Module Boot Process

Boot Process
Microsoft Windows® XP New Hire
Microsoft Confidential – Provided Under NDA

© 2004 Microsoft Corporation. All rights reserved.
Microsoft, Internet Explorer, and Windows are either registered trademarks or

trademarks of Microsoft Corporation in the United States and/or other
countries.
The names of actual companies and products mentioned herein may be the
trademarks of their respective owners.
THE CONTENTS OF THIS PACKAGE ARE FOR INFORMATIONAL AND

TRAINING PURPOSES ONLY AND ARE PROVIDED "AS IS" WITHOUT
WARRANTY OF ANY KIND, WHETHER EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-
INFRINGEMENT.
No part of the text or software included in this training package may be

reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or any information storage and
retrieval system, without permission from Microsoft®. Because Microsoft must
respond to changing market conditions, it should not be interpreted to be a
commitment on the part of Microsoft, and Microsoft cannot guarantee the
accuracy of any information presented after the date of publication. The names
of actual companies and products mentioned herein may be the trademarks of
their respective owners.
To obtain authorization for uses other than those specified above, please visit
the Microsoft Copyright Permissions web page at
http://www.microsoft.com/permission/copyrgt/img-req.htm.
This content is proprietary and confidential, and is intended only for users
described in the content provided in this document. This content and
information is provided to you under a Non-Disclosure Agreement and cannot
be distributed. Copying, disclosing all or any portion of the content and/or
information included in this document is strictly prohibited.
Table of Contents
Boot Process .................................................................................. 1

Introduction .................................................................................. 5
Boot Process .................................................................................. 6
Initial Phase: ........................................................................................6
Boot Loader Phase ................................................................................8
Kernel Phase ........................................................................................8
Logon Phase.........................................................................................9
Hardware Basics ...................................................................................10
Key Components................................................................................. 10
BIOS .....................................................................................................12
Key Points.......................................................................................... 12
Disk.......................................................................................................13
Key Points.......................................................................................... 13
Boot Files ..............................................................................................15
Key Points.......................................................................................... 15
Registry ................................................................................................16
Key Points.......................................................................................... 16
Drivers ..................................................................................................18
Key Points.......................................................................................... 18
Services ................................................................................................21
Key Points.......................................................................................... 21
Logon....................................................................................................23
Key Points.......................................................................................... 23
Applications ..........................................................................................25
Key Points.......................................................................................... 25
Clean Boot Troubleshooting ..................................................................27
Troubleshooting .................................................................................. 28
Safe Mode and Clean Boot Troubleshooting ................................. 30
Next Steps ......................................................................................... 30
Boot Logging ...................................................................................... 33
Shutdown Troubleshooting ................................................................... 34
Table of Figures
Figure 1 – Boot Process, Part 1 ..............................................................................................7
Figure 2 – Boot Process, Part 2 ..............................................................................................8
Figure 3 – Boot Process and the Registry .............................................................................. 17
Figure 4 - Clean Boot Troubleshooting Flowchart.................................................................... 28
Boot Process
Introduction
Module Objectives:
● At the completion of this module you will be able to:
● Discuss components of a PC.
● Define BIOS and discuss relation with the boot process.
● Define key disk structures (Disks, Partitions, MBR, Boot Sector)
● Identify method for repairing the boot files.
● Identify location of registry files, and backup registry files.
● Discuss driver loading during the boot process.
● Define Service, and identify when services load on startup.
● Discuss user accounts and user profiles.
● Discuss application startup locations (registry, Startup group, other).
● Outline steps for clean boot troubleshooting in Windows XP..
Microsoft Partner 5
Boot Process
Boot Process
The topic covers the boot process of a Microsoft® Windows® XP system.
Reference:
Chapter 2: Installing and Configuring Windows XP
Configuring Startup Options
Overview of the Startup Process
“Microsoft Windows XP Inside Out” CD-ROM, by Ed Bott, Carl Siechert, and Craig Stinson. Copyright ©
1995-2003 by Microsoft Corporation. Portions copyright © 2003 by Ed Bott, Carl Siechert, and Craig
Stinson.
The Windows XP boot process occurs in four unique phases:
● Initial
● Boot loader
● Kernel
● Logon phases
Initial Phase:
During the initial phase, the system performs a power-on self test (POST), searches
for and loads the first physical sector of a boot device, and passes control to
NTLDR.exe. The initial phase can be broken down into two parts:
● Power on Self Test (POST): The PC powers on and performs a few basic system
diagnostics.
● Disk Access: The system BIOS loads the Master Boot Record and executes the
NT boot file: NTLDR.
6 Microsoft Partner
Boot Process
Figure 1 – Boot Process, Part 1
Microsoft Partner 7
Boot Process
Boot Loader Phase

During the Loader Phase, NTLDR loads ntdetect.com. Ntdetect.com does an initial
hardware detection. The system registry hive is loaded into memory. Any device
drivers identified in the system registry as boot devices are loaded into memory. The
kernel is loaded into memory and executed.
Figure 2 – Boot Process, Part 2
Kernel Phase
The kernel initializes all device drivers that are boot devices. All device drivers with a
start value of “1” are loaded into memory and initialized. The Session Manager is
initialized. The remaining registry hives are loaded. The Windows subsystem is
started. The Winlogon process is started. All drivers with a start value of “2” are
initialized.
The kernel file is either Ntoskrnl.exe for single-processor machines, or Ntkrnlmp.exe

for multi-processor machines.
8 Microsoft Partner
Hardware Basics Boot Process
Logon Phase
The local security service Lsass.exe is started. The login screen should appear.
Services with a start value of “2” are started. When the user logs on, the shell is
initialized and desktop appears.
Microsoft Partner 9
Boot Process Hardware Basics
Hardware Basics
Objectives:
● Discuss components of a personal computer.
Key Components
Key components of personal computers running Windows XP include the following:
• Processor
• Motherboard
o Chipset
o Many integrated components
• BIOS
o Configuration stored on CMOS chip
• Memory (RAM)
• Disk Controller
o Typically built onto the motherboard
• Storage
o Hard Disk
Data Structures
• Master Boot Record
• Partitions/Partition Table
• Boot Sector
File Systems
• FAT16/FAT32
• NTFS
o Other Storage
CD-ROM/DVD-ROM Drives
10 Microsoft Partner
Hardware Basics Boot Process
CD-R/RW Drives
• Display Adapter and Monitor
• Sound Card
• USB Host Controller and Devices
• Printers
• Network Adapters
• Modems
• Power Supply and Case
Support Boundaries
Microsoft Support Professionals should troubleshoot issues to the hardware level.
When a support professional has eliminated software issues as the cause and suspects
that the hardware is causing the issue, the customer should be redirected to the
Original Equipment Manufacturer (OEM) for the computer or the Independent
Hardware Vendor (IHV) of the device in question.
To ensure high customer satisfaction, support engineers should set expectations with
customers at the beginning of the call, or at any time that they feel the issues is
potentially caused by hardware. For example, “Joe, there are several tests that I want
to try to narrow down the problem. After we’ve tried these tests, we may discover that
the mouse is causing the problem in which case I would need to have you contact the
manufacturer of the mouse.”
Microsoft Partner 11
Boot Process BIOS
BIOS
Objectives:
● Define BIOS and discuss relation with the boot process.
Reference:
Configuring Startup Options
Overview of the Startup Process
“Microsoft Windows XP Inside Out” CD-ROM, by Ed Bott, Carl Siechert, and Craig Stinson. Copyright © 1995-
2003 by Microsoft Corporation. Portions copyright © 2003 by Ed Bott, Carl Siechert, and Craig Stinson.
Key Points
The Basic Input Output System (BIOS) for x86 Personal Computers provides the low-
level programming needed to initialize the hardware, and access disk devices to load
an operating system.
Considerations:
• Errors at Power On Self Test (POST)
• BIOS Updates
• Support Boundaries
Disk Boot Process
Disk
Objectives:
● Define key disk structures (Disks, Partitions, MBR, Boot Sector)
Reference:
Hard Disk Management 101
Key Points
Components:
• Disk
• Partition
• MBR
• Partition Table
• Boot Sector
• File Systems
• FAT16/FAT32
• NTFS
Tools:
• Chkdsk
o Chkdsk /f – Must have exclusive disk access.
o Chkdsk /r – Run in Recovery Console.
• Defrag
• Disk Cleanup
Boot Process Disk
Boot Files Boot Process
Boot Files
Objectives:
● Identify method for repairing the boot files.
Reference:
Chapter 25: Recovering After a Computer Crash
Making Repairs from the Recovery Console
Key Points
The following files are required to boot to Windows XP:
• \NTLDR: During the initial phase, the system performs a power-on self test
(POST), searches for and loads the first physical sector of a boot device, and
passes control to NTLDR.exe. Disk Access: The system BIOS loads the Master
Boot Record and executes the NT boot file: NTLDR. During the Loader Phase,
NTLDR loads ntdetect.com. NTLDR loads and reads the Boot.ini and if the
boot.ini contains reference to more than one Operating System, then the boot
loader screen is displayed.
• \NTDetect.com: During the Loader Phase, Ntdetect.com does an initial

hardware detection. Ntdetect.com initializes and detects all the supported
hardware that it can find. Ntdetect.com passes its list of hardware components
to NTLDR.
• \Boot.ini: The Boot.ini file is used by Windows NT (specifically, Ntldr) to

determine the operating system options to display during the startup (boot)
process. During the Loader Phase, NTLDR loads and reads the Boot.ini and if
the boot.ini contains reference to more than one Operating System, then the
boot loader screen is displayed.\Windows\System32\NTOSKrnl.exe – This is the
operating system kernel. Note that it may also be NTKrnlMP.exe in the case of
a multi-processor computer.
• \Windows\System32\HAL.dll – This is the hardware abstraction layer file, which

implements the direct hardware access needed by the kernel. There are several
versions of this file, depending on whether the machine supports Advanced
Configuration and Power Interface (ACPI), as well as multiple or single
processors.
Many other files are required, but these particular files form the core of the early
startup process.
Boot Process Registry
Registry
Objectives:
• Identify location of registry files, and backup registry files.
Reference:
● KB Article: Description of the Microsoft Windows registry (256986)
● KB Article: How to recover from a corrupted registry that prevents Windows XP

from starting (307545)
Chapter 29: Editing the Registry
Key Points
The Registry consists of a set of database files used to store configuration information
for Windows, drivers, and applications. These files are represented in the Registry
Editor (Regedit) as top-level keys, or hives.
The files containing the registry are in several locations - %windir%\system32\config

contains hives related to the computer, and %userprofile% contains hives related to
the user.
Per-machine files in %windir%\system32\config include:
• Default: This file contains the default user profile, which is used to create new
user profiles, and also settings for the computer before a user has logged on.
Settings for this file are shown in Regedit under HKU\.DEFAULT.
• SAM: This file contains local user and group information, displayed in Regedit
under HKLM\SAM.
• Security: This file stores system wide security information and policies. It is
exposed in Regedit under HKLM\SECURITY.
• Software: This file contains software installation information and per-machine

software configuration information. This hive is displayed in Regedit as
HKLM\SOFTWARE.
• System: This file contains information needed to boot the computer, including
driver configuration, service startup settings and low level configuration options
for Windows. This is exposed as HKLM\SYSTEM in Regedit.
Registry Boot Process
Per-user files in %userprofile% are named NTUSER.DAT. This contains the user
settings and other information stored under HKEY_CURRENT_USER (HKCU), which
displays the current user’s branch of the registry, displayed also under HKEY_USERS.
Note that there is also an NTUSER.DAT file in the Default User profile folder. This hive
is used to create the user registry for new user profiles.
Figure 3 – Boot Process and the Registry
Boot Process Drivers
Drivers
Objectives:
• Discuss driver loading during the boot process.
Reference:
● KB Article: HOW TO: Manage Devices in Windows XP (283658)
● KB Article: Troubleshooting Device Conflicts with Device Manager (310126)
● KB Article: HOW TO: Verify Unsigned Device Drivers in Windows XP (308514)
Chapter 6: Setting up and Troubleshooting Hardware
Key Points
Drivers are software that provide support for hardware devices on the computer, or
provide functionality to the system. Examples include:
Display Driver: enables the display adapter to work with Windows. In most cases
you don’t need a display driver for basic display of information, but for >640x480
resolution, more colors and best performance, the driver is imperative.
Disk Controller Driver: supports the hardware interface that connects the hard
drives to the motherboard. Many disk controllers are supported by drivers included
with Windows XP. In cases where the driver is not included, it must be provided during
Setup.
Network Protocol Driver: implements the network protocol. This does not support a
hardware device, but adds functionality to the system which is available for all users.
Drivers can also be categorized based on tests for quality. Because faulty drivers can
cause Windows to fault, it is important that high quality drivers are used. Driver
Signing describes the process used to digitally sign a driver once it has passed tests
provided by Microsoft for compatibility and stability. Unsigned drivers may be stable,
but there is no guarantee. When troubleshooting driver related issues, it is good to
focus on unsigned drivers first.
During the Loader Phase, any device drivers identified in the system registry as boot
devices are loaded into memory. The kernel is loaded into memory and executed.
Drivers Boot Process
initialized.
Boot Process
During the Loader Phase, any device drivers identified in the system registry as boot
devices are loaded into memory. The kernel is loaded into memory and executed.
initialized.
Troubleshooting Tools
Drivers can be examined using Device Manager (devmgmt.msc), which is a Microsoft
Management Console (MMC) snap-in that is available in the Computer Management
interface. The Driver tab in a device’s properties provides information about the driver
date, and whether it is a signed driver.
Drivers can be configured to start when the computer is started. Some, such as the
disk controller driver, start early in the boot process. Others, such as the sound card
driver, are initialized later in the boot process.
Safe Mode is useful for troubleshooting driver issues, because it uses only the most
critical drivers needed to boot the computer. If the problem does not occur in Safe
Mode, using Device Manager to disable non-critical devices will prevent these drivers
from loading, and may enable the computer to start properly. If so, you can go back in
Device Manager, re-enable some of the devices and test. Continue this technique,
adding back half of the devices until the problem recurs, and then narrow down on the
problem driver.
Another technique that can be useful for troubleshooting device issues during startup
or installation of Windows is to disconnect any nonessential hardware. This would
include any Universal Serial Bus (USB) devices, as well as other external devices that
are not needed to start the computer.
Finally, the Disable command in Recovery Console provides the ability to set drivers
as disabled even if you cannot start the operating system in Safe Mode. You can use
Listsvc to view a list of services and drivers. This is recommended only when clear
information that points to a particular driver as the cause of the issue is available.
Because only a subset of drivers is used in Safe Mode, failures of this type are
infrequent. These tools will be explained in more detail in a later module.
Driver Rollback Process

Driver Rollback Process:
1. The DeviceInstanceID value of

HKLM\Software\Microsoft\Windows|CurrentVersion\Reinstall\XXXX is compared
to the ID value of the selected device. If there is a match, then a rollback is
possible.
Boot Process Drivers
2. The string value ReinstallString is used to locate the backed-up driver package
for this device.
3. The original driver package is re-installed based on the INF and SYS files stored
in the location mentioned previously.
4. Both the folder and the key for this stored driver package are deleted after the
re-install is complete.
Services Boot Process
Services
Objectives:
• Define Service
• Identify when services load on startup
Reference:
Chapter 7: Managing Programs and Processes
Controlling Services at Startup
Appendix C: Working with the Command Prompt
Key Points
Services are similar to applications on the computer, but they run regardless of the
user(s) logged on to the computer. Some services start automatically, while others are
only started when needed.
Services that start automatically are initialized before user logon, in order of the
dependencies that exist. So if Service Y requires that Service X is running, Service X is
started first. Although services can all potentially start before a user logs on to the
computer, it is possible to logon to the computer when only a portion of the services
have started. When the critical system services have started, the user can logon.
Service initialization continues after logon for additional services.
The Services MMC snap-in (Services.msc) is the main interface for controlling
services. This interface provides the list of services on the machine. For each service,
you can configure the startup setting (Automatic, Manual, or Disabled), change the
user account for the service, modify failure actions, and view dependencies that exist
between services.
In addition, the System Configuration Utility (MSConfig.exe) provides the Services

tab, where you can selectively disable services on the machine. On this tab, you can
hide all Microsoft services leaving third party services not included with Windows
visible and allowing you to selectively disable them to find the problem.
Boot Process Services
One key Microsoft service is the System Restore service, which provides Restore Point
support. If this service is disabled, all previous restore points are deleted, leaving you
with no restore points to use for later troubleshooting. As a result, even if you need to
disable Microsoft services, it is recommended that you not disable the System Restore
service using MSConfig.
Finally, the Disable command in Recovery Console provides the ability to set
services as disabled even if you cannot start the operating system in Safe Mode. You
can use Listsvc to view a list of services and drivers This is recommended only when
clear information that points to a particular service as the cause of the issue is
available. Because only a subset of services is used in Safe Mode, failures of this type
are infrequent.
Logon Boot Process
Logon
Objectives:
• Discuss user accounts
• Define user profiles
Reference:
Chapter 3: Controlling Access to Your Computer
Chapter 34: Managing User Profiles
Key Points
User logon is the process of validating a user account against the local (or domain)
security database, and then loading settings and applications for that user. On many
home computers this is an automatic process. When you install Windows XP and only
specify one user during the final stage of the installation, Windows does not ask you to
logon – it simply logs that user on automatically during the startup process. If a
password is configured for this single user, then the Welcome screen logon is
displayed and manual logon is needed.
From the perspective of the boot process, user logon is a transition point in several
ways:
• Last Known Good Configuration is an option in the F8 boot menu that is used to
recover from driver and service issues that have occurred since the last
successful startup. As soon as user logon occurs, the Last Known Good
Configuration is updated to point to the current configuration. This makes the
Last Known Good Configuration no longer useful for troubleshooting should you
encounter a failure during this startup.
• Many services have already started. Others will continue to load after user
logon, but the majority of critical services are running at the time of logon.
• The user profile for the user account is loaded. This includes the user registry
(NTUser.dat), as well as other components in \Documents and
Settings\<username>.
• This is when applications configured to start automatically are initialized.
Boot Process Logon
Troubleshooting
When troubleshooting a logon failure, it is important to identify whether the issue is
related to permissions or an account issue, damaged user profile, or applications
configured to start automatically.
Account issues will typically involve errors indicating that access is denied, or the
user cannot logon. There could also be forgotten password issues. The best first
course of action for such issues is to attempt to logon as a different user.
Damaged User Profile issues typically result in blank desktops, errors during logon,
or other types of failure during the logon process. Troubleshooting for these issues
also involves logon as a different user, to isolate the problem to one user account.
In Windows XP Professional Edition, you can Press CTRL + ALT + DEL twice at the
Welcome screen to display a standard logon interface. At the interface you can then
attempt to logon as Administrator. By default this account does not have a password.
In Windows XP Home Edition, you can boot to Safe Mode and logon as administrator
to test another user.
For application startup issues, consult the following section.
Applications Boot Process
Applications
Objectives:
• Discuss application startup locations (registry, Startup group, other).
Reference:
Chapter 7: Tuning Up System Performance
Managing Programs and Processes
Key Points
Applications can start automatically during user logon. This is a frequent cause of
startup performance problems, as well as error messages during the log on phase of
the boot process.
Because applications load only after user logon, it is easy to narrow down failures that
cannot be application-related. Errors at the startup splash screen, for example, could
not be caused by an application.
Locations from which applications can start automatically include the following:
• Machine Run Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• User Run Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• Common Startup Folder: \Documents and Settings\All Users\Start

Menu\Startup
• User Startup Folder: \Documents and Settings\<username>\Start

Menu\Startup
• Scheduled Tasks: Control Panel\Scheduled Tasks. This is a folder that contains

programs that are run periodically. One of the options for a scheduled tasks is
to run on startup.
• Win.ini (rare): This was the startup method for older versions of Windows.
While it is possible for a startup item to load from here, it is increasingly
unlikely.
Boot Process Applications
• RunOnce and RunOnceEx Keys: Same locations as the Machine and User Run
keys, but named RunOnce and RunOnceEx. Startup items in these locations are
started, and then deleted from the key.
The System Configuration Utility (MSConfig.exe) is the single best tool in Windows
to troubleshoot startup application issues. Any time you encounter a problem that
happens in Normal startup, but not in Safe Mode, you should start your
troubleshooting with MSConfig.
Clean Boot Troubleshooting Boot Process
Clean Boot Troubleshooting
Objectives:
• Outline steps for clean boot troubleshooting in Windows XP
Reference:
● KB Article: Resources for troubleshooting startup problems in Windows
XP (308041)
● KB Article: How to perform advanced clean-boot troubleshooting in

Windows XP (316434)
● KB Article: How to start your computer by using the Last Known Good
Configuration feature in Windows XP (307852)
Chapter 7
Managing Programs and Processes
Configuring Programs That Run Automatically
(System Configuration Utility)
Chapter 25
Using Advanced Startup Options
Appendix D - Viewing System Information
Boot Process Clean Boot Troubleshooting
Troubleshooting
Figure 4 - Clean Boot Troubleshooting Flowchart
Safe Mode and Clean Boot Troubleshooting

Safe Mode is an essential step when troubleshooting many Windows XP
issues. If the computer does not have a particular problem in Safe Mode, one
of the following is causing the problem in Normal Mode:
● Driver for a device not loaded in Safe Mode
● Services loading on startup
● Applications loading on startup
More information on Clean Boot troubleshooting can be found in the following

articles:
KB Article: How to perform a clean boot in Windows XP (310353)
KB Article: How to troubleshoot by using the System Configuration utility in
Windows XP (310560)
KB Article: How to perform advanced clean-boot troubleshooting in Windows
XP (316434)
KB Article: Resources for troubleshooting startup problems in Windows XP
(308041)
Note:
Issues that do not occur while logged on as Administrator in Safe Mode could
also be a result of user permissions or user profile issues. If you have only
tested Safe Mode with Administrator, test using the user’s normal account in
Safe Mode to rule out these issues.
Next Steps
If Safe Mode also fails, continue with issue-specific troubleshooting as
discussed in the remainder of this document.
When Safe Mode is functional but Normal Mode is not, perform the following
troubleshooting:
1. Use standard clean boot troubleshooting to isolate the issue. Start with
MSConfig using the steps in the following article:
KB Article: How to perform a clean boot in Windows XP (310353)
2. If the issue is still present with the most aggressive clean boot
documented in that article, start MSConfig and check the
/BASEVIDEO option on the Boot.ini tab. Then restart the computer.
See also: A description of the Safe Mode Boot options in Windows XP
(315222)
a. If the issue is resolved, check for updated video drivers.
b. If the issue is not resolved, uncheck the /BASEVIDEO option and

continue with the troubleshooting.
3. If the issue still occurs, remove non-essential hardware from the

computer and restart normally.
4. If the error does not appear when starting normally with non-essential
hardware disconnected from the computer:
a. Connect the devices one-at-a-time, restarting after each device.

Repeat until you find the device with the malfunctioning driver.
b. When you find the problem driver, remove the device and use
Device Manager to update the driver using the following steps:
i. Open a CMD prompt.
ii. Type the following two commands, pressing enter after each:
set devmgr_show_nonpresent_devices=1
start devmgmt.msc
For more information on the above commands, see:

KB Article: Device Manager Does Not Display Devices That
Are Not Connected to the Windows XP-Based Computer
(315539)
c. This should open Device Manager. Click the View menu and then
click Show hidden devices.
d. Locate the problem device and double-click it. Also check for any
non-present devices (displayed with a faded icon), and delete the
devices that are not needed. Pay particular attention to non-
present devices that are duplicates of currently active devices.
These are known as “ghosted devices”.
e. Check the Driver tab to determine what version and date driver it
is using. Look for updated drivers for this device.
f. Check to see if the driver is signed. If the device is using a driver

that shows Microsoft Windows Publisher as the Digital Signer,
and the date and time match SP2 (August, 2004), then the device
is likely using a driver updated with SP2.
i. Click the Driver Details button and check to ensure that all
files have the same version information. If not, check the
device manufacturer’s web site for updated drivers or remove
the device from Device Manager.
ii. If all files match in version or date/time, use the Roll Back
Driver button on the Driver tab of the device Properties.
This should restore the previous driver version in use.
g. If the device driver is not signed, or shows a different Digital

Signer, check Windows Update for updated driver versions
available from Microsoft. If no updated versions are available,
check the device manufacturer’s web site for updated drivers or
remove the device from Device Manager.
5. If no updated drivers are available, check the Driver tab again, and
note the driver files listed. Then delete the device in Device Manager,
rename the files in the \Windows\System32\Drivers folder and reinstall
the device.
This process can resolve cases where the driver files are corrupt.
6. If the error continues to appear in normal mode with non-essential

hardware removed, create a new hardware profile and then use Device
Manager to disable non-essential devices in that profile.
a. Open System Properties.
b. On the Hardware tab, click Hardware Profiles.
c. Select the current hardware profile and then click the Copy button
to make a duplicate profile. Name this profile “Test”.
d. Restart the computer, and select the Test profile when prompted
during the boot process.
e. Open Device Manager and disable non-essential devices. Note all

devices that you disable so that they can be re-enabled at the end
of the troubleshooting.
Non-essential devices would include those in the following
categories:
- Bluetooth Radios
- IEEE 1394 Bus host controllers
- Infrared devices
- Modems
- Network adapters
- PCMCIA adapters
- Sound, video and game controllers
Devices in the “Universal Serial Bus Controllers” category can be
disabled, but only if the computer is not using a USB keyboard or
mouse.
f. When you reach a configuration where the computer is able to

boot to Normal Mode, re-enable devices in groups to narrow down
the particular device/driver causing the issue.
g. Continue with the following steps after isolating the problem

device.
7. When the specific driver is isolated, locate the problem device in

Device Manager and double-click it.
a. Check the Driver tab to determine what version and date driver it
is using. Also check to see if the driver is signed.
b. If the device is using a driver that shows Microsoft Windows

Publisher as the Digital Signer, and the date and time match SP2
(August, 2004), then the device is likely using a driver updated
with SP2.
i. Click the Driver Details button and check to ensure that all
files have the same version information. If not, check the
device manufacturer’s web site for updated drivers or remove
the device from Device Manager.
ii. If all files match in version or date/time, use the Roll Back
Driver button on the Driver tab of the device Properties.
This should restore the previous driver version in use.
c. If the device driver is not signed, or shows a different Digital

Signer, check Windows Update for updated driver versions
available from Microsoft. If no updated versions are available,
check the device manufacturer’s web site for updated drivers or
remove the device from Device Manager.
8. When the troubleshooting is complete, restart the computer in the

original hardware profile. Then go back to the Hardware Profiles list
from System Properties and delete the Test profile.
Boot Logging
Boot logging can be enabled using F8 during startup and selecting the Enable
Boot Logging option. Enabling this feature causes a log to be created, which
lists each driver as it initializes. This data is logged to
%windir%\ntbtlog.txt. Entries representing drivers not loading can
indicate a problem:
Did not load driver \SystemRoot\System32\DRIVERS\mydriver.sys
Boot logging is also enabled when you start the computer in Safe Mode, Safe
Mode with Command Prompt, and Safe Mode with Networking.
Note: Boot log entries are recorded starting with NTOSKRNL, but are not
written to the ntbtlog.txt file until Smss.exe initializes. Because of this the log
file may not be present after failures early in the boot process.
Also note: The boot log is not overwritten on each boot. New data is
appended at the end of the file. To view the latest information, read this file
from the bottom up.
Shutdown Troubleshooting
Troubleshooting shutdown issues involves a process similar to startup issues.
Because shutdown problems may be causes by applications, services or
drivers, the Safe Mode and Clean Boot Troubleshooting process outlined
above should be followed when no clear resolution is available.
For more information on troubleshooting shutdown issues, see:

KB Article: Resources to help troubleshoot shutdown problems in Windows
XP (308029)

Module Boot Process

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Module Boot Process

Uploaded by

Copyright:

Available Formats

Boot Process

Microsoft Windows® XP New Hire

Microsoft Confidential – Provided Under NDA

Microsoft, Internet Explorer, and Windows are either registered trademarks or

THE CONTENTS OF THIS PACKAGE ARE FOR INFORMATIONAL AND

No part of the text or software included in this training package may be

Boot Process .................................................................................. 1

● Discuss components of a PC.

● Define BIOS and discuss relation with the boot process.

● Define key disk structures (Disks, Partitions, MBR, Boot Sector)

● Identify method for repairing the boot files.

● Identify location of registry files, and backup registry files.

● Discuss driver loading during the boot process.

● Define Service, and identify when services load on startup.

● Discuss user accounts and user profiles.

● Discuss application startup locations (registry, Startup group, other).

● Outline steps for clean boot troubleshooting in Windows XP..

Configuring Startup Options

Overview of the Startup Process

The Windows XP boot process occurs in four unique phases:

Figure 1 – Boot Process, Part 1

Boot Loader Phase

Figure 2 – Boot Process, Part 2

The kernel file is either Ntoskrnl.exe for single-processor machines, or Ntkrnlmp.exe

o Many integrated components

o Configuration stored on CMOS chip

o Typically built onto the motherboard

• Master Boot Record

• Display Adapter and Monitor

• USB Host Controller and Devices

• Power Supply and Case

Configuring Startup Options

Overview of the Startup Process

• Errors at Power On Self Test (POST)

Hard Disk Management 101

o Chkdsk /f – Must have exclusive disk access.

o Chkdsk /r – Run in Recovery Console.

Making Repairs from the Recovery Console

• \NTDetect.com: During the Loader Phase, Ntdetect.com does an initial

• \Boot.ini: The Boot.ini file is used by Windows NT (specifically, Ntldr) to

• \Windows\System32\HAL.dll – This is the hardware abstraction layer file, which

● KB Article: How to recover from a corrupted registry that prevents Windows XP

Chapter 29: Editing the Registry

The files containing the registry are in several locations - %windir%\system32\config

Per-machine files in %windir%\system32\config include:

• Software: This file contains software installation information and per-machine

Figure 3 – Boot Process and the Registry

● KB Article: Troubleshooting Device Conflicts with Device Manager (310126)

● KB Article: HOW TO: Verify Unsigned Device Drivers in Windows XP (308514)

Chapter 6: Setting up and Troubleshooting Hardware

Driver Rollback Process

1. The DeviceInstanceID value of

• Identify when services load on startup

Controlling Services at Startup

Appendix C: Working with the Command Prompt

In addition, the System Configuration Utility (MSConfig.exe) provides the Services

• Define user profiles

Chapter 34: Managing User Profiles

• This is when applications configured to start automatically are initialized.

For application startup issues, consult the following section.

Managing Programs and Processes

• Machine Run Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run

• User Run Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run