| Windows Nt Startup Process |
Article Index for Windows Nt |
Website Links For Windows Nt |
Information AboutWindows Nt Startup Process |
| CATEGORIES ABOUT WINDOWS NT STARTUP PROCESS | |
| windows nt | |
| booting | |
| windows administration | |
| windows components | |
|
In Windows Vista , this process has changed significantly. INITIAL STARTUP PHASE After the computer is turned on, but before the Windows startup process begins, the computer executes a Power-on Self-test (POST), which does an initial check of the computer's hardware. If this process finishes without trouble, control is passed to the hard disk's boot sector, which is the MBR and the code inside it looks for the system partition, and then executes its boot sector, which, in Windows NT -based operating systems, loads NTLDR and then starts executing code in it. BOOT LOADER PHASE When the boot process starts, NTLDR does the following: #Accesses the file system on the boot drive (either FAT or NTFS ). #F8 KeyPressed? #If ''hiberfil.sys'' is found, the contents are loaded into memory and the system resumes where it left off. #Otherwise, '' Boot.ini '' is read, and prompts the user with the boot menu accordingly. #If a non NT-based OS is selected, then NTLDR loads the associated "boot sector" file listed in ''boot.ini'' (''bootsect.dos'' if no file is specified) and gives it control. #If an NT-based OS is selected, then NTLDR runs '' Ntdetect.com '', which gathers information about the computer's hardware. #This information is then passed to '' Ntoskrnl.exe '', the Windows Kernel . KERNEL LOADING PHASE In this stage, NTLDR does the following:
Through this process, a "progress bar" is visible at the bottom of the display on Windows 2000, XP, and Server 2003 systems. Prior to Windows XP, this part of the boot process took significantly longer; this is because the drivers would be initialized one at a time. On Windows XP and Server 2003, the drivers are all initialized asynchronously. Hal.dll The Hardware Abstraction Layer is the interface between the operating system and the computer's hardware. Windows comes with several HAL's to support different kinds of hardware; the one that Windows Setup chooses is named '' Hal.dll '' (generally speaking, uni- vs. multi-processor, ACPI vs. non-ACPI, and APIC vs. PIC , are the determining factors). Control sets The HKLM\SYSTEM portion of the registry contains all the information about detected hardware (both at boot-time and Plug-and-play ), as well as a complete list of Windows Services. This portion of the registry is stored in a file located at %SystemRoot%\System32\Config\system, in a set of registry keys called the ''Control Set''. Multiple control sets (typically two) are kept, in the event that the settings contained in the currently-used one prohibit the system from booting. In HKLM\SYSTEM are control sets labeled ControlSet001, ControlSet002, etc., as well as CurrentControlSet. During regular operation, Windows uses CurrentControlSet to read and write information. CurrentControlSet is a reference to one of the control sets stored in the registry. Windows picks the "real" control set being used based on the values set in the HKLM\SYSTEM\Select registry key:
When a control set is chosen, the Current key gets set accordingly. The Failed key is also set to the same as Current until the end of the boot process. LastKnownGood is also set to Current if the boot process completes successfully.Hardware and drivers The HKLM\HARDWARE section of the registry is populated by the kernel at boot-time with the information about detected hardware that was gathered by ntdetect.com. More specifically:
Drivers are considered by Windows to be "services". As such, all the drivers that are to be loaded at this point are stored in HKLM\SYSTEM\CurrentControlSet\Services.For the purposes of booting, a driver is either a "Boot" driver that is loaded by NTLDR prior to starting the kernel and started before system drivers by the kernel, or a "System" driver, which is loaded and started by ntoskrnl.exe after boot drivers. "Boot" drivers are almost exclusively drivers for hard-drive controllers and file systems ( ATA , SCSI , file system filter manager, etc.); in other words, they are the absolute minimum that ntoskrnl.exe will need to get started with loading other drivers, and the rest of the operating system. "System" drivers cover a wider range of core functionality, including the display driver, CD-ROM support, and the TCP/IP stack.After this (and before any files are opened), Autochk {Link without Title} , a boot-time version of Chkdsk is started; if the computer was not shut down cleanly, Autochk will attempt to repair any potential damage. More detailed information can be found in the Windows XP Resource Kit: Kernel Loading Phase . SESSION MANAGER Once all the Boot and System drivers have been loaded, the kernel (system thread) starts the Session Manager Subsystem ( smss.exe). SMSS is one of the most important components of Windows. At boot time, it:
The Session Manager stores its configuration at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager. The exact operation of most of these items is based on the configuration set in the registry.WINLOGON #ctrl+alt+del #Winlogon calls GINA ##GINA logon dialog box is displayed
##GINA passes credentials back to Winlogon #Winlogon passes credentials to LSA
#Winlogon (loaded by SMSS)
LOGON PHASE After a user has successfully logged in to the machine, Winlogon does the following:
PLUG AND PLAY DEVICE DETECTION (WINDOWS 2000 AND LATER ONLY) SEE ALSO FOOTNOTES |
|
|