Training
Module
Troubleshoot Windows startup - Training
This module examines the Windows startup architecture and discusses the methods used to troubleshoot client startup issues.
Debug initial command
The Debug initial command flag debugs the Client Server Run-time Subsystem (CSRSS) and the WinLogon process.
Note
Starting in Windows 10, CSRSS is a protected process and can only be debugged in kernel mode.
Abbreviation |
dic |
Hexadecimal value |
0x4 |
Symbolic Name |
FLG_DEBUG_INITIAL_COMMAND |
Destination |
System-wide registry entry, kernel flag |
NTSD debugs the processes (using the command ntsd -d), but control is redirected to the kernel debugger.
For details on NTSD, see Debugging Using CDB and NTSD.
Additional resources
Documentation
-
Global Flag Reference - Windows drivers
Global Flag Reference
-
!bpid (WinDbg) - Windows drivers
The !bpid extension requests that a process on the target computer break into the debugger or requests that a user-mode debugger be attached to a process on the target computer.
-
Stop on Exception - Windows drivers
Stop on exception