What Happens When You Start Your Computer

As stated earlier in this chapter, the Windows XP/Windows Server 2003 boot sequence closely resembles that of Windows NT/2000. Listed below are the processes that take place when Windows NT-based operating system successfully starts on an x86-based computer:

  • Power On Self Test (POST)

  • Initial startup process

  • Boot loader process

  • Operating-system selection (if you have a multi-boot system)

  • Hardware detection

  • Hardware-profile selection

  • Kernel-loading process

  • Kernel-initialization process

  • User-logon process

Note 

The startup sequence quoted above applies to systems started or restarted after a normal shutdown. The startup processes begin when you do one of the following:

  • Turn on the computer

  • Reboot the system

However, this startup sequence does not apply when resuming from hibernate or standby modes.

When you log on, the process of loading Windows NT/2000, Windows XP, or Windows Server 2003 is completed, as well as are most of the initialization procedures. However, the startup can only really be considered as successfully completed after you log on to the system.

The following requirements need to be met to successfully begin the Windows NT/2000/XP/Windows Server 2003 startup:

  • Correct initialization of all the hardware.

  • Presence of all required files for starting the OS. If any of these files aren't present in the correct folder or are corrupt, the startup will fail.

Power on Self Test

When you turn on or restart your computer, it undergoes the Power On Self Test (POST) procedure. The POST routine is a set of tests performed by the CPU, which, as soon as power is switched on, starts to perform the code contained in the motherboard system firmware. Firmware, known as the basic input output system (BIOS) on x86-based systems and internal adapters, contains the code necessary to start the computer.

The POST routine performs the following two tasks:

  • Runs the POST diagnostic routine, which, depending on the firmware, might run some rudimentary hardware checks, such as determining the amount of memory present. The POST diagnostic routine also verifies that all hardware devices needed to start an operating system (such as a hard disk) are present and have been correctly initialized.

  • After completing the diagnostic routine, POST retrieves the system-configuration settings from the Complementary Metal Oxide Semiconductor (CMOS) memory, located on the motherboard. After the motherboard POST completes, each add-on adapter with built-in firmware (for example, video and hard-drive controllers) runs a device-specific POST routine.

If there are problems related to the computer hardware or BIOS settings, POST will emit a series of beeps. POSTs are controlled by your computer's BIOS and may differ from machine to machine. Because of this, it is recommend to always have on hand the documentation supplied with your computer.

The topic of troubleshooting hardware problems goes beyond the range of problems discussed in this book. As a matter of fact, it deserves a separate comprehensive volume. However, you should be aware of some helpful resources on the topic that will certainly help you to make sense of BIOS error codes:

  • BIOS Survival Guide, available at http://burks.bton.ac.uk/burks/pcinfo/hardware/bios_sg/bios_sg.htm

  • Definitions and Solutions for BIOS Error Beeps and Messages/Codes, available at http://www.earthweb.com

Files Required to Start up Windows NT-Based Operating Systems

If the POST routine has been completed successfully, then your computer's hardware has also been initialized successfully. It is now time to start the operating system. This process requires the presence of all of the files necessary to boot the system. The Startup procedure will fail if any of these files are missing or corrupt.

The files required to start Windows NT, Windows 2000, Windows XP or Windows Server 2003 (for x86 platforms) are listed in Table 6.1.

Table 6.1: Files Required to Start Up Windows NT/2000/XP Server 2003 (x86 Platforms)

File

Location


Ntldr

Root directory of the startup disk

Boot.ini

Root directory of the startup disk

Bootsect.dos[*]

Root directory of the startup disk

Ntdetect.com

Root directory of the startup disk

Ntbootdd.sys (for SCSI only)

Root directory of the startup disk

Ntoskrnl.exe

%SystemRoot%\System32

Hal.dll

%SystemRoot%\System32

The \SYSTEM registry hive

%SystemRoot%\System32\Config

Device drivers

%SystemRoot%\System32\Drivers

[*]This file is required only in multi-boot systems, where MS-DOS, Windows 3.1x, or Windows 9x are used as alternative operating systems. You can also use the NT loader to boot UNIX or Linux. Copy the first sector of your native root Linux or FreeBSD partition into a file in the NT/2000 partition and name the file, for example, C:\Bootsect.inx or C:\Bootsect.bsd (by analogy to C:\Bootsect.dos). Then edit the [operating systems] section of the Boot.ini file by adding strings such as:

   C:\BOOTSECT.LNX="Linux"   C:\BOOTSECT.BSD="FreeBSD"

Note 

Windows NT, Windows 2000, Windows XP and Windows Server 2003 define the "system" and "boot" partitions differently from other operating systems. These are the most important things that you should know. The system partition contains the files necessary to start Windows NT/2000/XP/Windows Server 2003. The boot partition, which contains the %SystemRoot% and %SystemRoot%\System32 directories, can be another partition on the same or on a different physical disk. The term %SystemRoot% is an environment variable.

Initial Startup Process

When the POST routine has been successfully completed, the system BIOS tries to locate the startup disk. The search order for locating the startup disk is specified by the system BIOS. In addition to floppy disks and hard disks attached to SCSI or ATA controllers, firmware might support the starting of an operating system from other devices, such as CD-ROM, network adapters, or Zip or LS-120 disks.

The system BIOS allows you to reconfigure the search order (also known as the boot sequence). You can find detailed information concerning boot-sequence editing in the documentation supplied with your computer. If drive A: is the first item in the boot-sequence list, and there is a disk present in this drive, the system BIOS will try booting from the disk. If there is no disk in drive A:, the system BIOS will check the first hard drive that is powered up and initialized. The first sector on the hard disk, which contains the Master Boot Record (MBR) and partition table, is the most critical data structure to the startup process.

The system BIOS reads the Master Boot Record, loads it into memory, and then transfers execution to the Master Boot Record. The code scans the partition table to find the system partition. When has been found, MBR loads sector 0 of the system partition and executes it. Sector 0 on the system partition is the partition boot sector, containing the startup code for the operating system. This code uses a method defined by the operating system.

Note 

If the startup disk is a floppy disk, the first sector of this disk is the Windows NT/2000/XP/Windows Server 2003 partition boot sector. For a successful startup, this disk must contain all of the boot files required for starting Windows NT/2000/XP/Windows Server 2003.

If the first hard disk has no system partition, MBR will display one of the following error messages:

  • Invalid partition table

  • Error loading operating system

  • Missing operating system

Generally, the form of MBR doesn't depend on the operating system. For example, on x86 computers the same MBR is used to start Windows NT/2000/XP/Windows Server 2003, Windows 9x, MS-DOS, and Windows 3.1x. On the other hand, the partition boot sector depends on both the operating system and the file system. On an x86 platform, the Windows NT/2000/XP/Windows Server 2003 partition boot sector is responsible for the following actions:

  • Detecting the file system used to find the operating-system boot loader (Ntldr) in the root directory of the system partition. On FAT volumes, the partition boot sector is 1 sector long. On FAT32 volumes, this data structure takes up 2 physical sectors, because the startup code requires more than 512 bytes. On NTFS volumes, the partition boot sector data structure can consume up to 16 sectors, with the extra sectors containing the file-system code required to find Ntldr.

  • Loading Ntldr into memory.

  • Executing the boot loader.

On x86 computers, the system partition must be located on the first physical hard disk. Don't confuse the system partition and the boot partition. The boot partition contains Windows NT/2000/XP/Windows Server 2003 system files and can be the same as the system partition. It can also be located on a different partition or even on a different hard disk.

If the first hard disk has no system partition that is used to start the computer, you need to power down this disk. This will allow the system BIOS to access another hard disk, which will be used to start the operating system.

If there is a disk in drive A:, the system BIOS will try loading the first sector of this disk into the memory. If the disk is bootable, its first sector is the partition boot sector. If the disk isn't bootable, the system will display errors such as:

   Non-System disk or disk error   Replace and press any key when ready

(if the disk is DOS-formatted) or

   Ntldr is missing   Replace and press any key when ready

(if the disk is formatted under Windows NT/2000/XP/Windows Server 2003).

If you need to boot the system from a bootable CD (for example, to install Windows XP or Windows Server 2003 from the distribution CD or use the CD-based Recovery Console), you must set the CD-ROM as the primary boot device—the first item listed in the boot order. When you start your system using the bootable CD, Setup checks the hard disk for existing Windows installations. If Setup finds an existing installation, it provides you with the option of bypassing CD-ROM startup by not responding to the "Press any key to boot from CD-ROM" prompt. If you do not press a key within three seconds, Setup does not run and the computer passes control from the CD-ROM to the hard disk.

Note 

If you don't want to start Windows XP/Windows Server 2003 Setup to install this operating system or repair the damaged OS installation, remove the CD from your CD drive. This will allow you to minimize the time required to start Windows XP or Windows Server 2003. Also note that the presence of a non-bootable CD in the CD-ROM drive can significantly increase the time required to start Windows XP/Windows Server 2003.

Boot Loader Process

The boot loader allows you to select the operating system to be started and loads the operating system files from the boot partition. The tasks performed at this phase include installing a 32-bit memory model with flat memory space, detecting hardware configuration data, generating its configuration in the memory, and transferring the handle of this description to the loader. Ntldr then loads the kernel image, the HAL, the device drivers, and the file-system drivers for the volume, from which the operating system will start. Beside other tasks at this phase, the system loads the drivers for which the Start registry value is set to 0. The Start registry entry for device drivers is located in the registry under the following key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName 

The ServiceName here is the name of the service. For example:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi

Ntldr Functions

Ntldr controls the process of selecting the operating system to be loaded and detecting hardware prior to initializing the Windows NT/2000/XP/Windows Server 2003 kernel. Ntldr must be located in the root folder of the system partition. Beside the operating-system loader, the partition must contain all the files listed in Table 6.1.

When Ntldr starts executing, it clears the screen and performs the following actions:

  • Switches the processor to 32-bit flat memory mode. All x86-based computers first start in real mode, similar to an 8088 and 8086 start mode. Because Ntldr is a 32-bit program, it must switch the CPU to a 32-bit flat memory mode before it can perform any actions.

  • Starts an appropriate minifile system. The code intended for accessing files on FAT and NTFS partitions is built into NTFS. This code enables Ntldr to access the files.

  • Reads the Boot.ini file located in the root directory of the system partition and displays the boot menu. This screen is also known as a boot-loader screen. If your computer is configured for starting multiple operating systems and you select an alternative operating system (other than Windows NT/2000, Windows XP, or Windows Server 2003), Ntldr will load the Bootsect.dos file and transfer all control to the code contained in this file. The alternative operating system will start normally, because the Bootsect.dos file contains an exact copy of the partition boot sector necessary to start the operating system.

  • If you select one of the Windows NT/2000/XP/Windows Server 2003 installations, Ntldr finds and executes Ntdetect.com to collect information on the hardware currently installed.

  • Ntldr loads and starts the operating system kernel (Ntoskrnl.exe). After starting the kernel, Ntldr passes on the hardware information collected by Ntdetect.com.

Note 

One of the most significant improvements introduced with Windows XP and Windows Server 2003 is the so-called Fast Boot feature, which was introduced by increasing the boot loader performance. The Ntldr version included with Windows XP and Windows Server 2003 is optimized for fast disk reading. When the system is loaded for the first time, all information on the disk configuration, including file-system metadata, is cached. The Logical Prefetcher, which is new in Windows XP/Windows Server 2003, brings much of this data into the system cache with efficient asynchronous disk I/Os that minimize seeks. During the boot, the logical prefetcher finishes most of the disk I/Os that need to be carried out for starting the system parallel to device initialization, providing faster boot and logon performance. Furthermore, during the boot, each system file is now read only once, within a single operation. As a result, Windows XP/Windows Server 2003 boot loader is 4 to 5 times faster than Windows 2000 boot loader.

As you can probably guess, the prefetcher settings are also stored in the registry. You can find them under the following key (Fig. 6.1):

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\   Memory Management\PrefetchParameters

click to expand
Figure 6.1: Logical Prefetcher settings in the registry

The values that interest us the most are the RootDirPath (data type REG_SZ, the default value is Prefetch) and EnablePrefetcher (data type REG_DWORD). The EnablePrefetcher setting can take the following values:

  • 0x00000001 — application launch prefetching

  • 0x00000002 — boot prefetching

If both options are enabled, the setting will be 0x00000003. The setting takes effect immediately. Note that, in the Server product line, only the boot prefetch is enabled by default. Application prefetch can be enabled by the registry setting cited here. The system boot prefetch file is in the %SystemRoot%\Prefetch directory (and the path to it is specified by the RootDirPath parameter mentioned above). Although these prefetch-readable files can be opened using Notepad, they contain binary data that will not be recognized. If you are going to view these files, make them read-only or copy them to a different location before opening.

Selecting the Operating System to Start

Ntldr displays a menu where you can select the operating system to be started. What is shown on this screen depends on the information contained in the Boot.ini file, which was described in Chapter 4. An example of the screen is shown below:

   Please select the operating system to start:        Windows XP Professional        Windows 2000 Professional        Windows NT Server Version 4.0        Windows NT Server Version 4.0(VGA mode)   Use  and  keys to move the highlight to your choice.   Press Enter to choose.   Seconds until highlighted choice will be started automatically: 29   For troubleshooting and advanced startup options for Windows, press F8

The process of selecting the operating system to start is similar to the process for earlier Windows NT versions (for example, Windows NT 3.51 and Windows NT 4.0). The operating system that appears first in the list is the default operating system. To select another operating system, use the arrow keys ( and ) to move the highlight to the string you need. Then press <Enter>.

If you don't select an item from the boot menu before the counter specified in the following string reaches zero, you'll see the following message:

   Seconds until highlighted choice will be started automatically: 29

Ntldr will load the default operating system. Windows Setup specifies the most recently installed copy of the operating system as the default option. You can edit the Boot.ini file to change the default operating system. A detailed description of the Boot.ini file format was provided in Chapter 4.

Note 

The startup menu will not appear if you only have one copy of Windows XP or Windows Server 2003 installed on your computer. In this case, Windows XP/Windows Server 2003 ignores the time-out value in the Boot.ini file and starts immediately.

Windows Advanced Startup Options

Any experienced Windows NT user will notice that there is small, but very significant, difference between the boot loader screens in Windows 2000/XP/Windows Server 2003 and Windows NT 4.0. This is the string placed at the bottom of the screen:

   For troubleshooting and advanced startup options for Windows 2000, press F8

In Windows 9x/ME, there was a similar option. If you have any problems booting Windows 2000, Windows XP, or Windows Server 2003, try using the advanced startup options menu displayed when you press the <F8> key.

The menu looks like this:

   Windows Advanced Options Menu   Please select an option:   Safe Mode   Safe Mode with Networking   Safe Mode with Command Prompt   Enable Boot Logging   Enable VGA Mode   Last Known Good Configuration (your most recent settings that worked)[*]   Directory Services Restore Mode (Windows domain controllers only)   Debugging Mode   Start Windows Normally[**]   Reboot[**]   Return to OS Choices Menu[**] 


[*]This option is an improvement over Windows 2000.

[**]Options that are new in Windows XP and Windows Server 2003.

Note that this menu will remain on the screen until you select one of the available options.

When Windows 2000/XP or Windows Server 2003 boots in safe mode, it uses the standard settings (VGA driver, no network connections, default system services only). When the system starts in safe mode, only vitally important drivers necessary for starting Windows are loaded. The safe boot mode allows the system to boot even with an incompatible or corrupt service or driver. Thus, the safe mode increases the probability of successful booting because you load the system with the minimum set of services and drivers. For example, if your Windows 2000/XP/Windows Server 2003 installation became unbootable after installing new software, it is likely that an attempt to boot the system in safe mode will be successful. After booting the system, you will be able to change the settings preventing Windows from booting correctly or delete the software that caused the problem.

The options on the Windows XP/Windows Server 2003 advanced startup menu are described below:

  • Safe Mode

    As already mentioned, this option is similar to the one that was introduced with Windows 2000. If the user selects this option, only the basic services and drivers will be loaded. These services and drivers are vitally important for the operating system (this set includes standard mouse, keyboard and mass-storage drivers, base video, and default system services). If you can't start Windows using this mode, you will probably need to restore the damaged system. More detailed information concerning this topic will be provided later in this chapter.

  • Safe Mode with Networking

    Similar to the option that existed in Windows 2000, Windows XP/Windows Server 2003 will start in safe mode (very much like the previous option) but, in addition, there will be an attempt to start networking services and restoring network connections.

  • Safe Mode with Command Prompt

    When you select this option, Windows 2000/XP/Windows Server 2003 will start using only the basic set of drivers and services (just the same as in safe mode, except that a command prompt will be started instead of the Windows GUI).

  • Last Known Good Configuration (your most recent settings that worked)

    In Windows NT 4.0/Windows 2000, there was a similar option. However, in Windows XP and Windows .NET Server, this option includes an improvement that deserves special mention. If you select this option in Windows 2000, the operating system starts using registry information saved immediately after successful startup (the system startup is considered to be successful if at least one user has successfully logged on to the system). It should be pointed out that, in Windows NT/2000, this option only allows you to correct configuration errors and does not always work successfully. Use this option only when you are absolutely sure that you have made an error while configuring the system. The problems caused by missing or corrupt system files or drivers will not be corrected. Also note that using this option will discard all modifications introduced into your registry since the last successful boot of Windows NT/2000.

    In Windows XP/Windows Server 2003, this option has been enhanced by additional functions. In contrast to Windows NT/2000, Windows XP and Windows Server 2003 create backup copies of the drivers before updating the currently used set of drivers. In addition to restoring the most recent registry settings, the Last Known Good Configuration startup option also restores the last set of drivers used after the last successful user logon. This allows you to recover from system errors such as unstable or improperly installed applications and drivers that prevent you from starting Windows XP/Windows Server 2003.

  • Directory Services Restore Mode (Windows domain controllers only)

    This option shouldn't be used with clients running Windows 2000/XP Professional because it is intended for domain controllers running Windows 2000 Server or later versions. As the name of this option suggests, it is used for restoring directory services.

  • Debugging Mode

    This option starts Windows XP/Windows Server 2003 and establishes the debugging mode.

  • Start Windows Normally

    First introduced with the release of Windows XP, this option allows you to start Windows XP/Windows Server 2003 normally.

  • Reboot

    When the user selects this option, the boot process will restart from the beginning (actually, with the POST routine). Like the previous option, this was first introduced with Windows XP.

  • Return to OS Choices Menu

    New in Windows XP, this option returns you to the boot loader screen, allowing you to select the operating system.

As has been said, the last three options were first introduced with Windows XP. While these options do not provide anything completely new, being largely cosmetic improvements, they clearly make the Advanced Startup Options menu more convenient than that in Windows 2000.

You may be wondering where the system stores safe mode configurations used to start the system when you select one of advanced boot options. Like everything else in the system, these parameters are stored in the registry, under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot (Fig. 6.2). This key contains all configuration settings used to boot the system in safe mode. It contains two subkeys: Network and Minimal. The Network key contains the information necessary to boot the system using the Safe Mode with Networking option, while the Minimal key contains the same information without the networking settings. The SafeBoot key contains the AlternateShell value entry, which specifies the name of the program used instead of the Windows GUI. Ususally, this entry has the value of "cmd.exe" (Windows 2000/XP/Windows Server 2003 command processor), which corresponds to the Safe Mode with Command Prompt option.

click to expand
Figure 6.2: The advanced startup menu options in Windows 2000/XP/.NET Server are specified by the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot registry key

Hardware Detection

When you select one of the Windows NT/2000/XP or Windows Server 2003 installations from the boot menu (or the default operating system starts loading after the timer has expired), Ntldr calls on Ntdetect.com to collect information on the currently installed hardware. Ntdetect.com returns the collected information to Ntldr.

This phase of the initialization is different for Windows NT 4.0 and Windows 2000/XP/Windows Server 2003. As mentioned in Chapter 5, beginning with Windows 2000, the system includes two new Executive subsystems: Plug and Play Manager and Power Manager. Plug and Play Manager is integrated with I/O Manager and doesn't participate in the initialization process. However, because Windows 2000 and later versions support Plug and Play, PnP-aware drivers play a certain part in hardware detection in the operating system. The main difference from Windows NT 4.0 is that Windows 2000 performs hardware detection using Ntdetect.com only. Because of this, a new Boot.ini parameter was introduced in Windows 2000 — /FASTDETECT, which is used when Windows NT 4.0 and Windows 2000/XP/Windows Server 2003 coexist on the same computer. If you have this type of configuration, the Windows 2000 version of Ntdetect.com will be used to load both operating systems. If the /FASTDETECT parameter is set, Ntdetect.com won't try to recognize Plug and Play devices. If this parameter is omitted, Ntdetect.com will enumerate all of the hardware. So, if you have a multi-boot configuration where both Windows NT 4.0 and Windows 2000 are installed, the /FASTDETECT parameter should be set for the Boot.ini strings that start Windows 2000 and omitted for the strings that start Windows NT 4.0.

Selecting the Hardware Profile

If you have selected the option that starts Windows 2000/XP/Windows Server 2003, and there is only one hardware profile in the system, Ntldr will continue the startup process by starting the operating system kernel (Ntoskrnl.exe) and passing on the hardware information collected by Ntdetect.com.

If your system has several hardware profiles, the following information will be displayed on the screen:

   Hardware Profile/Configuration Recovery Menu   This menu allows you to select a hardware profile   to be used when Windows is started.   If your system is not starting correctly, then you may switch to a   previous system configuration, which may overcome startup problems.   IMPORTANT: System configuration changes made since the last   successful startup will be discarded.   Profile 1   Profile 2   Profile 3   Use the up and down arrow keys to move the highlight   to the selection you want. Then press ENTER.   To switch to the Last Known Good Configuration, press 'L'.   To Exit this menu and restart your computer, press F3.   Seconds until highlighted choice will be started automatically: 5

After displaying this menu, the boot loader will allow you time to select from the available options. You can select one of the existing hardware profiles, switch to the Last Known Good Configuration option, or quit this menu and restart the computer.

The first hardware profile is highlighted. To select other hardware profiles, highlight the option you need and press <Enter>.

You can also choose between the default configuration and LastKnownGood Configuration. If you select the Last Known Good Configuration option, Windows will load the registry information that was saved immediately after the last successful boot. If you don't select this option, Windows will use the default configuration that was saved in the registry the last time you performed a system shutdown. The Last Known Good Configuration is stored in the registry under HKEY_LOCAL_MACHINE\SYSTEM\Select. More detailed information concerning this topic will be provided later in the chapter.

Note 

Windows XP and Windows Server 2003 create the default hardware profile for desktop computers. This default profile includes all of the hardware detected when you installed the system. For portable computers, Windows XP creates two default hardware profiles (Docked Profile and Undocked Profile), and selects the appropriate profile depending on the way you are presently using your computer (as a dock station or standalone). Note that, despite the fact that full-featured Plug and Play support has eliminated the necessity of manually configuring hardware profiles, they still can be very useful for troubleshooting hardware problems.

Loading the Kernel

When the boot loader has obtained information on the currently installed hardware and selected hardware profile, it starts the operating system kernel Ntoskrnl.exe and passes on the hardware information collected by Ntdetect.com.

Information on the currently selected hardware profile is passed to the loader when you press <Enter> in the Hardware Profile/Configuration Recovery Menu screen. The loader can also make this choice automatically (if the timer has expired or if there is only one hardware profile).

When the kernel starts loading, you will see several dots on the screen. These dots serve as a progress indicator displayed when the boot loader loads Ntoskrnl.exe and the hardware abstraction layer into the memory. At this phase, neither of these programs are initialized. Ntldr then scans the registry and retrieves information on the size of nonpaged pool and registry quota (for Windows NT/2000). Next, Ntldr loads the HKEY_LOCAL_MACHINE\SYSTEM registry hive from %SystemRoot%\System32\Config\System.

At this point, the boot loader enables the registry API and creates a control set that will be used to initialize the computer. Both of these tasks are preliminary steps necessary for preparing the drivers for loading. The value specified in the HKEY_LOCAL_MACHINE\SYSTEM\Select registry key (Fig. 6.3) defines which control set in HKEY_LOCAL_MACHINE\SYSTEM should be used to load the system. By default, the loader will select the Default control set. If you select LastKnownGood configuration, the loader will use the LastKnownGood control set. Based on your selection and on the value of the Select key, the loader will determine which control set (ControlSet00x) will be enabled. The loader will then set the Current value of the Select key to the name of the control set it will be using.

click to expand
Figure 6.3: The HKEY_LOCAL_MACHINE\SYSTEM\Select registry key

The loader then scans all of the services defined by the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services registry key and searches device drivers with a Start value of 0x0 (this means that the drivers should be loaded, but not initialized). Normally, drivers with these values are low-level device drivers (for example, disk drivers). The Group value for each device driver defines its load order. The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ControlServiceGroupOrder registry key defines the loading order.

When this phase is completed, all of the basic drivers are loaded and active. If one of the critical drivers cannot be initialized, the system starts rebooting.

Initializing the Kernel

When the Windows NT 4.0 kernel begins initializing, the screen turns blue, and a text similar to the one presented below appears:

   Microsoft ® Windows NT (TM) Version 4.0 (Build 1345)   1 System Processor (64 MB Memory)

If this message appears, it means that all of the previous stages of the boot sequence have been successfully completed. Obvious difference between Windows NT and Windows 2000 (or later) is the fact that all system messages that appear during the Windows NT 4.0 boot process are displayed in 80×50 text mode, while Windows 2000, Windows XP, and Windows Server 2003 display these messages in VGA mode. The Windows NT 4.0 Hardware Abstraction Layer (HAL) provides all of the support for this mode and is also responsible for displaying the messages. Windows 2000 and its successors have a special driver — Bootvid.sys — that performs these tasks. In Windows 2000/XP/Windows Server 2003, you will know that the kernel is initializing when the animated screen displaying the OS logo appears (Fig. 6.4). This cosmetic improvement doesn't change the basic principles of the loading process in comparison to previous versions of the Windows NT operating system.

click to expand
Figure 6.4: The animated screen displaying the OS logo indicates that the kernel is initializing

If you want to check things out for yourself, add the /SOS option to the Boot.ini file string that starts Windows 2000/XP/Windows Server 2003, then save your changes and reboot the system. You will see the whole loading sequence for all of the drivers. The graphics logo will be used as a background and, in the foreground, you will see something very much like the following:

   Microsoft ® Windows XP Professional (TM) (Build 2600)   1 System Processor (256 MB Memory)

The kernel creates the HKEY_LOCAL_MACHINE\HARDWARE registry key based on information obtained from the boot loader. The HKEY_LOCAL_MACHINE\HARDWARE key contains hardware data collected when the system starts. This data includes information on the hardware components and IRQs used by each hardware device.

The kernel then creates a Clone control set by making a copy of the control set indicated by the Current value.

Note 

In Windows NT 4.0, the Clone control set was visible but, after a successful boot, it became unavailable (the system displayed an error message any time an attempt was made to open this key). In Windows 2000/XP/Windows Server 2003, the registry editors simply don't display this key.

The Clone control set should never be modified, since it must be an identical copy of the data used for configuring the computer. It shouldn't contain any changes introduced in the course of system startup.

As the kernel initializes, it performs the following operations:

  • Initializes low-level device drivers loaded at the previous stage

  • Loads and initializes other device drivers

  • Starts programs, such as Chkdsk, which should run before starting any services

  • Loads and initializes system services

  • Creates the paging file (Pagefile.sys)

  • Starts all the subsystems necessary for Windows 2000/XP/Windows Server 2003

Loading and Initializing the Device Drivers

Now the kernel initializes the low-level device drivers that were loaded at the previous stage (kernel loading). If any of these drivers cannot be initialized, the system performs corrective action based on the data defined by the following registry entry:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services   \DriverName\ErrorControl

Ntoskrnl.exe then scans the registry, this time for device drivers that have an HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DriverName\Start value of 0x01. The Group value for each device driver defines the order in which the drivers are loaded. The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder registry subkey defines the loading order.

In contrast to the kernel-loading phase, device drivers that have a Start value of 0x01 aren't loaded using BIOS calls. Instead, they use device drivers loaded and initialized in the kernel-loading phase. Error handling for device drivers belonging to this group is based on the ErrorControl value for each device driver.

Note 

Windows XP and Windows Server 2003 initialize device drivers simultaneously in order to improve boot time. Instead of waiting for each device to initialize separately, many can now be brought up concurrently. The slowest device has the greatest effect on boot time.

Loading Services

The Session Manager (Smss.exe) starts the higher-level subsystems and services of the operating system. All information used by the Session Manager is also stored in the registry under the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager. The Session Manager uses information stored under the following registry items:

  • The BootExecute data entry

  • The Memory Management key

  • The DOS Devices key

  • The Subsystems key

The BootExecute Data Entry

The BootExecute registry entry contains one or more commands that the Session Manager has to run before it starts loading services. The default value for this registry item is Autochk.exe, which is simply the Windows NT/2000/XP/Windows Server 2003 version of the Chkdsk.exe program. The example shown below shows the default setting for this registry item:

   BootExecute: REG_MULTI_SZ: autochk autochk*

The Session Manager is capable of running more than one program. The example shown below shows how to start the Convert utility, which will convert the x volume to NTFS format next time the system starts:

   BootExecute: REG_MULTI_SZ: autochk autochk* autoconv \DosDevices\x:   /FS:ntfs

When the Session Manager executes all of the commands specified, the kernel will load the other registry hives stored in the %SystemRoot%\System32\Config directory.

The Memory Management Key

In the next step, the Session Manager must initialize the information in the paging file, which is necessary for the Virtual Memory Manager. The configuration information is stored in the following data items:

   PagedPoolSize: REG_DWORD 0   NonPagedPoosSize: REG_DWORD 0   PagingFiles: REG_MULTI_SZ: c:\pagefile.sys 32

In versions of Windows earlier than Windows XP, as device drivers, system services, and the user shell load, the required memory pages will not be in memory until loaded from the disk drive. Another key improvement in Windows XP and Windows Server 2003 is the overlap of prefetching these pages before loading the device drivers that require them.

The prefetcher in Windows XP and Windows Server 2003 has the following functions:

  • Dynamically traces each boot to build a list of what to prefetch. Boot files are laid out together on disk during idle time, or when the Bootvis.exe tool is used to arm boot traces. The prefetcher needs at least two boots after installation to learn which files to lay out. The prefetcher monitors the previous eight boots on an ongoing basis.

  • Enables fast asynchronous I/O during boot to load required files in highly efficient transfers.

As was already mentioned, the prefetcher settings are stored in the registry under KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters key.

The DOS Devices Key

The Session Manager needs to create symbolic links that direct certain command classes to the appropriate file-system components. The configuration data resides in the following registry entries:

   PRN: REG_SZ: \DosDevices\LPT1   AUX: REG_SZ: \DosDevices\COM1   NUL: REG_SZ: \Device\Null   UNC: REG_SZ: \Device\Mup   PIPE:\REG_SZ: \Device\NamedPipe   MAILSLOT:\REG_SZ \Device\MailSlot

The SubSystems Key

Since the architecture of all subsystems in Windows NT/2000, Windows XP, and Windows Server 2003 is message-based, it is necessary to start the Windows (Win32) subsystem that controls all input/output operations and video-display access. The process of this subsystem is called CSRSS. The Win32 subsystem starts the WinLogon process, which, in turn, starts other important subsystems.

Configuration information for subsystems is defined by the Required value under the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\SubSystems.

Logging on

The Win32 subsystem starts the Winlogon.exe process, which, in turn, starts the Local Security Administration process (LSA) — Lsass.exe. When the kernel initializes successfully, it is necessary to log on to the system. The log-on procedure may be carried out automatically, based on the information stored in the registry, or it can be done manually. When you log on manually, the system displays the Begin Logon dialog or the Welcome screen (Windows XP-specific new feature). The Graphical Identification and Authentication (GINA) component collects your user name and password and passes this information securely to the LSA for authentication. If you have supplied the proper credentials, you are granted access using either Kerberos V5 (for network) or NTLM (local machine) authentication.

Note 

Windows NT/2000 may continue initializing network drivers, but you can now log on to the system. As for Windows XP and Windows Server 2003, if your computer isn't joined to a domain, network initialization will be carried out at the same time as the boot. However, PCs that are members of a domain will still wait.

At this stage, the Service Control Manager loads the services that start automatically. The Start value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DriverName is set to 0x2. Now the services are loaded according to their dependencies, which are described by the values DependOnGroup and DependOnService under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DriverName registry key.

Note 

As with Windows NT/2000, Windows XP/Windows Server 2003 has not been successfully loaded until you have logged on to the system. After that, the Clone control set will be copied to the LastKnownGood configuration.

The services listed in the following registry keys start and run asynchronously with the Welcome to Windows and Log On to Windows dialog boxes:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

The Plug and Play device detection process also runs asynchronously with the logon process and relies on system firmware, hardware, device drivers, and operating-system features to detect and enumerate new devices. When these components are properly coordinated, Plug and Play allows for device detection, system-resource allocation, driver installation, and device installation with minimal user intervention. Detailed information on the Plug and Play detection process was provided in Chapter 5.

After you log on, the following events occur:

  • Control sets are updated. The control set referenced by the LastKnownGood entry is updated with the contents in Clone. Clone, a copy of the CurrentControlSet entry, is created each time you start your computer.

  • Group Policy settings take effect. Group Policy settings that apply to the user and computer take effect. For more information about Group Policy, see Chapter 10.

  • Startup programs run. Windows XP and Windows Server 2003 start logon scripts, startup programs, and services referenced in these registry and folder locations:

    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    • %systemdrive%\Documents and Settings\All Users\Start Menu\Programs\Startup

    • %systemdrive%\Documents and Settings\%username%\Start Menu\Programs\Startup

    • %windir%\Profiles\All Users\Start Menu\Programs\Startup

    • %windir%\Profiles\%username%\Start Menu\Programs\Startup

Note 

The last two %windir% folders exist only on systems upgraded from Windows NT 4.0.

Loading Other Services and Drivers

As mentioned earlier, the system may continue loading and initializing certain services and drivers from the moment you log on. Future sections of this chapter concentrate on the following important topics:

  • Control sets in the registry. Control sets contain information on the system configuration used during system startup. Proper understanding of control sets is necessary to use the LastKnownGood configuration effectively.

  • How the registry data specifies the loading order of services and drivers. We will discuss the Start value that specifies the loading order of the service or driver. We will also discuss the Error Control value that defines the default behavior of the system in the event that the driver or service cannot be loaded or initialized correctly.

Control Sets in the Registry

The Control set contains system-configuration data, including information on the device drivers that need to be loaded and the services that need to be started. Control sets are stored in the registry under the HKEY_LOCAL_MACHINE\SYSTEM registry key. The system may have several control sets. Their number depends on how frequently you modify the system settings or how often problems arise. A typical installation of any Windows NT-based operating system contains the following control sets:

  • Clone

  • ControlSet001

  • ControlSet002

  • ControlSet003

  • CurrentControlSet

The CurrentControlSet subkey points to one of the ControlSet00x subkeys. The Clone control set is an exact copy of the control set used for starting and initializing the system (Default or LastKnownGood). The kernel-initialization process creates this control set at each system startup. The Clone control set becomes inaccessible after the first successful logon.

The HKEY_LOCAL_MACHINE\SYSTEM\Select registry key contains the following entries:

  • Current

  • Default

  • Failed

  • LastKnownGood

These parameters contain REG_DWORD data that point to a specific control set. For example, if the Current value is set to 0x1, then the CurrentControlSet points to ControlSet001. Similarly, if the LastKnownGood value is set to 0x2, it points to the ControlSet002. Usually, the Default value is the same as the Current value. The Failed parameter indicates the control set specified by the Default parameter when the user last used the LastKnownGood control set.

Earlier in the chapter, we discussed the process of system initialization using the Default and LastKnownGood configurations. When the kernel uses the default configuration, it uses the Default value to identify the control set that should be used for initialization.

There are only two situations in which the kernel uses the LastKnownGood configuration.

  • During system recovery after a critical failure (for example, if one of the critical-device drivers couldn't be loaded or initialized). We will discuss this topic in greater detail later in the chapter.

  • When the user selects the LastKnownGood configuration from the Hardware Profile/LastKnownGood menu.

If you have either of the following problems, using the LastKnownGood control set may help you recover the damaged system:

  • Problems caused by a device driver added to the system since the last successful startup

  • Boot problems caused by invalid registry modifications

The LastKnownGood control set can help you recover from configuration errors.

Note 

If you suspect that changes made since the last successful user-logon process are causing problems, do not log on, since this causes the LastKnownGood control set to be overwritten. Instead, restart the computer, and press F8 when prompted. Select Last Known Good Configuration from the Advanced Options startup menu. If you select the Last Known Good option during startup, all modifications introduced since the last successful startup will be discarded.

After the first user logs on, all configuration changes introduced using Control Panel applets will be reflected only by the CurrentControlSet control set. Thus, if you need to modify the control set, the only control set worth editing is the CurrentControlSet.

If you have problems finding subkeys of the CurrentControlSet, use the Find Key command from the View menu of the registry editor (Regedit.exe).

The Start Value

Each of the HKEY_LOCAL_MACHINE\SYSTEM\<control set>\Services\<DriverName> (where DriverName is the name of specific driver) keys contains the Start value that defines the loading order for the driver or service. The Start parameter can take one of the following values:

  • 0x0 (Boot). The driver or service is loaded by the operating-system boot loader before the kernel initialization phase starts. Disk drivers, for example, belong to this group.

  • 0x1 (System). The service or driver is loaded by the I/O subsystem during kernel initialization. This value type, for example, is used by mouse drivers.

  • 0x2 (Auto load). The service or driver is loaded by the Service Control Manager. This type of loading order is generally used for services that start automatically under any conditions, regardless of the service type. This type of value is used, for example, by parallel port device drivers. An example of a service that uses this value is the Alerter service.

  • 0x3 (Load on Demand, Manual). The Service Control Manager will load this service only after obtaining explicit instructions to do so. Services of this type are always available, but load only when the user starts them manually.

  • 0x4 (Disabled). This service or driver will never be loaded. Windows disables services or drivers if they can't be loaded by the Service Control Manager (for example, if the appropriate hardware isn't installed). If the Start parameter is set to this value, the Service Control Manager never tries to load the service or driver. The only exception to this rule is the case of file-system drivers, which the system always tries to load, even when the Start entry for these drivers is set to 0x4.

The ErrorControl Value

The list shown below provides brief descriptions of all of the possible values of the ErrorControl registry entry located under HKEY_LOCAL_MACHINE\SYSTEM\<control set>\Services\<DriverName>.

  • Ignore (0x0). If an error occurs while loading or initializing the device driver, the startup procedure continues without displaying an error message.

  • Normal (0x1). If an error occurs while loading or initializing the device driver, the startup procedure will continue after displaying an error message. The ErrorControl value entries for most device drivers are set to this value.

  • Severe (0x2). If the kernel detects an error while loading or initializing the driver or service, it switches to the LastKnownGood control set. The startup process then restarts. If the LastKnownGood control set is already in use, the startup procedure continues, and the error is ignored.

  • Critical (0x3). The procedure used in this case is similar to the one used for Severe errors. But there is one exception. If the system has already switched to the LastKnownGood control set and this didn't eliminate the error, the boot process stops and the system displays a failure message.



Windows Server 2003 Registry
Unicode Explained
ISBN: 1931769214
EAN: 2147483647
Year: 2005
Pages: 129

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net