Repair BOOTREC /FIXBOOT “Access is denied” or “Element not found”

Windows does not start, and while attempting recovery, bootrec /fixboot returns Access is denied or Element not found. The command failure is a repair-path symptom, not the original diagnosis. On a UEFI/GPT installation, Windows normally starts through EFI boot files and a BCD store on the EFI System Partition; rewriting a legacy-style partition boot sector with /fixboot may be unnecessary. On BIOS/MBR, the system partition and boot-code path are different.

This procedure first detects the layout and confirms that Windows Boot Manager/BCD files are the actual broken layer. It then uses BCDBoot to provision boot files from the verified Windows installation without formatting or recreating a healthy system partition.

Searchable Windows error codes and exact messages

Use this procedure when:

• the correct Windows 10 or Windows 11 installation is readable in WinRE;
• the system disk is consistently detected;
• the original startup symptom points to BCD or Windows boot files;
• bootrec /fixboot returns Access is denied or Element not found;
• DiskPart can unambiguously identify the Windows disk, partition style, and existing system partition; and
• the system partition is present and readable rather than deleted or RAW.

It applies to both UEFI/GPT and BIOS/MBR only after the correct branch is detected.

Do not use this procedure when the disk disappears, the intended Windows volume is RAW, the partition table is damaged, the EFI/System Reserved partition is deleted, the Windows installation cannot be identified, or BitLocker remains locked.

It does not apply to BOOTMGR is missing caused only by the wrong MBR Active partition, a missing firmware boot entry with otherwise healthy boot files, a controller-mode change, a failed physical drive, Secure Boot signature enforcement, or a third-party multiboot manager without its own recovery plan.

Do not use it merely because an online guide told the user to run all four BOOTREC commands. The original startup evidence must reach the BCD/boot-file layer.

Why /fixboot was refused, which prior update changed the boot files, and the exact Windows build may remain unknown.

The following may not remain unknown before BCDBoot writes:

• the Windows volume and physical disk number;
• whether that disk is GPT or basic MBR;
• the exact existing system partition;
• whether that partition is FAT32 EFI System Partition or NTFS BIOS system partition;
• every readable BCD store and its backup location, or an explicit record that the expected store is absent/unreadable;
• the expected firmware branch (UEFI or BIOS); and
• whether another boot manager intentionally owns the system partition.

The firmware setup's marketing label is not required. Disk layout and boot files determine the branch.

• Windows Recovery Environment or current Windows 10/11 installation media
• Administrative Command Prompt
• A consistently detected Windows disk
• A verified backup of important files
• A photograph or text record of list disk, list volume, list partition, and relevant detail output
• Unused temporary letters for the verified Windows and system volumes
• Enough free space on the Windows or external evidence volume for BCD copies and listings
• A readable BCD-Template in the verified Windows installation
• The original firmware boot order and other internal boot disks recorded

Disconnect unrelated bootable internal disks when this can be done safely. Otherwise stop if the correct system partition cannot be made unambiguous.

1. Disconnect external hard drives, memory cards, optical media, and unrelated USB storage. Keep recovery media deliberately in use.
2. Enter Troubleshoot > Advanced options > Command Prompt.
3. Do not run clean, convert, create, delete, format, set id, active, or inactive.
4. Do not assume the offline Windows installation is C:.
5. This procedure uses W: for detected Windows and S: for the detected system partition. Before assignment, list volume must prove both letters are unused.

1. Photograph the original Windows Recovery screen, including the complete code, File:, and Info: fields. Record the exact BOOTREC command and response.

2. Inspect without changing layout:

   diskpart
   list disk
   list volume
   

3. Select the already-identified Windows volume, confirm it, and assign W::

   select volume <Windows-volume-number>
   detail volume
   assign letter=W
   detail volume
   exit
   

4. Verify the source files:

   dir W:\Windows\System32\Config\SYSTEM
   dir W:\Windows\System32\Config\BCD-Template
   dir W:\Windows\System32\winload.exe
   dir W:\Windows\System32\winload.efi
   

5. Map W: to its physical disk and detect partition style:

   diskpart
   select volume <Windows-volume-number>
   detail volume
   select disk <Windows-disk-number>
   detail disk
   list partition
   

   • A * in list disk's GPT column routes to UEFI/GPT.
   • No * routes to BIOS/MBR only when detail disk confirms a fixed basic MBR disk.
   • Dynamic, removable, read-only for an unexplained reason, or ambiguous disks are stop conditions.

6. Identify the existing system partition from evidence:

   • UEFI/GPT: a small FAT32 partition on the intended disk whose type/role is System, normally containing \EFI\Microsoft\Boot.
   • BIOS/MBR: the verified Active NTFS system partition, which can be System Reserved or the Windows partition itself.
   • Size alone never identifies a system partition.

7. Assign S: to the separate verified system partition when one exists:

   select partition <system-partition-number>
   detail partition
   assign letter=S
   detail partition
   exit
   

   If the BIOS/MBR Windows volume itself is the verified system partition, use W: for both roles. For the BIOS commands below, set BOOTVOL explicitly after detection:

   set "BOOTVOL=S:"
   

   Use set "BOOTVOL=W:" instead only when the verified Windows volume itself is the BIOS system partition. Run echo %BOOTVOL% and stop if it does not show the detected target.

8. Inspect the files without formatting:

   UEFI:

   dir /a S:\EFI\Microsoft\Boot
   dir /a S:\EFI\Microsoft\Boot\BCD
   

   BIOS:

   dir /a %BOOTVOL%\
   dir /a %BOOTVOL%\Boot
   dir /a %BOOTVOL%\Boot\BCD
   dir /a %BOOTVOL%\bootmgr
   

9. Check the Windows and system volumes without repair switches:

   chkdsk W:
   

   On UEFI run chkdsk S:. On BIOS run chkdsk %BOOTVOL%. Do not run chkdsk S: when no S: was assigned.

   Stop for I/O errors, RAW, unreadable metadata, or an unstable disk.

10. Create a new unused attempt directory and preserve the readable BCD/boot tree. Use the next attempt number if FIX062-Attempt-01 already exists. UEFI example:

    set "EVID=W:\BootRepairBackup\FIX062-Attempt-01"
    if exist "%EVID%\" (echo STOP: %EVID% already exists. Set EVID to the next unused FIX062 attempt and rerun this block. & exit /b 1)
    md "%EVID%"
    if errorlevel 1 (echo STOP: Could not create %EVID%. & exit /b 1)
    echo FIX-062 UEFI attempt>"%EVID%\attempt-marker.txt"
    echo Windows=W: ESP=S:>>"%EVID%\attempt-marker.txt"
    copy S:\EFI\Microsoft\Boot\BCD "%EVID%\BCD-before"
    bcdedit /store S:\EFI\Microsoft\Boot\BCD /enum all /v > "%EVID%\BCD-before.txt"
    robocopy S:\EFI "%EVID%\EFI-before" /E /COPY:DAT /R:0 /W:0
    set "RC_BOOT_BACKUP=%ERRORLEVEL%"
    

    BIOS example:

    set "EVID=W:\BootRepairBackup\FIX062-Attempt-01"
    if exist "%EVID%\" (echo STOP: %EVID% already exists. Set EVID to the next unused FIX062 attempt and rerun this block. & exit /b 1)
    md "%EVID%"
    if errorlevel 1 (echo STOP: Could not create %EVID%. & exit /b 1)
    echo FIX-062 BIOS attempt>"%EVID%\attempt-marker.txt"
    echo Windows=W: System=%BOOTVOL%>>"%EVID%\attempt-marker.txt"
    copy %BOOTVOL%\Boot\BCD "%EVID%\BCD-before"
    copy %BOOTVOL%\bootmgr "%EVID%\bootmgr-before"
    bcdedit /store %BOOTVOL%\Boot\BCD /enum all /v > "%EVID%\BCD-before.txt"
    robocopy %BOOTVOL%\Boot "%EVID%\Boot-before" /E /COPY:DAT /R:0 /W:0
    set "RC_BOOT_BACKUP=%ERRORLEVEL%"
    

    Require Robocopy exit code 0–7 with no failed files and inspect the destination. If the BCD/boot file is absent or unreadable, create a text record of that condition in %EVID% and continue only when the Windows source, layout, target, and storage health remain certain; confidence and file-level rollback are then lower.

11. Inspect the readable store. The intended loader should reference the verified Windows device, \Windows\System32\winload.efi for UEFI or winload.exe for BIOS, and \Windows as systemroot.

12. If Windows Boot Manager already displayed a BCD code, the firmware and initial boot loader ran. In that case, /fixboot failure can be incidental; focus on provisioning the verified store, not rewriting every boot layer.

13. Proceed only when the Windows source, system target, and layout are established and every readable boot artifact is backed up; an absent/unreadable BCD must be explicitly documented rather than treated as a successful backup.

Choose one detected branch.

Branch A — UEFI/GPT with an existing healthy FAT32 EFI System Partition

1. Reconfirm W: and S: after any restart.

2. Copy Windows UEFI boot files to the verified EFI System Partition:

   bcdboot W:\Windows /s S: /f UEFI /v
   

3. Continue only if the result is Boot files successfully created.

4. Enumerate the repaired store:

   bcdedit /store S:\EFI\Microsoft\Boot\BCD /enum all /v > "%EVID%\BCD-after.txt"
   

5. Confirm the expected files now exist:

   dir /a S:\EFI\Microsoft\Boot\bootmgfw.efi
   dir /a S:\EFI\Microsoft\Boot\BCD
   

6. The explicit /s S: form targets the verified partition but does not create an NVRAM firmware entry. If a Windows Boot Manager entry already existed, restart and test it.

7. If the firmware entry is absent, isolate other bootable disks and revalidate the single intended system disk. Prove this WinRE session is UEFI-booted, then capture a named pre-write firmware listing:

   wpeutil UpdateBootInfo
   reg query HKLM\System\CurrentControlSet\Control /v PEFirmwareType
   bcdedit /enum firmware /v > "%EVID%\firmware-before-addlast.txt"
   

   Require PEFirmwareType REG_DWORD 0x2 and a successful firmware enumeration. If the value is 0x1, missing, or firmware enumeration is unavailable, stop and restart recovery media through its UEFI entry. GPT describes the disk layout; it does not prove that this recovery session can write UEFI variables. Only after that gate, run:

   bcdboot W:\Windows /addlast /v
   

   This allows BCDBoot to select the system partition and create/update the UEFI firmware entry without the invalid combination of /f and no /s. /addlast places a newly created entry last so it can be tested before promotion. Do not use it while multiple system partitions remain ambiguous.

8. Continue only if BCDBoot reports Boot files successfully created. Capture the required post-write state:

   bcdedit /enum firmware /v > "%EVID%\firmware-after-addlast.txt"
   

   Compare firmware-before-addlast.txt and firmware-after-addlast.txt and record the exact newly created Windows Boot Manager GUID, if any. Do not infer it from the description alone.

9. Restart into the firmware one-time boot menu and select that exact new entry once. If it does not start the verified Windows installation, do not promote it; return to WinRE, preserve the failure, and use the rollback section. If it starts correctly, enter firmware setup and move that proven entry to the intended persistent position. Only after this one-time test may Branch C be used for a remaining Windows boot-chain failure.

Branch B — BIOS/MBR with an existing verified Active NTFS system partition

1. Reconfirm that the disk is fixed basic MBR and the selected system partition is already the intended Active partition.

2. Copy BIOS boot files and build the BCD on that partition:

   bcdboot W:\Windows /s %BOOTVOL% /f BIOS /v
   

3. Continue only after Boot files successfully created.

4. Enumerate and save the new store:

   bcdedit /store %BOOTVOL%\Boot\BCD /enum all /v > "%EVID%\BCD-after.txt"
   

5. Do not change Active flags in this procedure. If the correct partition was not already Active, route to the wrong-Active-partition repair.

Branch C — BCDBoot succeeds but the first restart still fails

1. Record the new exact code and file path; it can be different from the original.
2. Run Startup Repair once from WinRE. It can repair a remaining firmware-entry or boot-chain inconsistency after valid files exist.
3. Restart once and record the result.
4. Do not loop Startup Repair repeatedly. If it reports it could not repair the PC, preserve SrtTrail.txt and route by its actual finding.

Branch D — BCDBoot fails

Do not retry with /f ALL, format the system partition, or copy files from another computer. Record the full BCDBoot output and recheck:

• correct W:\Windows source and BCD-Template;
• correct S: target and file system;
• free space;
• write protection;
• file-system health;
• storage I/O; and
• whether another disk's system partition was selected.

Stop until the failed prerequisite is resolved.

• BCDBoot succeeds and Windows starts: the /fixboot error did not require a format; valid boot files/BCD resolved the actual layer.
• BCDBoot succeeds and Startup Repair completes the start: record both actions. The result does not prove Startup Repair alone would have worked.
• A new BCD code appears: route by its complete code, file, and message; do not repeat /fixboot.
• The firmware entry is missing after the explicit /s command: expected behavior is possible because /s does not create the NVRAM entry. Use the controlled missing-entry step only after isolating the intended disk.
• Total identified Windows installations: 0 remains but BCDBoot works: the BOOTREC scan result was not proof that Windows was absent.
• The disk or partition becomes unreadable: stop software repair and move to storage/data recovery.

• Do not format the EFI System Partition to solve Access is denied.
• Do not delete or recreate a present, healthy EFI/System Reserved partition.
• Do not use diskpart clean, convert, set id, or a guessed partition type.
• Do not run active on GPT or change an MBR Active flag without the dedicated diagnosis.
• Do not use /f ALL when the detected branch is known.
• Do not use a guessed C:\Windows in WinRE.
• Do not copy another computer's BCD or boot files.
• Do not assume an older recovery disk is better merely because one historical case succeeded with it; use current compatible media unless a documented version-specific regression is proven.
• Do not continue after BCDBoot reports failure.

1. Return to WinRE and redetect W: and the system target; letters can change. List the attempt directories, reset EVID to the exact attempt recorded before the write, and inspect its marker and backups before restoring anything. For example, when the recorded attempt was 01:

   dir W:\BootRepairBackup
   set "EVID=W:\BootRepairBackup\FIX062-Attempt-01"
   type "%EVID%\attempt-marker.txt"
   dir "%EVID%\BCD-before"
   

   If the recorded attempt was not 01, substitute that exact number. Stop if the marker branch, volume identities, directory, or expected same-attempt files do not match. On BIOS, also reset BOOTVOL to S: for a separate System Reserved partition or W: when the Windows volume itself is the verified system partition, and require it to match the marker.

2. Copy the failed post-change store aside before restoring anything.

3. UEFI rollback:

   copy S:\EFI\Microsoft\Boot\BCD "%EVID%\BCD-after-failed"
   attrib -s -h -r S:\EFI\Microsoft\Boot\BCD
   copy /y "%EVID%\BCD-before" S:\EFI\Microsoft\Boot\BCD
   

4. BIOS rollback:

   copy %BOOTVOL%\Boot\BCD "%EVID%\BCD-after-failed"
   attrib -s -h -r %BOOTVOL%\Boot\BCD
   copy /y "%EVID%\BCD-before" %BOOTVOL%\Boot\BCD
   copy /y "%EVID%\bootmgr-before" %BOOTVOL%\bootmgr
   

5. Restore only a readable backup taken from the same system partition. If the original file did not exist, do not pretend rollback is possible by copying an unrelated file. Restoring BCD/bootmgr is not a byte-for-byte rollback of every boot file BCDBoot may refresh; use the full tree captures only to compare and restore exact changed files on the same partition.

6. If the automatic UEFI BCDBoot step created a new unwanted firmware entry, compare firmware listings, boot a known-good entry once, and delete only the newly identified GUID with bcdedit /delete {GUID}.

1. Remove recovery media and unrelated external storage.

2. Start Windows three times: one restart and two cold starts.

3. Confirm the intended installation and user profile load.

4. In an elevated prompt, save the working state:

   md "%SystemDrive%\BootRepairBackup\FIX062-working"
   bcdedit /enum all /v > "%SystemDrive%\BootRepairBackup\FIX062-working\BCD-working.txt"
   bcdedit /enum firmware /v > "%SystemDrive%\BootRepairBackup\FIX062-working\firmware-working.txt"
   

5. Open Disk Management and verify no partition was formatted, resized, deleted, or given an unintended persistent letter.

6. Remove temporary letters from the EFI/System Reserved partition when WinRE did not remove them automatically:

   diskpart
   list volume
   select volume <verified-system-volume-number>
   detail volume
   remove letter=S
   exit
   

7. Confirm WinRE remains available from Settings > System > Recovery > Advanced startup when practical.

Confidence is approximately 80% when Windows Boot Manager originally reached a BCD/file error, the correct Windows and system partitions are unambiguous and healthy, BCDBoot reports success on the detected branch, and Windows completes repeated cold starts. Confidence is lower when Startup Repair is also required or the original BCD was unreadable and could not be backed up.

The three underlying records confirm three variations: an older recovery environment succeeded where the current attempt had not, BCDBoot followed by Automatic Repair completed recovery, and mounting the verified system/EFI volume plus BCDBoot resolved Element not found cases. The safe common mechanism is correct-layout BCDBoot, not indiscriminate use of older media or formatting.

Stop if the disk is unstable, layout is ambiguous, the system partition is missing/RAW, BCDBoot fails, the Windows source cannot be verified, the case uses an intentional non-Windows boot manager, or a controller-mode/firmware conversion would be required. Escalate with the original screen, DiskPart evidence, BCD copies, BCDBoot output, and after-state code.