msconfig is the command that opens System Configuration, a built-in Windows troubleshooting tool that controls how Windows starts. With it you can start Windows with fewer services and programs (a diagnostic or selective startup), turn off non-Microsoft services for a clean boot, make the next restart go into Safe Mode, and open other admin tools. It’s mainly used to find out which background service or startup program is causing a problem. You need to be an administrator to use it.
I’m learning Windows and cybersecurity basics myself, and msconfig comes up constantly in beginner labs and troubleshooting guides. This post explains each part in plain English, based on Microsoft’s own documentation, and covers the one mistake that catches almost everyone: getting stuck in Safe Mode. It doesn’t include answers to any training-platform rooms; it’s about understanding the tool.
There are three quick ways:
msconfig and press Enter.msconfig and choose System Configuration from the results. This is the method in Microsoft’s clean boot guide.msconfig and press Enter.Microsoft notes that to use System Configuration “you must be logged on as an administrator or as a member of the Administrators group.” If you’re a standard user, Windows shows a User Account Control prompt asking for an admin password. My guide to what UAC is in Windows explains why that prompt appears and what the coloured banners mean.
System Configuration has five tabs:
Let’s go through each one.
According to Microsoft’s System Configuration troubleshooting article, the three options are:
“The normal startup option is the Windows default. This option enables Windows to start in normal mode together with all programs, services, and device drivers loaded.” This is where you want to end up when you’ve finished troubleshooting.
Diagnostic startup loads only basic device drivers and software. Microsoft lists Microsoft services that are temporarily disabled in this mode, including Networking, Plug and Play, Event Logging, Error Reporting and System Restore. That makes it a very stripped-down start, useful for a quick “is it Windows or something I installed?” test, but you won’t have a network connection while you’re in it.
Selective startup lets you choose what loads, with three check boxes:
All are ticked by default. If you untick an item on the Services or Startup tabs, Windows automatically switches the General tab to Selective startup, so seeing “Selective startup” selected is a sign that someone has changed something.
Microsoft describes a methodical process of elimination:
It’s slow, because each test needs a restart, but it’s reliable. Write down what you changed as you go.
A clean boot starts Windows with only Microsoft’s own services and no third-party startup programs. Microsoft says it “starts Windows with only essential drivers and startup programs”, and that, unlike Safe Mode, “it provides greater control to isolate the source of a problem.” It’s the standard first step for software conflicts, such as a game crashing or an installer failing.
Microsoft’s clean boot steps, summarised:
msconfig).The Hide all Microsoft services step is crucial. Without it, “Disable all” would turn off Windows’ own services as well, which can stop networking, sign-in and other essentials.
When you’ve finished, reverse it, following Microsoft’s reset steps:
The Services tab lists Windows services with check boxes. A ticked box means the service is allowed to start at boot; an unticked one won’t start next time. It also shows the manufacturer and whether each service is running.
This is a startup switch, not a full service manager. For changing a service’s startup type (Automatic, Manual, Disabled) or seeing its dependencies, use the Services console, services.msc.
On Windows 7 and earlier, the Startup tab listed programs that launch at sign-in. Since Windows 8, it only says that startup items are managed in Task Manager and gives you an Open Task Manager link. Microsoft notes these programs come from the Startup folders and the registry.
In Task Manager’s Startup apps page you can see each program’s publisher, status and “startup impact”, and disable anything you don’t need. Fewer startup apps usually means a faster sign-in.
The Boot tab changes how Windows starts next time. The option beginners use most is Safe boot, which restarts Windows in Safe Mode. The sub-options are:
Other boot options on the tab include No GUI boot (hide the Windows logo while starting), Boot log (write a log of drivers loaded during startup), Base video (start with a basic display driver) and OS boot information. Advanced options lets you limit the number of processors and the maximum memory. These are for testing. Leave them unticked on a normal PC, and if you ever change them, change them back afterwards.
This is the classic msconfig mistake. A Safe boot set in msconfig is persistent: Windows keeps restarting into Safe Mode until you turn it off. Microsoft’s article on a computer that keeps restarting into safe mode explains that this happens when the SAFEBOOT option is ticked in System Configuration.
msconfig.If msconfig won’t open or the setting won’t stick, Microsoft gives this command to remove the safeboot setting from the boot configuration. Run it in an administrator Command Prompt:
bcdedit /deletevalue {default} safeboot
Then restart. bcdedit edits the Boot Configuration Data store directly, so type it exactly and don’t experiment with other bcdedit options unless you know what they do. For help, Microsoft suggests running bcdedit.exe /?.
If you only want Safe Mode once, a better approach is Settings > System > Recovery > Advanced startup, or holding Shift while you click Restart. That boots into the recovery options and returns to normal startup next time.
Microsoft describes the Tools tab as a way “to start diagnostic tools and other advanced tools”. It shows each tool’s path and switches, and you start one by selecting it and clicking Launch (or pressing Alt + L). The list includes tools such as Change UAC Settings, System Information, Event Viewer, Registry Editor, Command Prompt and System Restore.
It’s a handy launcher while you’re learning, because the path column shows the real program name, for example that Registry Editor is regedit.exe. Several of those paths use environment variables such as %windir%, which I explain in my post on Windows environment variables.
For anyone studying security, msconfig is relevant in a few ways:
Don’t disable services just because you don’t recognise them. Many essential Windows components have unfamiliar names. Change one thing at a time and keep notes.
These three get mixed up a lot, so here’s the difference in one place:
Microsoft’s clean boot guide also points out that if a problem stops Windows starting at all, you can’t use these steps. After several failed starts, Windows should open the Windows Recovery Environment automatically, which has its own repair and Safe Mode options.
msconfig opens System Configuration, a Windows tool for troubleshooting startup. You can use it to perform a clean boot, run a diagnostic or selective startup, set Safe boot for the next restart, and launch other admin tools.
Yes, if you change one thing at a time and know how to undo it. Microsoft warns that changing advanced boot options without guidance can make a computer unusable, so avoid the Advanced options on the Boot tab.
On the Services tab, tick Hide all Microsoft services and click Disable all. Then use the Startup tab’s link to Task Manager and disable all startup apps. Click OK and restart.
Open msconfig, clear Safe boot on the Boot tab, choose Normal startup on the General tab and restart. If that fails, run bcdedit /deletevalue {default} safeboot in an administrator Command Prompt.
Diagnostic startup loads only basic drivers and services and disables things like networking. Selective startup lets you choose whether to load system services and startup items, so you can narrow down the cause of a problem.
Yes. System Configuration is included in Windows 11 and Windows 10. Startup programs are managed in Task Manager rather than on msconfig’s Startup tab.
Yes. Microsoft states you must be signed in as an administrator or a member of the Administrators group. A standard user gets a UAC prompt asking for admin credentials.
// note
This is a learning note from studying the web. It is one small topic, written so I can remember it. It is not a course and not a claim that I have finished the subject.
If a sentence is wrong, say so from the contact page and name this title. Drafts never appear here. Related notes, when they exist, are other published posts, and the same sample rule applies to each of them.
UAC (User Account Control) is the Windows feature that runs your apps with standard rights and asks before anything gets admin power. Here’s how the two tokens, the dimmed secure desktop, the four slider levels and the registry settings fit together.
Use NTFS for internal Windows drives, exFAT for USB sticks and SD cards you share with a Mac, and FAT32 only for small or old devices. Here are the real limits (4 GB files, 32 GB format cap), the security differences and the commands.
%windir% is an environment variable that points to the Windows folder, usually C:\Windows. Here’s what the common variables mean, the difference between user and system variables, set vs setx, PowerShell’s $Env: syntax and how PATH finds programs.
PHP’s ‘Cannot modify header information – headers already sent’ warning means something was output before header() or session_start(). How to read ‘output started at’, and fixes for spaces, BOMs, echo, closing tags, includes and output buffering. Tested.