Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. ntbtlog.txt
LogRisk: Safe

ntbtlog.txt C:\Windows\ntbtlog.txt

ntbtlog.txt, the Windows boot log: lists the drivers loaded or not loaded at startup when boot logging is turned on.

Updated on By AltF4 Formation

What it’s for

ntbtlog.txt exists only if boot logging was requested. It shows, driver by driver, what the kernel loaded, which is valuable when a boot crashes or hangs: the last driver loaded before the stop often points at the culprit. Turn it on from Startup Settings in the recovery environment (“Enable boot logging”), through Safe Mode, or with the Boot tab of msconfig (“Boot log” check box).

What it contains

A header with the Windows version and the boot date, then one line per driver:

  • Loaded driver \SystemRoot\system32\ntoskrnl.exe for a loaded driver.
  • Did not load driver \SystemRoot\System32\Drivers\xxx.sys for a driver that was not loaded.

Many “Did not load driver” lines are normal: drivers for absent hardware, or drivers not loaded in Safe Mode.

Risks and best practices

  • The file is informational only; deleting it affects nothing.
  • Look for the last “Loaded driver” line before the hang, and compare with a healthy boot rather than trusting a single “Did not load”.
  • Outside troubleshooting, turn boot logging off (clear the msconfig box) so it does not stay on.

Useful commands

Fenêtre de terminal
# Last lines: the last driver loaded before a hang
Get-Content "$env:windir\ntbtlog.txt" -Tail 20


# Drivers that were not loaded
Select-String -Path "$env:windir\ntbtlog.txt" -Pattern 'Did not load driver'

Format

Plain text, one line per driver, in load order. The header carries the system version and the boot timestamp.

Rotation and archiving

There is no rotation. Copy the file before running another logged boot if you want to compare two boots.

How to read it

Read it from the bottom up. Find the last “Loaded driver” entry, note the driver, then look it up with Get-CimInstance Win32_SystemDriver. Cross-check with the System log and, after a blue screen, with memory.dmp.

Report a mistake