Estimated reading time at 200 wpm: 12 minutes
On 19 April 2026, I attempted to boot into Windows 11 on my dual-boot desktop PC — a routine action I have performed well over a hundred times. Instead of a normal startup, Windows began running an automatic repair process on Drive C. This took approximately three minutes before presenting a screen stating that the repair had failed and could not be completed.
Whether or not you agree our Fat Disclaimer applies
The options offered were stark: reset Windows 11 whilst preserving files, or perform a full reinstallation. I attempted the built-in repair option from that screen. It failed again with the same result.
I decided to shut the machine down completely and power it off at the wall. On restarting, a brief repair notice ran to 100% and the machine booted normally into Windows 11 without further incident. I had done nothing to deliberately cause the problem, and the self-resolution was unexplained.
The question was clear: what had gone wrong, and was it likely to happen again?
Initial Assessment
The self-resolution on full power-off strongly suggested a dirty bit issue on the NTFS partition. NTFS is the file system Windows uses to organise data on its drives. It uses a “dirty bit” — a flag — to mark a volume as having been improperly shut down. When Windows sees this flag on startup, it attempts to run a repair. In a dual-boot system, this is a common occurrence when Windows does not get a fully clean exit.
The hypothesis at this stage was that Windows had not unmounted its partition cleanly at some earlier point, the NTFS flag was set, Startup Repair saw it and became confused by its own tooling, and a full power-off cleared the in-memory state sufficiently for a clean boot.
However, this needed verification rather than assumption.
Step One — Examining the Event Logs
What the Event Viewer Is
Windows keeps a continuous record of everything that happens on the system — services starting and stopping, hardware errors, software failures, and system events. This is called the Event Log, and it is accessible through a built-in tool called Event Viewer. Events are classified by severity: Information, Warning, Error, and Critical.
Exporting the Logs
Rather than reading individual entries in Event Viewer — which would have been impractical given the volume — the System log was exported to a CSV file (a plain text spreadsheet format) using PowerShell, Windows’ built-in command-line scripting tool. The command used was:
Get-WinEvent -LogName System | Select-Object TimeCreated, LevelDisplayName, Id, ProviderName, Message | Export-Csv -Path "$env:USERPROFILE\Desktop\system-log.csv" -NoTypeInformation -Encoding UTF8
This produced a file containing 7,141 events, which was uploaded for analysis by Claude.
What the Logs Revealed
The analysis found 409 Errors, 331 Warnings, and 1 Critical event across the log. Several categories of events were immediately significant.
Step Two — Identifying the Key Errors
The Critical Event
The single Critical event was a Kernel-Power Event ID 41. This is Windows’ way of recording that the system restarted without a clean shutdown — in other words, it crashed or lost power unexpectedly. The log confirmed the previous shutdown at 7:14:17 AM on 19 April 2026 was unexpected. This was the crash that had triggered the Startup Repair sequence.
WHEA Hardware Errors
The most significant finding was a series of WHEA-Logger warnings. WHEA stands for Windows Hardware Error Architecture — it is the layer of Windows responsible for detecting and recording errors reported directly by the computer’s hardware. These are not software errors. They indicate real faults at the physical hardware level.
These warnings had been appearing repeatedly since 3 April 2026 — more than a fortnight before the crash. Each one reported a “corrected hardware error” on a PCIe Root Port.
PCIe (Peripheral Component Interconnect Express) is the high-speed data highway inside a modern PC. It is the connection standard used to link major components — graphics cards, NVMe solid-state drives, network cards — directly to the processor and motherboard. A PCIe Root Port is one of the entry points on the motherboard where these connections are managed.
The errors were appearing on two specific ports, identified by their hardware addresses:
0x0:0x1:0x00x0:0x1C:0x2
The word “corrected” means the hardware recovered each time without data loss. However, a recurring pattern of corrected PCIe errors is a known precursor to more serious failures.
NTFS Volume Warnings
Both Drive C and Drive D were flagged on almost every boot as requiring an Online Scan — a file system check. Several Windows shadow copies (automatic backup snapshots) were flagged as needing a full offline repair. This pattern was consistent with the drives being marked dirty on every unclean exit, which in turn was caused by the underlying crashes.
Intel Storage Service Failures
The Intel Platform License Manager Service was timing out on almost every boot, and the Intel Storage Middleware Service — part of Intel’s RST (Rapid Storage Technology) software, which manages NVMe drive connections — was terminating unexpectedly on multiple sessions. This fitted the PCIe fault picture, as these services sit directly above the storage hardware stack.
CPU Throttling
Processors 16 through 19 were repeatedly being throttled by the system firmware. Throttling means the processor is being deliberately slowed down, usually to manage heat or power. This was noted as a secondary finding worth monitoring.
Step Three — Checking the Drives
Given the PCIe errors, the health of both Samsung NVMe SSDs was checked using Samsung Magician, the manufacturer’s own drive monitoring tool.
What an NVMe SSD Is
An NVMe (Non-Volatile Memory Express) SSD is a type of solid-state storage drive that connects directly to the motherboard via a PCIe slot, using a small card format called M.2. It is significantly faster than older drive types because it bypasses the traditional storage controller bottleneck.
SMART Self-Tests
Both drives were put through a SMART Short Self-Test. SMART (Self-Monitoring, Analysis and Reporting Technology) is a built-in diagnostic system present in all modern drives. It monitors the drive’s internal health and can report on failures before they become catastrophic.
Samsung SSD 980 1TB (Drive C — Windows OS drive):
- Health: Good
- Temperature: 32°C (Normal)
- Total data written: 31 TB (very low — early life)
- Failing LBAs: 0 (no bad sectors)
- SMART test: Successfully completed
Samsung SSD 990 PRO 2TB (Drive D — storage drive):
- Health: Good
- Temperature: 34°C (Normal)
- Total data written: 12.8 TB (very low — early life)
- Failing LBAs: 0 (no bad sectors)
- SMART test: Successfully completed
Both drives were clean. The PCIe errors had not caused any data-layer damage. The drives themselves were not the source of the problem.
Step Four — Mapping the PCIe Errors to Physical Devices
Since the drives were healthy, the investigation turned to identifying exactly which physical components corresponded to the two PCIe fault addresses.
Querying the Hardware Map
Using a series of PowerShell commands, every device in the system was mapped to its PCIe bus address. This produced a complete picture of what sat where on the motherboard.
The two fault addresses resolved as follows:
0x0:0x1:0x0—Intel PEG10 - 460D. This is the primary CPU PCIe x16 graphics slot. The NVIDIA GeForce RTX 3080 is physically plugged into this slot.0x0:0x1C:0x2—Intel PCI Express Root Port #3 - 7ABA, feeding through toPCI bus 3, device 0— the Realtek Gaming 2.5GbE Family Controller. This is the onboard Ethernet controller, soldered directly onto the motherboard.
What This Meant
Two separate PCIe-connected devices were generating hardware errors. One — the Realtek Ethernet controller — is soldered to the motherboard and cannot be physically reseated or replaced without professional intervention. The other — the RTX 3080 — is a physical card sitting in a slot. It can be removed and reseated.
Both errors began around 3 April 2026. The only event in the timeline near that date was the careful movement of the PC on 1 April 2026, when it was lifted gently to clean a dust filter.
Step Five — Identifying the Root Cause
The Physical Hypothesis
A PCIe x16 slot holds a graphics card through a combination of friction contact at the gold edge connector and a plastic retention clip at the end of the slot. The RTX 3080 is a very large, heavy card. Even careful movement of a PC case — particularly lowering it the few inches onto the floor — can cause micro-displacement of a heavy card in its slot. The PCIe connection is a precision friction-fit. A very small shift can introduce intermittent contact problems without the card appearing to have moved.
This was the leading hypothesis: the movement on 1 April caused the RTX 3080 to shift fractionally in its slot, introducing intermittent PCIe signal errors from 3 April onwards, which progressively contributed to system instability, culminating in the crash on 19 April.
The Decision
The decision was made to reseat the RTX 3080. This meant powering the machine fully off, disconnecting all peripherals, opening the case, releasing the PCIe retention clip, removing the GPU completely, and firmly reseating it until the clip locked back into place.
Step Six — The Reseat
What Was Found
On removing the RTX 3080, the PCIe slot retention clip was found to be slightly depressed rather than fully upright. The card itself had a slight wobble when tested before removal. Both of these are consistent with a card that is not fully and correctly seated in its slot.
After reseating the card firmly:
- The retention clip was fully upright and engaged
- The card had noticeably less movement
- All PCIe power connectors were checked and confirmed fully seated
The machine was reassembled, reconnected, and booted into Windows 11. The boot was clean — no Startup Repair, no error screens, no hesitation.
Step Seven — Verification
The Post-Reseat Log
A fresh System log was exported immediately after the reseat boot and analysed in the same way as the original.
The result was clear:
GPU PCIe errors (device 0x1:0x0) — completely absent after the reseat. The last error on this address was 14 April 2026. There were zero GPU PCIe errors following the reseating.
Realtek NIC errors (device 0x1C:0x2) — still present in historical entries but continuing at their previous infrequent rate. This was expected, as the onboard Ethernet controller could not be physically reseated. These errors are being monitored.
After 21:00 on 19 April — only one entry of any concern in the entire log: a standing TPM Secure Boot certificate notice, which is a configuration item rather than a fault.
The Performance Observation
Immediately after the reseat, I noted that the system felt noticeably snappier — more responsive. I was sceptical of this observation, suspecting it might be psychological relief rather than a real improvement.
The log analysis confirmed it was real. A GPU communicating with the processor over an intermittently connected PCIe x16 link is not operating at full bandwidth. Every data transfer across that interface was subject to the same contact instability that was generating the hardware errors. A fully and cleanly seated card communicates at full PCIe bandwidth. The performance improvement was genuine and physically explicable.
Conclusion
Root Cause
The root cause of the Windows 11 crash on 19 April 2026 was a partially unseated NVIDIA GeForce RTX 3080 graphics card. The card had shifted fractionally in its PCIe x16 slot — almost certainly as a result of the careful physical handling of the PC on 1 April 2026. The depressed retention clip and the slight wobble of the card before reseating confirmed this. The intermittent PCIe contact errors this caused accumulated over a fortnight before eventually triggering an unclean system shutdown.
Resolution
Full removal and firm reseating of the RTX 3080, with confirmation that the retention clip was properly engaged. GPU PCIe errors ceased immediately.
Ongoing Monitoring
The Realtek 2.5GbE Ethernet controller continues to generate infrequent corrected PCIe errors on Root Port #3. These are hardware-level events on a soldered onboard component and cannot be addressed through reseating. The frequency is low and has not caused further instability. The Event Log will be monitored periodically to confirm these errors remain at background levels and do not escalate.
Technical Glossary
BIOS / UEFI — The firmware that starts a computer before the operating system loads. UEFI is the modern replacement for the older BIOS standard.
Dirty bit — A flag set by NTFS to mark a volume as having been improperly unmounted. Causes Windows to run a filesystem check on next boot.
Dual boot — A configuration where two operating systems (in this case Windows 11 and BigLinux) are installed on the same machine, with a menu at startup to choose between them.
Event Log / Event Viewer — Windows’ built-in record of system activity, hardware events, software errors, and services. Accessible via the Event Viewer application.
GPU (Graphics Processing Unit) — The dedicated graphics card responsible for rendering images on screen. In this system, an NVIDIA GeForce RTX 3080.
Kernel-Power Event ID 41 — A specific Windows event that records an unclean system restart — a crash, freeze, or unexpected power loss.
M.2 — A compact form factor for NVMe SSDs. The drive is a small rectangular card that slots directly into the motherboard.
NTFS (New Technology File System) — The file system used by Windows to organise data on its drives.
NVMe (Non-Volatile Memory Express) — A modern high-speed protocol for SSD storage, connecting directly via PCIe for maximum performance.
PCIe (Peripheral Component Interconnect Express) — The high-speed data connection standard used inside modern PCs to link major components (graphics cards, NVMe drives, network cards) to the processor and motherboard. PCIe x16 denotes a full-width slot used for graphics cards.
PCIe Root Port — An entry point on the motherboard’s chipset that manages PCIe connections to downstream devices.
PowerShell — Windows’ built-in command-line scripting environment, used here to export event logs and query hardware device information.
Realtek 2.5GbE — The onboard Ethernet network controller, soldered to the motherboard, responsible for wired internet connectivity.
Reseat — To remove a component from its slot and reinsert it, ensuring a clean and full connection. Used for graphics cards, RAM, and other socketed hardware.
RST (Intel Rapid Storage Technology) — Intel’s software layer for managing NVMe storage devices connected via PCIe.
SMART (Self-Monitoring, Analysis and Reporting Technology) — A built-in diagnostic system in modern drives that monitors internal health and reports potential failures.
WHEA (Windows Hardware Error Architecture) — The Windows subsystem responsible for detecting, recording, and reporting errors that originate in the physical hardware, below the software layer.
