Windows XP Boot Process

1. Windows XP Boot Process 70-270: MCSE Guide to Microsoft Windows XP Professional

2. Booting Windows XP (Page 1) • Boot processphases: • Boot phase begins when computer is first powered on • Or begins when Restart is chosen from "Shut Down Windows" dialog box • Windows XP load phases • Begins when boot phase is completed • Configuration is selected

3. Boot Phase Steps Power-on self test (POST) Initial startup Boot loader Select operating system Detect hardware Select configuration Windows XP Load Phase Load the kernel Initialize the kernel Services load Windows XP system startup Log on Booting Windows XP (Page 2)

4. Power-on Self Test (Page 1) • First step in boot sequence (the POST) for any computer with an operating system • Determines: • Amount of real memory that exists • Whether or not all necessary hardware components are present and functioning • The specific tests vary depending on how the BIOS (Basic Input/Output System) is configured

5. Power-on Self Test (Page 2) • If POST is successful, computer boots itself • If the tests are unsuccessful, the computer reports error by: • Emitting a series of beeps (number of beeps identifies the error—differs from one BIOS to another) • Also possibly might display error message and a code on the screen

6. Power-on Self Test (Page 3) • Software that performs POST resides in called the CMOS (complementary metal oxide semiconductor) • Battery-powered chip that also can hold basic configuration information so POST can check installed RAM, number and type of hard drives, type of keyboard and mouse, the boot sequence (Which drive first?), etc. • In Windows XP, BIOS no longer stores information about devices and drivers connected to system (replaced by the HAL)

7. Power-on Self Test • The following screen shows results of sample successful POST completion

8. Power-on Self Test

9. Power-on Self Test (Page 4) • After POST completes, each adapter with a BIOS performs its own self-test (POST), i.e. • Video card • SCSI (small computer system interface) cards which are interfaces that provide much faster data transmission rates than standard parallel and serial ports; used for printers, scanners, etc. • Adapters issue their own reports on monitor

10. Power-on Self Test (Page 5) • At this point there still is no operating system in RAM … • POST application in the BIOS is in control • Output on screen is in basic, text-only form

11. Initial Startup (Page 1) • The BIOS finds the first sector of the first hard drive which contains the Master Boot Record (MBR) and transfers control to it: • It is the job of MBR ultimately to load the Ntldr program (the boot loader program) and pass control of the boot process on to it (either directly or indirectly)

12. Initial Startup (Page 2) • The Master Boot Record (con.): • In FAT partitions, because the boot sector is only one sector in size, MBR points to another location on disk which then points to the boot loader • In NTFS partitions, boot sectors may be up to 16 sectors in size so it is large enough to store the code to find the boot loader • If booting from a floppy, the first sector contains the partition boot sector

13. Initial Startup (Page 3) • BIOS stores information as to the order in which drives are checked to see which is the startup drive (as stored in CMOS) • If floppy drive is in the sequence, partition boot sector is loaded and runs the MBR from the floppy • If the floppy does not have a partition boot sector, the message "Non-system disk or disk error …" appears • Remove disk, and turn machine off an then on—do not reboot to avoid viruses

14. Initial Startup (Page 3) • Ntldr is stored on the system partition • This is the partition where the MBR expects to find the system • Ultimately its job is to boot the Windows XP operating system which is stored on the boot partition • The system itself actually can be stored on any partition • The system and boot partitions may or may not be the same

15. Boot Loader (Page 1) • Collection of files on system partition used to initiate loading of operating system • Required files to boot Windows XP are Ntldr, Ntdetect.com and Boot.ini • Other optional boot loader programs are Bootsect.dos and Ntbootdd.sys

16. Windows XP Startup Files

17. Boot Loader (Page 2) • The boot loader first switches processor into 32-bit mode • Previously it had been running in real mode as if it were an 8088 or 8086 machine • Next it starts the appropriate file system, FAT, FAT32 or NTFS • The ability to access any of the file systems is programmed into Ntldr

18. Boot Loader (Page 3) • Primary functions of the boot loader are to: • Select the operating system to load if there is more than one from which to choose • Detect hardware • Select a configuration • Ntldr stays in control throughout boot loader process until it loads and passes control to Windows XP kernel (Ntoskrnl.ext)

19. Selecting the Operating System • Ntldr reads Boot.ini and displays the Boot selection menu (if necessary) • Contains operating system choices, if more that one, from which the user may choose • It also is possible from this screen to press <F8> to reach the "Troubleshooting and Advanced Startup" screen (more later) • Will auto select first option after a specified number of seconds • Change default O/S or time in Boot.ini

20. Boot Selection Menu

21. Detecting Hardware • If the user selects Windows XP (or if it is the only O/S present), Ntldr executes Ntdetect.com • Used to collect a list of hardware currently installed in computer • From hardware list, creates system profile • Later will be compared to Windows XP Registry entries for discrepancies that could lead to problems

22. Selecting a Configuration • Next boot loader selects a configuration • Known as the hardware profile • If there is one hardware profile, it is selected • If there is more than one, system tries to select one that matches detected hardware • If system cannot make automatic selection, user is prompted for manual selection

23. Troubleshooting and Advanced Startup Options (Page 1) • Windows XP combines the boot and recovery options of Windows NT and Windows 95/98 • Provides several options to restore a malfunctioning system to functional state • Before timer expires, or Windows XP kernel starts to load, press <F8> to access Windows Advanced Options Menu

24. Troubleshooting and Advanced Startup Options

25. Troubleshooting and Advanced Startup Options (Page 2) • Contents of menu may include: • Safe Mode—boots Windows XP with only minimum system files and drivers • May be able to boot into a functioning system when some drivers are corrupted • Might allow replacing or removing the problem driver before rebooting • Safe Mode with Networking—same as above but with networking components • If network drivers are not the problem

26. Troubleshooting and Advanced Startup Options (Page 3) • Contents of menu may include (con.): • Safe Mode with Command Prompt—same as above but not to the GUI environment • Enable Boot Logging—enables or disables boot process, and writes details to log file Ntbtlog.txt in %systemroot% folder • Records process of steps between boot menu and logon prompt which could provide clues to which driver, system or procedure is causing the problem

27. Troubleshooting and Advanced Startup Options (Page 4) • Contents of menu may include (con.): • Enable VGA Mode—normal boot but with only basic VGA video driver (in case there is a bad video driver) • Last Known Good Configuration—state of Registry during last successful user logon • Could be useful if a new driver or software recently has been installed, or the Registry was recently modified

28. Troubleshooting and Advanced Startup Options (Page 5) • Contents of menu may include (con.): • Directory Services Restore Mode—only on Windows XP domain controllers, restores Active Directory

29. Troubleshooting and Advanced Startup Options (Page 6) • Contents of menu may include (con.): • Debugging Mode—normal boot but sends debugging information to another system over a serial cable • If no other option helps in restoring system, may help determine where in boot process the problem occurs • Complex information usually used by high-end programmers—consult Microsoft Windows XP Professional Resource Kit

30. *** Activity *** • Try one or more of following boot options (press <F8> function key during boot): • Safe Mode • Safe Mode with Command Prompt • Enable VGA Mode • Last Known Good Configuration • Reboot normally when done

31. Boot Configuration and Selecting an Operating System (Page 1) • Controlled through configuration of the Boot.ini file … • Located in the root directory of the system partition (usually drive C:\) • To view the file, uncheck "Hide Protected operating system files" in Folder Options • Updated from the "System and Recovery" dialog window on the Advanced tab of Control Panel's System applet To Sample"Boot.ini"

32. Boot Configuration and Selecting an Operating System (Page 2) • Used by boot loader to display the list of available operating systems • Consists of two sections: [boot loader] and [operating systems] To Sample"Boot.ini"

33. Sample "Boot.ini" Return

34. [boot loader] • Settings: • Timeout—number of seconds system waits for user to select an operating system … • If set to zero (0), the default operating system is loaded automatically • If set to (-1), waits indefinitely (this value only can be set in text editor—an invalid value in System applet in "Control Panel" • Default—shows path to default O/S To Sample"Boot.ini"

35. [operating systems] (Page 1) • Lists available operating systems as follows: • Path to boot partition for operating system • Text displayed in boot loader screen • Optional parameters (switches) provide options many of which are equivalent to <F8> "Windows Advanced Options Menus" • As well as a few other options To Sample"Boot.ini"

36. [operating systems] (Page 2) • Switches: • /BASEVIDEO—same as Enable VGA Mode • /BAUDRATE=n—baud rate for Debugging Mode • /BOOTLOG—same as Enable Boot Logging • /CRASHDEBUG—starts Debugging Mode but remains inactive until STOP error occurs

37. [operating systems] (Page 3) • Switches (con.): • /DEBUG—starts Debugging Mode and allows access by the remote computer • /DEBUGPORT={com1|com2|1394}—sets port for Debugging Mode • /FASTDETECT={com1|com2|…}—specifies serial ports to skip during hardware scan • All if no port specified • Included in every entry by default when the operating system is installed

38. [operating systems] (Page 4) • Switches (con.): • /MAXMEM=n—sets maximum RAM O/S can use • /NOGUIBOOT—boots without showing splash screen • /NODEBUG—disables Debugging Mode • /NUMPROC=n—sets maximum number of processors on multiprocessor machine that O/S may use

39. [operating systems] (Page 5) • Switches (con.): • /SAFEBOOT:MINIMAL—boots to Safe Mode • /SAFEBOOT:NETWORK—boots to Safe Mode with Networking • /SAFEBOOT:MINIMAL(ALTERNATESHELL)—boots to Safe Mode with Command Prompt • /SOS—displays device driver names when they are loaded

40. Advanced RISC Computing Pathnames (Page 1) • Advanced RISC Computing pathname is a path naming convention that is used in the "Boot.ini" file • Defines the hard disk, partition and folder where Windows XP Professional and any other operating systems reside • Created automatically when an operating system is installed into a partition To Sample"Boot.ini"

41. Advanced RISC Computing Pathnames (Page 2) • The parts of the path are: • scsi(n) or multi(n)—whether the drive type is SCSI or other (multi) and the adapter number • disk(n)—the SCSI bus number • rdisk(n)—which disk contains the O/S • partition(n)—selects partition with the O/S • \path—select path with the O/S To Sample"Boot.ini"

42. Editing Boot.ini • Options for editing (see next slides): • Use Control Panel to edit indirectly • Use text editor (i.e. Notepad) to change the Boot.ini file directly

43. Using Control Panel • Safest way to proceed • Select System applet in "Control Panel", then select Advanced tab, and the Startup and Recovery <Settings> button • Options to modify: • Choose "Default operating system" (the default boot selection) • Select "Time to display list of operating systems" (delay interval before boot selection starts automatically)

44. Startup and Recover Dialog

45. Using a Text Editor • Use Notepad or any other text editor • The <Edit> button in the "Startup and Recovery" window launches Notepad and opens the Boot.ini file • Be careful when editing file • Windows XP might not boot if there is an incorrect configuration • Create backup copy of the file before making changes

46. *** Activity *** • Before starting this activity, you should backup boot.ini • Modify "timeout" value using Notepad • Set the "timeout" value back to its original value (30) using Startup and Recovery dialog in System applet in "Control Panel" • Return to Notepad and open boot.ini to confirm the change

47. See next slide *** Activity *** • Before starting this activity, you should backup boot.ini • In Notepad, create one or more additional operating system entries, i.e. • An additional Windows XP Professional entry but booting in VGA Mode • A fictional entry for Windows 2000 on an alternate partition

48. Sample "Boot.ini" [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Pro VGA Mode" /fastdetect /basevideo multi(0)disk(0)rdisk(3)partition(2)\WINNT="Microsoft Windows 2000" /fastdetect To Sample"Boot.ini"

49. Windows XP Load Phase • Stages: • Loading the kernel • Initializing the kernel • Services load • Windows XP system startup • Logging on

50. Loading the Kernel (Page 1) • Once Windows XP is selected as O/S to boot, a "Starting Windows…" text message and the XP splash screen are displayed • During this time the boot loader loads the kernel into memory (consists of): • Windows XP kernel (Ntoskrnl.exe) • Hardware abstraction layer (HAL), the file that is named Hal.dll