Security Troubleshooting

Week of 2027-01-12 · Download .docx

Objectives

Interpret BSOD stop codes and identify common causes
Configure Windows Firewall rules and manage account lockouts
Explain BitLocker, Windows Defender, and System Restore functions

Key terms

BSOD: Blue Screen of Death — Windows kernel panic; stop code identifies the specific fault.
IRQL_NOT_LESS_OR_EQUAL: BSOD stop code indicating a driver is accessing memory at an improper interrupt level.
SSL/TLS certificate error: Certificate is expired, issued by untrusted CA, or hostname mismatches.
wf.msc: Windows Defender Firewall with Advanced Security — manages inbound/outbound firewall rules.
lusrmgr.msc: Local Users and Groups — used to unlock local accounts and reset passwords.
BitLocker: Full disk encryption using TPM to seal the volume encryption key to the hardware.
Windows Defender: Built-in real-time antivirus and anti-malware in all Windows 10/11 editions.
System Restore: Reverts system files, registry, and programs to a restore point; preserves personal files.
Safe Mode: Windows boot mode loading minimum drivers; used for troubleshooting driver and malware issues.
msconfig Boot tab: Provides Safe Boot checkbox and other boot configuration options.
Browser cache: Locally stored web page content; clearing forces fresh downloads and can fix display issues.
Account lockout: Account locked after N failed logins; reset by another local admin via lusrmgr.msc.

The concept

BLUE SCREEN OF DEATH (BSOD)

A BSOD occurs when the Windows kernel encounters a critical error it cannot recover from. The hexadecimal stop code identifies the fault type. IRQL_NOT_LESS_OR_EQUAL (0x0000000A) means a driver attempted to access memory at an interrupt request level too high for its permission level — almost always caused by a buggy or incompatible device driver. MEMORY_MANAGEMENT and UNEXPECTED_KERNEL_MODE_TRAP suggest RAM hardware failure. Look up stop codes in the Windows documentation or Windows Event Viewer logs for analysis.

FIREWALL AND ACCOUNT MANAGEMENT

Windows Defender Firewall with Advanced Security (wf.msc) provides per-rule inbound/outbound control, connection security rules for IPsec, and profile-based policies for domain, private, and public network types. Local account lockouts are resolved through Local Users and Groups (lusrmgr.msc) by another local administrator — right-click the locked account and uncheck the 'Account is locked out' checkbox.

BITLOCKER AND WINDOWS DEFENDER

BitLocker (Pro/Enterprise) uses the TPM to seal the volume encryption key to the specific hardware configuration. If the drive is removed and placed in a different computer, the TPM is absent and the key cannot be recovered — protecting data from physical drive theft. Windows Defender is included in all Windows 10/11 editions at no cost and provides real-time antivirus and anti-malware protection without a separate purchase.

SYSTEM RESTORE AND SAFE MODE

System Restore rolls back system files, the registry, and installed programs to a restore point without affecting personal files — appropriate for undoing a bad Windows update. Safe Mode loads Windows with minimal drivers, making it possible to troubleshoot driver conflicts and run antimalware when a driver is preventing normal boot. Access Safe Mode via msconfig (Boot → Safe Boot) or by holding Shift while clicking Restart.

Worked examples

Example 1: After installing a new graphics card driver, the system BSODs on every boot with stop code IRQL_NOT_LESS_OR_EQUAL. Diagnosis: the new driver is causing the fault. Recovery: boot to Safe Mode (msconfig → Boot → Safe Boot, or Shift+Restart → Troubleshoot → Advanced Options → Safe Mode). Once in Safe Mode, open Device Manager and roll back the display driver or uninstall it. Reboot normally.

Example 2: A user cannot log into their Windows 10 workstation after entering the wrong password several times — account is locked. Resolution: log in with another local administrator account. Open lusrmgr.msc → Users → right-click the locked account → Properties → uncheck 'Account is locked out'. The user can now log in.

Common mistakes

Trying to use Event Viewer or Device Manager to configure Safe Mode — use msconfig Boot tab or Shift+Restart.
Forgetting that BitLocker protects only against drive removal — the drive is decrypted when booting on the original PC.
Assuming Windows Defender is a paid product or Enterprise-only — it is free and built into all Windows 10/11 editions.
Using System Restore when the problem is a corrupted system file — use sfc /scannow for that; System Restore rolls back changes.
Clearing browser cache to fix network connectivity issues — cache only affects web page rendering, not TCP/IP connectivity.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. IRQL_NOT_LESS_OR_EQUAL typically indicates:

Driver accessing memory at an improper interrupt level
RAM failure
SSD corruption
Network card failure

2. Windows Firewall rules are managed via:

Windows Defender Firewall with Advanced Security (wf.msc)
Event Viewer
Device Manager
msconfig

3. BitLocker uses the TPM to:

Store the encryption key — preventing decryption if the drive is removed
Speed up disk read/write
Provide antivirus protection
Manage BIOS boot passwords

4. Windows Defender is:

Built-in antivirus in all Windows 10/11 editions — no separate install
A paid product
Only on Enterprise edition
A firewall only

5. Safe Mode can be enabled from:

msconfig → Boot → Safe Boot, or hold Shift while clicking Restart
Event Viewer
BIOS/UEFI settings
Device Manager

Self-check answers

1. A — IRQL errors are almost always caused by a buggy device driver.
2. A — wf.msc provides full inbound/outbound rule management and connection security rules.
3. A — TPM seals the volume key to the hardware; drive removal makes decryption impossible on another PC.
4. A — Windows Defender is free and built into every Windows 10/11 edition.
5. A — msconfig Boot tab (persistent) or Shift+Restart (one-time) are the standard Safe Mode access methods.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top