Lesson 1: Understanding the Boot Process

Lesson 1:?Understanding the Boot Process

In this lesson, you learn about the files used in the Windows XP Professional boot process. You also learn that the Windows XP Professional boot process occurs in five stages: the preboot sequence, boot sequence, kernel load, kernel initialization, and logon. You learn during which phase each of the boot processes are used and come to understand how to more effectively troubleshoot the Windows XP Professional boot process by learning about its files and phases.

After this lesson, you will be able to

Explain the boot process
Describe the files used in the boot process
Explain the purpose and function of the BOOT.INI file

Estimated lesson time: 40 minutes

Files Used in the Boot Process

The boot sequence requires certain files. Table 18.1 lists the files used in the Windows XP Professional boot process, the appropriate location of each file, and the stages of the boot process associated with each file. Systemroot (typed as %systemroot%) represents the path to your Windows XP Professional installation directory, which will be C:\Windows if you've followed the installation instructions in Chapter 2, "Installing Windows XP Professional."

To view the files listed in Table 18.1, open Windows Explorer and click Folder Options on the Tools menu. In the View tab of the Folder Options dialog box, under Hidden Files And Folders, click Show Hidden Files And Folders. Clear the Hide Protected Operating System Files (Recommended) check box. A Warning message box appears, indicating that it is not a good idea to display the protected operating system files. Click Yes to display them. Click OK to close the Folder Options dialog box.

Table 18.1??Files Used in the Windows XP Professional Boot Process

The BOOT.INI File

When you install Windows XP Professional on a computer, Windows Setup saves the BOOT.INI file in the active partition. NTLDR uses information in the BOOT.INI file to display the boot loader screen, from which you select the operating system to start. In this lesson you learn how to modify the BOOT.INI file, including modifying Advanced RISC Computing (ARC) paths and using the optional BOOT.INI switches.

The BOOT.INI file includes two sections, [boot loader] and [operating systems], that contain information that NTLDR uses to create the Boot Loader Operating System Selection menu. A typical BOOT.INI might contain the following lines:

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00"

multi(0)disk(0)rdisk(1)partition(1)\ WINNT="Windows NT Server Workstation 4.00 [VGA mode]" /basevideo /sos

C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

The [operating systems] section of a BOOT.INI file that is created during a default installation of Windows XP Professional contains a single entry for Windows XP Professional. If your computer is a Microsoft Windows 95-based or Microsoft Windows 98-based dual-boot system, the [operating systems] section also contains an entry for starting the system using the other operating system. If you installed Windows XP Professional on a computer and kept an installation of Microsoft Windows NT 4.0 on another partition of the same computer, the [operating systems] section also contains an entry for starting the system using this version of Windows NT.

ARC Paths

During installation, Windows XP Professional generates the BOOT.INI file, which contains Advanced RISC Computing (ARC) paths pointing to the computer's boot partition. (RISC stands for Reduced Instruction Set Computing, a microprocessor design that uses a small set of simple instructions for fast execution.) The following is an example of an ARC path:

multi(0)disk(0)rdisk(1)partition(2)

Table 18.2 describes the naming conventions for ARC paths.

Table 18.2??ARC Path Naming Conventions


Convention	Description
Multi (x) \| scsi (x)	The adapter/disk controller. Use scsi to indicate a Small Computer System Interface (SCSI) controller on which SCSI basic input/output system (BIOS) is not enabled. For all other adapter/disk controllers, use multi, including SCSI disk controllers with the BIOS enabled. Here, x represents a number that indicates the load order of the hardware adapter. For example, if you have two SCSI adapters in a computer, the first to load and initialize receives number 0, and the next SCSI adapter receives number 1.
Disk(y)	The SCSI ID. For multi, this value is always 0.
Rdisk(z)	A number that identifies the disk (ignored for SCSI controllers).
Partition(a)	A number that identifies the partition.

In both multi and scsi conventions, multi, scsi, disk, and rdisk numbers are assigned starting with 0. Partition numbers start with 1. All nonextended partitions are assigned numbers first, followed by logical drives in extended partitions.

See Figure 18.1 for some examples of how to determine the ARC path name.

Figure 18.1??ARC paths

The scsi ARC naming convention varies the disk(y) parameter for successive disks on one controller, whereas the multi format varies the rdisk(z) parameter.

BOOT.INI Switches

You can add a variety of switches to the entries in the [operating systems] section of the BOOT.INI file to provide additional functionality. Table 18.3 describes some of these optional switches that you can use for entries in the BOOT.INI file.

Table 18.3??BOOT.INI Optional Switches


Switch	Description
/basevideo	Boots the computer using the standard Video Graphics Adapter (VGA) video driver. If a new video driver is not working correctly, use this switch to start Windows XP Professional, and then change to a different driver.
/fastdetect=[comx \| comx,y,z.]	Disables serial mouse detection. Without a port specification, this switch disables peripheral detection on all COM ports. This switch is included in every entry in the BOOT.INI file by default.
/maxmem:n	Specifies the amount of random access memory (RAM) that Windows XP Professional uses. Use this switch if you suspect that a memory chip is bad.
/noguiboot	Boots the computer without displaying the graphical boot status screen.
/sos	Displays the device driver names as they are loading. Use this switch when startup fails while loading drivers to determine which driver is triggering the failure.

Modifications to BOOT.INI

You can modify the time out and default parameter values in the BOOT.INI file using System Properties in Control Panel. In addition, you can manually edit these and other parameter values in the BOOT.INI file. For example, you might modify the BOOT.INI file to add more descriptive entries for the Boot Loader Operating System Selection menu or to include various switches to aid in troubleshooting the boot process.

During Windows XP Professional installation, Windows Setup sets the read-only and system attributes for the BOOT.INI file. Before editing the BOOT.INI file with a text editor, you must make the file visible and turn off the read-only attribute. You can change file attributes using My Computer, Windows Explorer, or the command prompt.

To change file attributes by using My Computer or Windows Explorer, complete the following steps:

Double-click the icon for the drive containing the BOOT.INI file.
On the View menu, click Folder Options.
In the Folder Options dialog box, click the View tab.
Under Hidden Files, click Show All Files, and then click OK.
Right-click BOOT, and then click Properties.
In the General tab, under Attributes, clear the Read-Only check box, and then click OK.

To change file attributes using the command prompt, switch to the directory containing the BOOT.INI file if necessary, and then type

attrib -s -r boot.ini

After you have changed the attributes of the BOOT.INI file, you can open and modify the file using a text editor.

Preboot Sequence

During startup, a computer running Windows XP Professional initializes and then locates the boot portion of the hard disk.

The following four steps occur during the preboot sequence:

The computer runs power-on self test (POST) routines to determine the amount of physical memory, whether the hardware components are present, and so on. If the computer has a Plug and Play BIOS, enumeration and configuration of hardware devices occurs at this stage.
The computer BIOS locates the boot device and loads and runs the master boot record (MBR).
The MBR scans the partition table to locate the active partition, loads the boot sector on the active partition into memory, and then executes it.
The computer loads and initializes the NTLDR file, which is the operating system loader.

Windows XP Professional Setup modifies the boot sector during installation so that NTLDR loads during system startup.

Boot Sequence

After the computer loads NTLDR into memory, the boot sequence gathers information about hardware and drivers in preparation for the Windows XP Professional load phases. The boot sequence uses the following files: NTLDR, BOOT.INI, BOOTSECT.DOS (optional), NTDETECT.COM, and NTOSKRNL.EXE.

The boot sequence has four phases: initial boot loader phase, operating system selection, hardware detection, and configuration selection.

Initial Boot Loader Phase

During the initial boot loader phase, NTLDR switches the microprocessor from real mode to 32-bit flat memory mode, which NTLDR requires to carry out any additional functions. Next, NTLDR starts the appropriate minifile system drivers. The minifile system drivers are built into NTLDR so that NTLDR can find and load Windows XP Professional from partitions formatted with file allocation table (FAT), FAT32, or NT file system (NTFS).

Operating System Selection

During the boot sequence, NTLDR reads the BOOT.INI file. If more than one operating system selection is available in the BOOT.INI file, then the Please Select The Operating System To Start screen appears, listing the operating systems specified in the BOOT.INI file. If you do not select an entry before the timer reaches zero, NTLDR loads the operating system specified by the default parameter in the BOOT.INI file. Windows XP Professional Setup sets the default parameter to the most recent Windows XP Professional installation. If there is only one entry in the BOOT.INI file, the Please Select The Operating System To Start screen does not appear and the default operating system is automatically loaded.

If the BOOT.INI file is not present, NTLDR attempts to load Windows XP Professional from the first partition of the first disk, typically C:\.

Hardware Detection

NTDETECT.COM and NTOSKRNL.EXE perform hardware detection. NTDETECT.COM executes after you select Windows XP Professional on the Please Select The Operating System To Start screen (or after the timer times out).

If you select an operating system other than Windows XP Professional, such as Microsoft Windows 98, NTLDR loads and executes BOOTSECT.DOS, which is a copy of the boot sector that was on the system partition at the time that Windows XP Professional was installed. Passing execution to BOOTSECT.DOS starts the boot process for the selected operating system.

NTDETECT.COM collects a list of currently installed hardware components and returns this list to NTLDR for later inclusion in the registry under the HKEY_LOCAL_MACHINE\HARDWARE key.

NTDETECT.COM detects the following components:

Bus/adapter type
Communication ports
Floating-point coprocessor
Floppy disks
Keyboard
Mouse/pointing device
Parallel ports
SCSI adapters
Video adapters

Configuration Selection

After NTLDR starts loading Windows XP Professional and collects hardware information, the operating system loader presents you with the Hardware Profile/Configuration Recovery menu, which contains a list of the hardware profiles that are set up on the computer. The first hardware profile is highlighted. You can press the down-pointing arrow key to select another profile. You also can press L to invoke the LastKnownGood configuration.

If there is only a single hardware profile, NTLDR does not display the Hardware Profile/Configuration Recovery menu and loads Windows XP Professional using the default hardware profile configuration.

Kernel Load

After configuration selection, the Windows XP Professional kernel (NTOSKRNL.EXE) loads and initializes. NTOSKRNL.EXE also loads and initializes device drivers and loads services. If you press Enter when the Hardware Profile/Configuration Recovery menu appears, or if NTLDR makes the selection automatically, the computer enters the kernel load phase. The screen clears and a series of white rectangles appears across the bottom of the screen.

During the kernel load phase, NTLDR does the following:

Loads NTOSKRNL.EXE but does not initialize it.
Loads the hardware abstraction layer file (HAL.DLL).
Loads the HKEY_LOCAL_MACHINE\SYSTEM registry key from %systemroot%\System32\Config\System.
Selects the control set it will use to initialize the computer. A control set contains configuration data used to control the system, such as a list of the device drivers and services to load and start.
Loads device drivers with a value of 0x0 for the Start entry. These typically are low-level hardware device drivers, such as those for a hard disk. The value for the List entry, which is specified in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder subkey of the registry, defines the order in which NTLDR loads these device drivers.

Kernel Initialization

When the kernel load phase is complete, the kernel initializes, and then NTLDR passes control to the kernel. At this point, the system displays a graphical screen with a status bar indicating load status. Four tasks are accomplished during the kernel initialization stage:

The Hardware key is created.??On successful initialization, the kernel uses the data collected during hardware detection to create the registry key HKEY_LOCAL_MACHINE\HARDWARE. This key contains information about hardware components on the system board and the interrupts used by specific hardware devices.
The Clone control set is created.??The kernel creates the Clone control set by copying the control set referenced by the value of the Current entry in the HKEY_LOCAL_MACHINE\SYSTEM\Select subkey of the registry. The Clone control set is never modified, as it is intended to be an identical copy of the data used to configure the computer and should not reflect changes made during the startup process.

Device drivers are loaded and initialized.??After creating the Clone control set, the kernel initializes the low-level device drivers that were loaded during the kernel load phase. The kernel then scans the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services subkey of the registry for device drivers with a value of 0x1 for the Start entry. As in the kernel load phase, a device driver's value for the Group entry specifies the order in which it loads. Device drivers initialize as soon as they load.

If an error occurs while loading and initializing a device driver, the boot process proceeds based on the value specified in the ErrorControl entry for the driver.

Table 18.4 describes the possible ErrorControl values and the resulting boot sequence actions.

Table 18.4??ErrorControl Values and Resulting Action


ErrorControl value	Action
0x0 (Ignore)	The boot sequence ignores the error and proceeds without displaying an error message.
0x1 (Normal)	The boot sequence displays an error message but ignores the error and proceeds.
0x2 (Severe)	The boot sequence fails and then restarts using the LastKnownGood control set. If the boot sequence is currently using the LastKnownGood control set, the boot sequence ignores the error and proceeds.
0x3 (Critical)	The boot sequence fails and then restarts using the LastKnownGood control set. However, if the LastKnownGood control set is causing the critical error, the boot sequence stops and displays an error message.

ErrorControl values appear in the registry under the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\name_of_service_or_driver\ErrorControl.

Services are started.??After the kernel loads and initializes devices drivers, the Session Manager (SMSS.EXE) starts the higher order subsystems and services for Windows XP Professional. Session Manager executes the instructions in the BootExecute data item, and in the Memory Management, DOS Devices, and SubSystems keys.
Table 18.5 describes the function of each instruction set and the resulting Session Manager action.

Table 18.5??Session Manager Reads and Executes These Instruction Sets

Logon

The logon process begins at the conclusion of the kernel initialization phase. The Win32 subsystem automatically starts WINLOGON.EXE, which starts the Local Security Authority (LSASS.EXE) and displays the Logon dialog box. You can log on at this time, even though Windows XP Professional might still be initializing network device drivers.

Next, the Service Controller executes and makes a final scan of the HKEY_ LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services subkey, looking for services with a value of 0x2 for the Start entry. These services, including the Workstation service and the Server service, are marked to load automatically.

The services that load during this phase do so based on their values for the DependOnGroup or DependOnService entries in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services registry subkey.

A Windows XP Professional startup is not considered good until a user successfully logs on to the system. After a successful logon, the system copies the Clone control set to the LastKnownGood control set.

For more information on LastKnownGood configuration, see Lesson 3, "Using Startup and Recovery Tools," later in this chapter.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering these questions, review the material in this lesson before beginning the next lesson. The answers are in Appendix A, "Questions and Answers."

Windows XP Professional modifies the boot sector during installation so that __________ loads during system startup.
What is the purpose of the BOOT.INI file and what happens if it is not present?
What does the BOOTSECT.DOS file contain and when is it used?
A user calls you and tells you that Windows XP Professional does not appear to be loading correctly. The Hardware Profile/Configuration Recovery menu does not appear when the computer is restarted, but it does appear on the computer of the person sitting in the next cubicle when that computer is restarted. What would you tell the user?

Lesson Summary

NTLDR and NTDETECT.COM are required files in the Windows XP Professional boot process.
BOOTSECT.DOS is a copy of the boot sector that was on the system partition at the time that Windows XP Professional was installed. It is only used if you choose to load an operating system other than Windows XP Professional.
When you install Windows XP Professional on a computer, Windows Setup saves the BOOT.INI file in the active partition.
NTLDR uses information in the BOOT.INI file to display the boot loader screen, from which you select the operating system to start.
You can edit the BOOT.INI file, including modifying ARC paths and using the optional BOOT.INI switches.
The Windows XP Professional boot process occurs in five phases: preboot sequence, boot sequence, kernel load, kernel initialization, and logon.