Fix Can’t Enable Boot Logging Process Monitor Windows 10

If you can’t enable boot logging or Process Monitor (ProcMon) in Windows 10, the fix usually involves running the tool as an administrator, disabling Fast Startup, or using the built-in Event Viewer to capture boot-time driver activity. Below is a step-by-step guide to get boot logging working, plus context on why it fails and what alternatives exist.

What Boot Logging and Process Monitor Do

Boot logging records what happens during Windows startup—every driver that loads, every service that starts, and every process that runs. The built-in Windows feature creates a file called ntbtlog.txt in the C:\Windows folder. Process Monitor (ProcMon) from Microsoft Sysinternals is a more advanced tool that can capture file system, registry, and process/thread activity in real time, including during boot if you configure it with the Enable Boot Logging option.

Both tools serve the same purpose: diagnosing why your PC is slow to start, why a driver fails, or why a service crashes. Boot logging is simpler and built-in; ProcMon gives much deeper detail but requires more setup.

Why “Enable Boot Logging” Is Grayed Out or Fails

The most common reason you can’t enable boot logging in Process Monitor is that you’re not running it as an administrator. ProcMon needs elevated privileges to install a boot-time driver that captures activity before the Windows GUI loads. If you launch it without admin rights, the checkbox is grayed out.

Another frequent cause is Windows Fast Startup. This feature (enabled by default on many laptops) uses a hybrid shutdown that doesn’t fully close the kernel session. As a result, boot logging may not trigger because the system is hibernating rather than performing a full cold boot. Disabling Fast Startup often resolves the issue.

Third-party antivirus or security software can also interfere with ProcMon’s driver installation. Some security suites block unsigned or unknown drivers, preventing the boot-logging component from loading.

How to Enable Boot Logging in Windows 10 (Built-in Method)

Windows 10 has a native boot logging feature that doesn’t require any extra tools. Here’s how to turn it on:

1. Press Win + R, type msconfig, and press Enter.
2. In the System Configuration window, go to the Boot tab.
3. Check the box next to Boot log.
4. Click OK and restart your PC.
5. After restart, open C:\Windows\ntbtlog.txt with Notepad to view the log.

This method works on most systems, but it only logs drivers, not processes or registry activity. To get a fuller picture, you need Process Monitor.

How to Enable Boot Logging in Process Monitor

If you prefer ProcMon, follow these steps:

1. Download Process Monitor from the official Microsoft Sysinternals site.
2. Right-click Procmon.exe and select Run as administrator.
3. Press Ctrl + E to stop capturing (if it’s already running).
4. Go to Options → Enable Boot Logging.
5. Click OK and restart your computer.
6. After boot, open ProcMon as administrator. It will ask if you want to save the boot log—click Yes and choose a location.

ProcMon will then replay the captured boot activity, showing every process, file, and registry access that occurred during startup. This is extremely useful for finding slow drivers or failed services.

Common Problems and Their Fixes

Even after following the steps, you may encounter issues. Here are the most common ones and how to solve them:

• Boot log file is empty or missing: Disable Fast Startup (Control Panel → Power Options → Choose what the power buttons do → Change settings that are currently unavailable → uncheck Turn on fast startup). Then do a full shutdown and restart.
• ProcMon says “Boot logging is already enabled”: This can happen if a previous session didn’t complete. Reboot again, and if it persists, use the built-in msconfig method instead.
• Antivirus blocks ProcMon: Temporarily disable real-time protection, run ProcMon, then re-enable it. Do not disable your antivirus permanently.
• Boot logging works but the log is huge: Use ProcMon’s filter (Ctrl + L) to focus on specific processes, like explorer.exe or a driver name.

Alternative: Event Viewer for Boot-Time Errors

If boot logging isn’t working, the Windows Event Viewer can give you a simpler view of startup problems. To access it:

1. Press Win + X and select Event Viewer.
2. Go to Windows Logs → System.
3. Click Filter Current Log on the right.
4. Under Event sources, check Service Control Manager and Kernel-Power.
5. Look for warnings or errors with timestamps matching your boot time.

This won’t give you a full process trace, but it will highlight services that failed to start or drivers that crashed—often enough to diagnose the issue.

Comparing Built-in Boot Logging and Process Monitor

Here’s a quick comparison to help you choose:

• Built-in (msconfig): Logs driver load/unload only. Simple, no extra tools, but limited to drivers.
• Process Monitor: Logs processes, threads, file I/O, registry access, and network activity. Much more powerful, but requires admin rights and can produce massive logs.
• Event Viewer: Logs errors and warnings from services and drivers. Good for quick checks, but doesn’t show the full sequence of startup events.

For most users, the built-in boot log is enough. For advanced troubleshooting—like finding which app is slowing down startup—ProcMon is the better choice.

Safety and Performance Considerations

Boot logging itself is safe and doesn’t slow down your system permanently. However, leaving boot logging enabled in msconfig will keep writing a log file on every boot, which uses a tiny amount of disk space and can slightly increase startup time. It’s best to disable it once you’ve finished diagnosing.

Process Monitor’s boot logging installs a kernel driver that stays active until you disable it. Make sure to disable boot logging in ProcMon after you’ve saved the log (Options → Disable Boot Logging), otherwise it will continue capturing on every boot.

Never disable your antivirus permanently to get boot logging to work—temporarily pausing it for a few minutes is fine, but remember to turn it back on.

Frequently Asked Questions

Why is the “Enable Boot Logging” option grayed out in Process Monitor?

This almost always means you’re not running ProcMon as administrator. Right-click the executable and select “Run as administrator”. If it’s still grayed out, check if Fast Startup is enabled—disable it in Power Options and try again.

Can I enable boot logging without restarting my PC?

No. Boot logging captures events during the boot process, so a restart is required to record anything. The log is written during the next startup.

Where is the boot log file stored?

For the built-in method, the file is C:\Windows\ntbtlog.txt. For Process Monitor, you choose the location when you save the boot log after restarting.

How do I disable boot logging after I’m done?

For the built-in method, open msconfig → Boot tab → uncheck “Boot log” → OK. For ProcMon, open the app as admin, go to Options → Disable Boot Logging, then restart.

Does boot logging work if I use a solid-state drive (SSD)?

Yes, boot logging works on SSDs. The log captures driver and process activity regardless of storage type. However, because SSDs boot faster, you may have less time to see the log in ProcMon—but it will still be recorded.

Can boot logging help with blue screen errors?

Boot logging can help identify which driver causes a blue screen by showing the last driver loaded before the crash. However, for a more direct approach, use the built-in verifier.exe or check the minidump files in C:\Windows\Minidump.

Related

• Transfer Adobe Programs to a New Computer
• New iOS Bug Freezing iPhones: What to Know
• Fix Telegram Not Downloading Media on iPhone and Android