[Previous] [Next]

Lesson 1: The Boot Process

In this lesson, you will learn that the Windows 2000 boot process occurs in five stages: the preboot sequence, boot sequence, kernel load, kernel initialization, and logon. You will be able to troubleshoot more effectively by learning about the phases in the Windows 2000 boot process and the files used in each phase.

After this lesson, you will be able to

• Explain the boot process for Intel-based computers.

Estimated lesson time: 25 minutes

Files Used in the Boot Process

An Intel-based boot sequence requires certain files. Table 22.1 lists the files
used in the Windows 2000 Intel-based boot process, the appropriate location of each file, and the stages of the boot process associated with each file. Systemroot represents the path to your Windows 2000 installation folder, which will be C:\Winnt if you've followed the installation instructions in Chapter 2, "Installing Windows 2000 Professional."

NOTE

---

To view the files listed in Table 22.1, open Windows Explorer and click Folder Options on the Tools menu. On the View tab of the Folder Options dialog box, click Show Hidden Files And Folders, and clear (remove the check mark from) the Hide Protected Operating System Files (Recommended) check box. A Warning box appears indicating that it is not a good idea to display the protected operating system files. Click Yes to display them.

Table 22.1 Files Used in the Windows 2000 Boot Process

NOTE

---

The string systemroot (typed as %systemroot%) is a placeholder for the folder in the boot partition that contains the Windows2000 system files.

Preboot Sequence

During startup, a Windows 2000-based computer initializes and then locates the boot portion of the hard disk.

The following four steps occur during the preboot sequence:

1. The computer runs power-on self test (POST) routines to determine the amount of physical memory, whether the hardware components are present, and so on. If the computer has a Plug and Play basic input/output system (BIOS), enumeration and configuration of hardware devices occurs at this stage.
2. The computer BIOS locates the boot device and loads and runs the master boot record (MBR).
3. The MBR scans the partition table to locate the active partition, loads the boot sector on the active partition into memory, and then executes it.
4. The computer loads and initializes the Ntldr file, which is the operating system loader.

NOTE

---

Windows 2000 modifies the boot sector during installation so that Ntldr loads during system startup.

Boot Sequence

After the computer loads Ntldr into memory, the boot sequence gathers information about hardware and drivers in preparation for the Windows 2000 load phases. The boot sequence uses the following files: Ntldr, Boot.ini, Bootsect.dos (optional), Ntdetect.com, and Ntoskrnl.exe.

The boot sequence has four phases: initial boot loader, operating system selection, hardware detection, and configuration selection.

Initial Boot Loader

During the initial boot loader phase, Ntldr switches the microprocessor from
real mode to 32-bit flat memory mode, which Ntldr requires to carry out any
additional functions. Next, Ntldr starts the appropriate minifile system drivers. The minifile system drivers are built into Ntldr so that Ntldr can find and load Windows 2000 from partitions formatted with either FAT or Microsoft Windows 2000 File System (NTFS).

Operating System Selection

During the boot sequence, Ntldr reads the Boot.ini file. If more than one operating system selection is available in the Boot.ini file, then the Please Select The Operating System To Start screen appears, listing the operating systems specified in the Boot.ini file. If you don't select an entry before the timer reaches zero, Ntldr loads the operating system specified by the default parameter in the Boot.ini file. Windows 2000 Setup sets the default parameter to the most recent Windows 2000 installation. If only one entry is in the Boot.ini file, the Please Select The Operating System To Load screen doesn't appear, and the default
operating system is automatically loaded.

NOTE

---

If the Boot.ini file isn't present, Ntldr attempts to load Windows 2000 from the Winnt folder on the first partition of the first disk, typically C:\Winnt.

Hardware Detection

On Intel-based computers, Ntdetect.com and Ntoskrnl.exe perform hardware
detection. Ntdetect.com executes after you select Windows 2000 on the Please Select The Operating System To Start screen (or after the timer times out).

NOTE

---

If you select an operating system other than Windows 2000, such as Microsoft Windows 98, Ntldr loads and executes Bootsect.dos. Bootsect.dos
is a copy of the boot sector that was on the system partition at the time that
Windows 2000 was installed. Passing execution to Bootsect.dos starts the boot process for the selected operating system.

Ntdetect.com collects a list of currently installed hardware components
and returns this list to Ntldr for later inclusion in the registry under the HKEY_LOCAL_MACHINE\HARDWARE key.

Ntdetect.com detects the following components:

• Bus/adapter type
• Communication ports
• Floating-point coprocessor
• Floppy disks
• Keyboard
• Mouse/pointing device
• Parallel ports
• SCSI adapters
• Video adapters

After Ntldr starts loading Windows 2000 and collects hardware information, the operating system loader process presents you with the Hardware Profile/Configuration Recovery Menu screen. The Hardware Profile/Configuration Recovery Menu screen contains a list of the hardware profiles that are set up on the computer. The first hardware profile is highlighted. You can press the Down arrow key to select another profile. You can also press L to invoke the Last Known Good Configuration option.

If there is only a single hardware profile, Ntldr doesn't display the Hardware
Profile/Configuration Recovery Menu screen and loads Windows 2000 using the default hardware profile configuration.

Kernel Load

After configuration selection, the Windows 2000 kernel (Ntoskrnl.exe) loads and initializes. Ntoskrnl.exe also loads and initializes device drivers and loads services. If you press Enter when the Hardware Profile/Configuration Recovery Menu screen displays, or if Ntldr makes the selection automatically, the computer enters the kernel load phase. The screen clears and a series of white rectangles appears across the bottom of the screen.

During the kernel load phase, Ntldr does the following:

• Loads Ntoskrnl.exe but doesn't initialize it.
• Loads the hardware abstraction layer file (Hal.dll).
• Loads the HKEY_LOCAL_MACHINE\SYSTEM registry key from systemroot\System32\Config\System.
• Selects the control set it will use to initialize the computer. A control set contains configuration data used to control the system, such as a list of the device drivers and services to load and start.
• Loads device drivers with a value of 0x0 for the Start entry. These are typically low-level hardware device drivers, such as those for a hard disk. The value
  for the List entry, specified in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder subkey of the registry, defines the order in which Ntldr loads these device drivers.

When the kernel load phase is complete, the kernel initializes, and then Ntldr passes control to the kernel. At this point, the system displays a graphical screen with a status bar indicating load status. Four tasks are accomplished during the kernel initialization stage:

1. The Hardware key is created. Upon successful initialization, the kernel uses the data collected during hardware detection to create the registry key HKEY_LOCAL_MACHINE\HARDWARE. This key contains information about hardware components on the system board and the interrupts used by specific hardware devices.
2. The Clone control set is created. The kernel creates the Clone control set by copying the control set referenced by the value of the Current entry in the HKEY_LOCAL_MACHINE\SYSTEM\Select subkey of the registry. The Clone control set is never modified, as it is intended to be an identical copy of the data used to configure the computer and should not reflect changes made during the startup process.
3. Device drivers are loaded and initialized. After creating the Clone control set, the kernel initializes the low-level device drivers that were loaded during the kernel load phase. The kernel then scans the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services subkey of the registry for device drivers with a value of 0x1 for the Start entry. As in the kernel load phase, a device driver's value for the Group entry specifies the order in which it loads. Device drivers initialize as soon as they load.

If an error occurs while loading and initializing a device driver, the boot
process proceeds based on the value specified in the ErrorControl entry
for the driver.

Table 22.2 describes the possible ErrorControl values and the resulting boot sequence actions.

ErrorControl values appear in the registry under the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\name_of_service_or_driver\ErrorControl.

4. Services are started. After the kernel loads and initializes device drivers, Session Manager (Smss.exe) starts the higher-order subsystems and services for Windows 2000. Session Manager executes the instructions in the BootExecute data item, and in the Memory Management, DOS Devices, and SubSystems keys.

Table 22.3 describes the function of each instruction set and the resulting
Session Manager action.

Table 22.2 ErrorControl Values and Resulting Action

Table 22.3 Instruction Sets Read and Executed by Session Manager

Logon

The logon process begins at the conclusion of the kernel initialization phase. The Win32 subsystem automatically starts Winlogon.exe, which starts Local Security Authority (Lsass.exe) and displays the Logon dialog box. You can log on at this time, even though Windows 2000 might still be initializing network device drivers.

Next, the Service Controller executes and makes a final scan of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services subkey, looking for services with a value of 0x2 for the Start entry. Services with a value of 0x2 for the Start entry are marked to load automatically. These include the Workstation service and the Server service.

The services that load during this phase do so based on their values for the DependOnGroup or DependOnService entries in the registry subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

Windows 2000 startup is not considered good until a user successfully logs on to the system. After a successful logon, the system copies the Clone control set to the LastKnownGood control set.

Lesson Summary

In this lesson, you learned that the Windows 2000 Intel-based boot process
occurs in five stages: preboot sequence, boot sequence, kernel load, kernel
initialization, and logon. You also learned about the files that are used in the
boot process, where these files are stored, and which stage of the boot process uses them.