data (BCD) identifier: 8a12b345-67c8-90d1-e234-56789f012345
Custom image location:
Custom image index: 0
Recovery image location:
Recovery image index: 0If the status reports Disabled, re-enable it:
# Enable the local WinRE environment
reagentc /enable
# If it fails (due to a corrupted path or missing image), reset the recovery image location first
reagentc /setreimage /path C:\Windows\System32\Recovery
reagentc /enableMandatory Drive Letter Mapping in WinRE#
:: Inspect assigned volume letters inside WinRE
diskpart
list volume
exitTypical console output:
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 D Windows NTFS Partition 465 GB Healthy
Volume 1 C System Res NTFS Partition 500 MB Healthy
Volume 2 System FAT32 Partition 100 MB Healthy HiddenIn this example, the \Windows systemroot lives on drive D:. Throughout this runbook I use C: as a standard convention, but you must replace C: with the actual volume letter identified on your machine!
2) Firmware, storage, and BitLocker auditing#
An incorrect boot rebuild can corrupt system data. You must identify the partition style and system firmware type of the host before executing changes.
1. Partition style (GPT vs. MBR)#
Access the WinRE command prompt and identify the physical partition structure via diskpart:
diskpart
list disk
exitConsole output:
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 476 GB 1024 KB *(If there is an asterisk in the "Gpt" column, the disk uses GPT and UEFI boot. If empty, the disk uses legacy MBR with BIOS boot).*
Alternatively, when querying via PowerShell:
# Check the partition style of active disks (modern Storage module)
Get-Disk | Select-Object Number, FriendlyName, PartitionStyle, Size
# Classical WMI alternative for legacy environments or minimal WinPE shells
Get-WmiObject Win32_DiskPartition | Select-Object DiskIndex, Index, Type | Where-Object { $_.Type -like "*GPT*" }2. Firmware mode (UEFI vs. BIOS)#
To determine whether the system is booted in modern UEFI or legacy BIOS mode:
# Query the registry for the firmware type variable
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control" -Name "PEFirmwareType" -ErrorAction SilentlyContinue(If PEFirmwareType returns 2, the system runs in UEFI mode; if it returns 1, it runs in BIOS/Legacy mode).
# Validate if UEFI Secure Boot is active (UEFI only)
try {
Confirm-SecureBootUEFI
} catch {
Write-Warning "Secure Boot unavailable or system booted in BIOS/Legacy mode."
}Technical Note: Confirm-SecureBootUEFI throws an exception on BIOS/Legacy platforms due to missing platform architecture support. Inspecting PEFirmwareType in the registry above is the universal, exception-safe method.
3. BitLocker diagnostics and unlocking#
# Check if BitLocker is active on system volumes
manage-bde -statusIf active, you will need the 48-digit recovery key (available in the user's Microsoft account or Azure AD / Active Directory console). Run the command below to unlock the volume before attempting any repairs:
# Unlock the encrypted volume (substitute C: with your actual OS letter)
manage-bde -unlock C: -RecoveryPassword YOUR-48-DIGIT-RECOVERY-KEY3) Disk integrity and root cause triage#
A corrupted bootloader can be a symptom of disk sector damage, file system corruption, or malware infection. Run structural verification checks before writing new boot files:
1. Offline diagnosis and repair in WinRE#
# 1. Scan and repair system file errors on volume C:
chkdsk C: /f /r
# 2. Check the integrity of protected system files offline
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
# 3. Repair the offline Windows system image using local WinSxS (no internet)
DISM /Image:C:\ /Cleanup-Image /RestoreHealth /LimitAccess
# 4. Repair the offline Windows image using Windows installation media (e.g., USB drive on letter E:)
DISM /Image:C:\ /Cleanup-Image /RestoreHealth /Source:WIM:E:\sources\install.wim:1 /LimitAccess2. Offline driver conflict triage#
If the system is failing boot with BSODs referencing specific recently installed drivers:
:: Inspect offline drivers via DISM
dism /Image:C:\ /Get-DriversOr query via PowerShell:
# Check recently added drivers in the offline system store
Get-WindowsDriver -Path C:\ | Sort-Object Date -Descending | Select-Object -First 103. Offline event log inspection in WinRE#
Running Get-WinEvent -LogName "System" fails in WinRE because the offline EventLog service is not running. To inspect event logs while inside WinRE, point directly to the .evtx file on disk:
# Read recent boot events directly from the offline log file
Get-WinEvent -Path "C:\Windows\System32\Winevt\Logs\System.evtx" -MaxEvents 30 -ErrorAction SilentlyContinue | Where-Object { $_.Message -like "*boot*" }4. Post-boot triage (after restoring Windows boot)#
Once Windows boots successfully, run diagnostics that depend on online services:
# Check Windows Defender real-time protection status
Get-MpComputerStatus
# Query critical events in the Security log
Get-WinEvent -LogName "Security" -MaxEvents 100 | Where-Object { $_.LevelDisplayName -eq "Critical" }
# List hardware devices reporting active configuration error codes
Get-WmiObject Win32_PnPEntity | Where-Object { $_.ConfigManagerErrorCode -ne 0 } | Select-Object Name, ConfigManagerErrorCode4) Operational safety: BCD and EFI backup#
WARNING: Never modify BCD records without creating a safety backup.
# Backup the current BCD configuration (with .bcd extension)
bcdedit /export C:\bcd-backup-$(Get-Date -Format yyyyMMdd).bcdTo backup the physical boot files located in the system's EFI partition:
:: 1. Launch Diskpart to mount the EFI system partition
diskpart
list disk
select disk 0
list partitionThe console displays the disk partition layout. Locate the partition labeled as System, formatted as FAT32 (~100MB-260MB):
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 System 100 MB 1024 KB
Partition 2 Reserved 16 MB 101 MB
Partition 3 Primary 465 GB 117 MB
Partition 4 Recovery 600 MB 465 GBSelect the identified System partition number (e.g., Partition 1), assign drive letter Z:, and exit:
select partition 1
assign letter=Z
exit(Safe PowerShell alternative to auto-identify and mount the EFI partition):
$efiPartition = Get-Partition | Where-Object { $_.Type -eq 'System' }
if ($efiPartition) {
Set-Partition -DiskNumber $efiPartition.DiskNumber -PartitionNumber $efiPartition.PartitionNumber -NewDriveLetter Z
Write-Host "EFI partition successfully mounted on Z:"
}Then copy the full EFI boot directory:
# Copy all files from the EFI partition with metadata and long path resilience via robocopy
robocopy Z:\ C:\efi-backup\ /E /COPYALL /R:3 /W:55) Boot recovery procedure#
Use the technical decision tree below to guide the execution sequence of bootloader recovery commands:
[ Windows Boot Fails ]
│
├──► 1. Access WinRE (Shift+Restart or USB Installer)
│
├──► 2. Map Drive Letters (diskpart → list volume)
│
├──► 3. Test BCD: bcdedit /enum
│ │
│ ├─► [BCD responds and OS entry exists?]
│ │ │
│ │ ├─► YES: Validate/correct "device" and "osdevice"
│ │ └─► NO: Rebuild boot files and store
│ │
│ └─► [Rebuilding Strategy]
│ │
│ ├─► Option A (Recommended): bcdboot
│ │ ├─► UEFI: bcdboot C:\Windows /s Z: /f UEFI
│ │ └─► BIOS: bootsect /nt60 C: /mbr && bcdboot C:\Windows /f BIOS
│ │
│ └─► Option B (Manual): bcdedit /create + /set + /default
│
└──► 4. Reboot and Test BootloaderOption a: the rapid path with bcdboot (Recommended)#
The bcdboot command is Microsoft's recommended automated utility to restore boot files and safely recreate the BCD store.
For modern UEFI environments (with the EFI partition mounted to letter Z:):#
bcdboot C:\Windows /s Z: /f UEFIExpected success console output:
Boot files successfully created.For legacy BIOS / MBR environments:#
On BIOS/MBR systems, bcdboot restores BCD entries and files in the \Boot directory, but does not repair sector zero boot code (MBR/PBR) if it was corrupted or overwritten. You must execute bootsect prior to bcdboot:
:: 1. Restore Master Boot Record (MBR) and Partition Boot Record (PBR)
bootsect /nt60 C: /mbr
:: 2. Rebuild boot files and BCD store for legacy BIOS
bcdboot C:\Windows /f BIOSFor hybrid or mixed compatibility systems:#
bcdboot C:\Windows /f ALLOption b: manual reconstruction with bcdedit#
If the automated utility fails, or if you need to create custom boot configurations (such as dual-boot setups):
1. Inspect current BCD entries and check for multiple operating systems:#
:: List all records in the BCD store
bcdedit /enum allExpected console output (example of healthy BCD store):
Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=\Device\HarddiskVolume2
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale en-US
inherit {globalsettings}
default {current}
resumeobject {8a12b345-67c8-90d1-e234-56789f012345}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
Windows Boot Loader
-------------------
identifier {current}
device partition=C:
path \Windows\system32\winload.efi
description Windows 11
locale en-US
inherit {bootloadersettings}
recoverysequence {8a12b346-67c8-90d1-e234-56789f012346}
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \Windows
resumeobject {8a12b345-67c8-90d1-e234-56789f012345}
nx OptIn
bootmenupolicy Standard2. Create a new bootloader entry (if the existing one is missing):#
bcdedit /create /d "Windows 11" /application osloaderThe command outputs a unique {GUID}:
The entry {8a12b345-67c8-90d1-e234-56789f012345} was successfully created.(If automating via PowerShell):
$createOutput = bcdedit /create /d "Windows 11" /application osloader
$guid = ($createOutput | Select-String -Pattern "\{[A-Fa-f0-9-]+\}").Matches.Value3. Set the required parameters for the new {GUID}:#
:: Set the partition containing the bootloader files
bcdedit /set {GUID} device partition=C:
:: Set the partition containing the operating system systemroot
bcdedit /set {GUID} osdevice partition=C:
:: Define the path to the bootloader (winload.efi for UEFI)
bcdedit /set {GUID} path \Windows\system32\winload.efi
:: Define the systemroot folder path
bcdedit /set {GUID} systemroot \Windows(For older systems running on MBR, change the bootloader path to \Windows\system32\winload.exe).
4. Add the entry to the active boot menu and set as default:#
:: Add the entry to the boot manager list
bcdedit /displayorder {GUID} /addlast
:: Set the newly created entry as the default boot OS
bcdedit /default {GUID}
:: Set the boot menu display timeout to 10 seconds
bcdedit /timeout 10Setting /default {GUID} is essential: without it, the Boot Manager may attempt to launch an orphaned or invalid entry.
6) Rollback procedure#
If manual modifications create duplicate entries or boot instability, restore the original BCD configuration:
# In WinRE PowerShell:
bcdedit /import "C:\bcd-backup-$(Get-Date -Format yyyyMMdd).bcd":: In classical CMD prompt (specify the actual backup file date):
bcdedit /import C:\bcd-backup-20260919.bcd
:: Remove the temporary drive letter from the EFI partition
diskpart
select disk 0
select partition 1
remove letter=Z
exitChecklist: Windows boot recovery#
Use this operational field checklist to guide the boot recovery process:
1. Diagnosis phase#
- [ ] Inspect boot failure symptoms (retrieve error codes, BSOD flags, or "Non-system disk" messages)
- [ ] Access the WinRE recovery environment (Shift+Restart or USB installation media)
- [ ] Map actual volume letters via
diskpart→list volume(locating the real Windows volume) - [ ] Identify partition style (
GPTwith*orMBR) and firmware mode (PEFirmwareType: 2=UEFI, 1=BIOS) - [ ] Check BitLocker status and retrieve recovery keys if encrypted
2. Safety & backups#
- [ ] Export the BCD configuration to a safe path:
bcdedit /export C:\bcd-backup.bcd - [ ] Mount the EFI partition (
assign letter=Z) and copy boot files viarobocopy - [ ] Ensure the backup is accessible on local disk or external media
3. Bootloader repair#
- [ ] Repair file system integrity:
chkdsk C: /f /r - [ ] Check protected system files offline:
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows - [ ] Attempt rapid boot files restoration via
bcdboot(on BIOS, executebootsect /nt60 C: /mbrfirst) - [ ] If manually reconstructing via
bcdedit: setdevice,osdevice,path, add todisplayorder, and set withbcdedit /default {GUID} - [ ] On BitLocker systems, confirm that
{resumeobject}has been properly bound
4. Post-boot homologation#
- [ ] Unmount the temporary EFI partition (
remove letter=Z) - [ ] Restart the host and confirm that Windows boots directly without intervention
- [ ] Verify post-boot antivirus status (
Get-MpComputerStatus) and driver health
Related Guides & Series Navigation#
- ⬅️ Previous in Systems & Boot: How to Edit the Hosts File in Windows Without Permission Errors
- ➡️ Next in Systems & Boot: WSL2 Stopped Working? Diagnosing and Fixing HCS_E_HYPERV_NOT_INSTALLED
- 🇧🇷 Versão em Português: Recuperação de boot no Windows: reconstruindo o BCD manualmente
- 💬 Questions or field insights? Have you faced unusual partition corruption or BitLocker issues during recovery? Scroll down to leave a comment or share your findings below.
Was this article helpful?
Leave a quick reaction to help prioritize future technical guides:
See also
This post is licensed under CC BY-NC.
Comments
Join the discussion below.
0 comments