Troubleshoot a problem
Start with what failed and when. Keep the error text and the name of the service, package, account or interface involved. Read the current state and relevant records before restarting a service, changing permissions or repeating an operation that changes the machine. For a reviewable event capture, follow Save incident event evidence.
The browser cannot reach the desktop #
- Check the address and port against
Sign in from a browser.
A machine configured to listen only on
127.0.0.1is not reachable from another device. - If the browser shows a certificate warning, follow The machine's certificate. Do not enter credentials when the certificate fingerprint does not match.
- At a console you can still reach, use
net statusto inspect the address, link and readiness. Check the GXWI service,gxwid, through Controlling services. - If this happened during installation or first boot, return to that installer's guide. Network changes, reboot and completion of setup can change the address or what the browser shows.
Sign-in is refused #
An unknown account and a wrong credential intentionally produce the same sign-in failure. Check that you are using an account on this machine and follow Creating accounts for local-account administration. Do not infer that an account is missing from the sign-in error alone.
For an administrator investigating the failure, the sign-in audit trail explains the authority's and local account service's events. Those records are available only to accounts permitted to read them.
A service will not start, stops, or keeps restarting #
Use Service troubleshooting. It covers configuration, identity, dependency and crash-loop failures. Inspect the service's state and its latest output before retrying: a running process is not always a ready or healthy service.
In Services Manager, select the service and choose Logs… to open Event Viewer on its output, including hooks and health checks. Widen the time range if the failure is older than the default last 24 hours.
Networking is missing or changed unexpectedly #
Use Network Manager or
net status to check the interface's
verdict, selected profile, address, gateway and warnings.
- Not managed / IGNORE: check which profile rule applies.
- A rejected configuration: the last working rules can remain active; read the rejection before assuming the new settings took effect.
- An address but no route: distinguish local connectivity from a route out of the machine.
- Addresses work but names do not: follow Name resolution.
Make lasting changes through the supported network settings or registry profiles. Manual changes to a managed interface can be reverted by netd. Network Manager labels some firewall displays Example data; do not use those displays as evidence of live traffic. For the next check for your symptom, follow Network diagnostic tools.
The clock or displayed time is wrong #
Start with Keeping the time: inspect the effective time zone, clock state and source failures before changing the clock. A wrong time zone and an unsynchronised clock need different corrections.
A write fails or a filesystem is full #
Keep the exact error and affected path. Find why a filesystem is full distinguishes block space, inode pressure and incomplete directory measurements before choosing a supported remedy. Do not turn a permission or I/O failure into a deletion task without evidence.
A package or feature change was interrupted #
For a package operation, follow Transactions and recovery before starting another transaction. For a feature, follow Interrupted features; their recovery uses the feature's own lifecycle, rather than package transaction recovery.
An action is denied, or records seem to be missing #
For a refused operation, follow Debugging a denial. Collect the failing operation, identity and required access before changing permissions. The task guide explains the access needed for that operation.
Event queries omit records you may not read. Event Viewer can show whether its read policy hides records, or whether it could not read that policy. An empty list is not proof that nothing happened. Also check the time range and filters, and remember that logs are best effort.
Follow Find missing records to distinguish filtering, access, retention and collection failures. What the machine records explains logs, events and metrics; Event Viewer explains filtering, older records and access notices.