Jump to content

Booting process of Windows NT

From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by BrandonXLF (talk | contribs) at 15:55, 21 March 2023 (Removed {{DEFAULTSORT}} using Hot Default Sort). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

The booting process of Windows NT includes Windows NT 4.0, Windows 2000, Windows XP and Windows Server 2003. In Windows Vista and later, this process has changed significantly; see Windows NT 6 startup process for information about what has changed.

Boot loader phase

Further information: NTLDR

The Windows NT startup process starts when the computer finds a Windows boot loader, a portion of the Windows operating system responsible for finding Microsoft Windows and starting it up. Prior to Windows Vista, the boot loader was NTLDR. Microsoft has also released operating systems for Intel Itanium processors which use IA-64 architecture. The boot loader of these editions of Windows is IA64ldr.efi (later referred as simply IA64ldr). It is an Extensible Firmware Interface (EFI) program.[1]

Operating system selection

NTLDR Bootloader's Advanced Option Menu

The boot loader, once executed, searches for Windows operating systems. Windows Boot Manager does so by reading Boot Configuration Data (BCD), a complex firmware-independent database for boot-time configuration data. Its predecessor, NTLDR, does so by reading the simpler boot.ini. If the boot.ini file is missing, the boot loader will attempt to locate information from the standard installation directory. For Windows NT and 2000 machines, it will attempt to boot from C:\WINNT. For Windows XP and 2003 machines, it will boot from C:\WINDOWS.

Both databases may contain a list of installed Microsoft operating systems that may be loaded from the local hard disk drive or a remote computer on the local network. NTLDR supports operating systems installed on disks whose file system is NTFS or FAT file systems, CDFS (ISO 9660) or UDFS.[2] Windows Boot Manager also supports operating systems installed inside a VHD file, stored on an NTFS disk drive.[3]

In Windows 2000 or in later versions of Windows in which hibernation is supported, the Windows boot loader starts the search for operating systems by searching for hiberfil.sys. NTLDR looks into the root folder of the default volume specified in boot.ini. Windows Boot Manager looks up the location of hiberfil.sys in BCD. If this file is found and an active memory set is found in it, the boot loader loads the contents of the file (which is a compressed version of a physical memory dump of the machine) into memory and restores the computer to the state that it was in prior to hibernation.

Next, the boot loader looks for a list of installed operating system entries. If more than one operating system is installed, the boot loader shows a boot menu and allow the user to select an operating system. If a non NT-based operating system such as Windows 98 is selected (specified by an MS-DOS style of path, e.g. C:\), then the boot loader loads the associated "boot sector" file listed in boot.ini or BCD (by default, this is bootsect.dos if no file name is specified) and passes execution control to it. Otherwise, the boot process continues.

Loading the Windows NT kernel

The operating system starts when certain basic drivers flagged as "Boot" are loaded into memory. The appropriate file system driver for the partition type (NTFS, FAT, or FAT32) which the Windows installation resides in is amongst them. At this point in the boot process, the boot loader clears the screen and displays a textual progress bar (which is often not seen due to the initialization speed); Windows 2000 also displays the text "Starting Windows..." underneath. If the user presses F8 during this phase, the advanced boot menu is displayed, containing various special boot modes including Safe mode, with the Last Known Good Configuration, with debugging enabled, and (in the case of Server editions) Directory Services Restore Mode. Once a boot mode has been selected (or if F8 was never pressed) booting continues.

The following files are loaded sequentially. [dubious – discuss]

  1. ntoskrnl.exe (the kernel)
  2. hal.dll (type of hardware abstraction layer)
  3. kdcom.dll (Kernel Debugger HW Extension DLL)
  4. bootvid.dll (for the Windows logo and side-scrolling bar)
  5. config\system (one of the registry hives)

Next, NTDETECT.COM and the Windows NT kernel (Ntoskrnl.exe) and the Hardware Abstraction Layer (hal.dll) are loaded into memory. If multiple hardware configurations are defined in the Windows Registry, the user is prompted at this point to choose one.

With the kernel in memory, boot-time device drivers are loaded (but not yet initialized). The required information (along with information on all detected hardware and Windows Services) is stored in the HKEY_LOCAL_MACHINE\System portion of the registry, in a set of registry keys collectively called a Control Set. Multiple control sets (typically two) are kept, in the event that the settings contained in the currently-used one prohibit the system from booting. HKEY_LOCAL_MACHINE\System contains control sets labeled ControlSet001, ControlSet002, etc., as well as CurrentControlSet. During regular operation, Windows uses CurrentControlSet to read and write information. CurrentControlSet is a reference to one of the control sets stored in the registry. Windows picks the "real" control set being used based on the values set in the HKLM\SYSTEM\Select registry key:

  • Default will be the boot loader's choice if nothing else overrides this
  • If the value of the Failed key matches Default, then the boot loader displays an error message, indicating that the last boot failed, and gives the user the option to try booting anyway, or to use the "Last Known Good Configuration".
  • If the user choose (or has chosen) Last Known Good Configuration, the control set indicated by the LastKnownGood key is used instead of Default.

When a control set is chosen, the Current key gets set accordingly. The Failed key is also set to the same as Current until the end of the boot process. LastKnownGood is also set to Current if the boot process completes successfully.

Which services are started and the order which each group is started in are provided by the following keys:

  • HKLM\SYSTEM\CurrentControlSet\Services
  • HKLM\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder

For the purposes of booting, a driver may be one of the following:

  1. A "Boot" driver that is loaded by the boot loader prior to starting the kernel. "Boot" drivers are almost exclusively drivers for hard-disk controllers and file systems (ATA, SCSI, file system filter manager, etc.); in other words, they are the absolute minimum that the kernel will need to get started with loading other drivers, and the rest of the operating system.
  2. A "System" driver which is loaded and started by the kernel after the boot drivers. "System" drivers cover a wider range of core functionality, including the display driver, CD-ROM support, and the TCP/IP stack.
  3. An "Automatic" driver which is loaded much later when the GUI already has been started.

With this finished, control is then passed from the boot loader to the kernel.

Kernel phase

Further information: ntoskrnl.exe

The initialization of the kernel subsystem and the Windows Executive subsystems is done in two phases.

During the first phase, basic internal memory structures are created, and each CPU's interrupt controller is initialized. The memory manager is initialized, creating areas for the file system cache, paged and non-paged pools of memory. The Object Manager,[4] initial security token for assignment to the first process on the system, and the Process Manager itself. The System idle process as well as the System process are created at this point.

The second phase involves initializing the device drivers which were identified by NTLDR as being system drivers.

Through the process of loading device drivers, a "progress bar" is visible at the bottom of the display on Windows 2000 systems; in Windows XP and Windows Server 2003, this was replaced by an animated bar which does not represent actual progress. Prior to Windows XP, this part of the boot process took significantly longer; this is because the drivers would be initialized one at a time. On Windows XP and Server 2003, the drivers are all initialized asynchronously.

Session Manager

Further information: Session Manager Subsystem

Once all the Boot and System drivers have been loaded, the kernel (system thread) starts the Session Manager Subsystem (smss.exe).

Before any files are opened, Autochk is started by smss.exe.[5] Autochk mounts all drives and checks them one at a time to see whether or not they were cleanly unmounted. If autochk determines one or more volumes are dirty, it will automatically run chkdsk and provides the user with a short window to abort the repair process by pressing a key within 10 seconds (introduced in Windows NT 4.0 Service Pack 4; earlier versions would not allow the user to abort chkdsk). Since Windows 2000, XP and 2003 show no text screen at that point (unlike NT 3.1 to 4.0, which displayed a blue text screen), the user will see a different background picture holding a mini-text-screen in the center of the screen and show the progress of chkdsk there.

At boot time, the Session Manager Subsystem:

  • Creates environment variables (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment)
  • Starts the kernel-mode side of the Win32 subsystem (win32k.sys). This allows Windows to switch into graphical mode as there is now enough infrastructure in place.
  • Starts the user-mode side of the Win32 subsystem, the Client/Server Runtime Server Subsystem (csrss.exe). This makes Win32 available to user-mode applications.
  • Creates virtual memory paging files (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management)
  • Performs any rename operations (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations) that are queued up. This allows previously in-use files (e.g. drivers) to be replaced as part of a reboot.
  • Executes any programs listed in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute such as autocheck and convert.
  • Starts the Windows Logon Manager (winlogon.exe). Winlogon is responsible for handling interactive logons to a Windows system (local or remote). The Graphical Identification aNd Authentication (GINA) library is loaded inside the Winlogon process, and provides support for logging in as a local or Windows domain user.

The Session Manager stores its configuration at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager. The exact operation of most of these items is based on the configuration set in the registry.

Authentication

GINA dialog box in Windows XP.
Further information: Winlogon

Winlogon starts the Local Security Authority Subsystem Service (LSASS) and Service Control Manager (SCM), which in turn will start all the Windows services that are set to Auto-Start.[6] It is also responsible for responding to the secure attention sequence (SAS), loading the user profile on logon, and optionally locking the computer when a screensaver is running.

The login process is as follows:[7][8]

  • The Session Manager Subsystem starts Winlogon.
  • Winlogon starts the Service Control Manager (services.exe).
    • Starts the auto-start services.
    • Updates the Control Sets; the LastKnownGood control set is updated to reflect the current control set.
  • (Windows XP) Winlogon starts UIHost (logonui.exe), a full-screen graphical UI.
  • Winlogon loads GinaDll (msgina.dll)
    • (Optional) Login prompt is displayed by GINA, and the user presses the Secure Attention Sequence (SAS) (Control-Alt-Delete). Winlogon checks if the system is configured to log into a specific account automatically (AutoAdminLogon).
    • Login dialog is displayed by GINA
    • User enters credentials (username, password, and domain)
    • GINA passes credentials back to Winlogon
  • Winlogon passes credentials to LSASS
  • LSASS tries to use cached data in the LSA database (SYSTEM hive)
  • If there is none, LSASS determines which account protocol is to be used by using the Security Packages listed in the key HKLM/SYSTEM/CurrentControlSet/Control/Lsa:
    • msv1_0.dll implements the NT LAN Manager protocols. This package is used in stand-alone systems and domain-member systems for backward compatibility.
    • Kerberos.dll provides remote login by using Active Directory.
  • LSASS enforces the local security policy (checking user permissions, creating audit trails, doling out security tokens, etc.).
  • Control is passed back to Winlogon to prepare for passing the control to the user.
    • Create Windows Stations (WinSta0)[9]
    • Create the desktops (Winlogon, Default and ScreenSaver)[10]
    • It then starts the program specified in the Userinit value which defaults to userinit.exe. This value supports multiple executables.

If the user is trying to log into the local host then the HKLM/SAM key will be used as database. If the user is trying to log into another host then the NetLogon service is used to carry the data. 

msv1_0.dll<->netlogon<->remote netlogon<->remote msv1_0.dll<->remote SAM

On Windows XP, GINA is only shown if the user presses the secure attention sequence.

Winlogon has support for plugins that get loaded and notified about specific events and LSASS also supports plugins (security packages). Some rootkits bundle Winlogon plugins because they are loaded before any user logs in. Some keys allow multiple comma-separated values to be supplied that allow a malicious program to be executed at the same time as a legitimate system file. The hashing algorithms used to store credentials in the SAM database are weak and can be brute-forced quickly on consumer hardware.

Winlogon's responsibilities and the login process have changed significantly from the above in Windows Vista.[11]

Shell

Further information: Windows Explorer

Userinit is the first program that runs with the user credentials. It is responsible to start all the other programs that compose the user shell environment.

The shell program (typically Explorer.exe) is started from the registry entry Shell= pointed to by the same registry entry in key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot; its default value is SYS:Microsoft\Windows NT\CurrentVersion\Winlogon, which evaluates to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.[12]

  • Userinit loads the user profile. There are a few types of user profiles and it can be local or remote. This process can be very slow if the user profile is of the "roaming" type.
  • User and Computer Group Policy settings are applied.
    • Run user scripts
    • Run machine scripts
    • Run proquota.exe
  • Runs the startup programs before the shell gets started.
  • Starts the shell configured in registry, which defaults to explorer.exe.
  • Userinit exits and the shell program continues running without a parent process.

Userinit runs startup programs from the following locations:[6]

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load
  • HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • %ALLUSERSPROFILE%\Start Menu\Programs\Startup\ (this path is localized on non-English versions of Windows before Vista)
  • %USERPROFILE%\Start Menu\Programs\Startup\ (this path is localized on non-English versions of Windows before Vista)

Remote booting and installation

Further information: Windows Deployment Services

To successfully boot, the client must support PXE booting and the Windows Deployment Services (WDS) component must be installed on the server. It is not installed by default. WDS is the successor of Remote Installation Services (RIS).

The PXE program is found on the BIOS or on a ROM chip on the network card.

PXE booting is not a technology specific to Windows and can also be used to start a Linux system. In fact, a Linux system can act as a server to service DHCP or TFTP.

PXE can be used to start Windows Setup to install the system on the client computer or to run the operating system from RAM. The latter, called Remote Boot, was introduced by Windows XP Embedded SP1[13] and is only available for this flavor of Windows.[14]

The general process for both methods is as follows:

  • PXE boot
  • The NBP program downloads the required files through the BINL protocol

The Boot Information Negotiation Layer (BINL) is a Windows 2000 service running on the server that communicates with the client after the NBP was already loaded by the PXE.

See also

References

  1. ^ "In Windows Server 2003, you may not be able to start a computer from a GPT disk when the computer has an Itanium processor (Revision: 2.2)". Microsoft Support. Microsoft Corporation. Retrieved October 29, 2011.
  2. ^ "Unified Extended Firmware Interface support in Windows Vista (Revision: 1.5)". Microsoft Support. Microsoft Corporation. October 26, 2007. Retrieved October 30, 2011.
  3. ^ "Boot from VHD in Win7". TechNet Edge. Microsoft Corporation. February 20, 2009. Retrieved October 30, 2011.
  4. ^ "Windows, NT Object Manager". Channel 9. Microsoft Corporation. June 3, 2005. Retrieved October 24, 2011.
  5. ^ "Resource Kit". Microsoft Corporation. Archived from the original on March 11, 2007.
  6. ^ a b "Troubleshooting the Startup Process". Windows XP Resource Kit. Microsoft Technet. November 3, 2005. Retrieved October 24, 2011.
  7. ^ Ionescu, Alex; Russinovich, Mark; Solomon, David A. (2012). Windows internals (6th ed.). Redmond, Wash.: Microsoft Press. pp. 555, 77. ISBN 978-0735648739.
  8. ^ Ionescu, Alex; Russinovich, Mark; Solomon, David A. (2012). Windows internals (6th ed.). Redmond, Wash.: Microsoft. pp. 522–527. ISBN 978-0735665873.
  9. ^ "Window Stations". MSDN. Microsoft Corporation. Retrieved April 19, 2014.
  10. ^ "Desktops". MSDN. Microsoft Corporation. Retrieved April 19, 2014.
  11. ^ "Create Custom Login Experiences With Credential Providers For Windows Vista". MSDN Magazine. Microsoft Corporation. Retrieved April 13, 2014.
  12. ^ "Different Shells for Different Users". Microsoft Corporation. Retrieved March 16, 2014.
  13. ^ "Deploying Windows XP Embedded Remote Boot". MSDN. Microsoft Corporation. Retrieved April 18, 2014.
  14. ^ "Remote Boot Overview". MSDN. Microsoft Corporation. Retrieved April 19, 2014.
  15. ^ "Managing Network Boot Programs". TechNet. Microsoft Corporation. Retrieved April 18, 2014.

Further reading

  1. Russinovich, Mark; Solomon, David A. (2005). "Startup and Shutdown". Microsoft Windows Internals (4th ed.). Microsoft Press. pp. 251–273. ISBN 0-7356-1917-4.
  2. Minasi, Mark; Enck, John (June 1998). "Troubleshooting NT Boot Failures". Administrator's Survival Guide: System Management and Security. Windows IT Library. ISBN 1-882419-88-X. Retrieved February 15, 2006.
  3. "Description of PXE Interaction Among PXE Client, DHCP, and RIS Server (Revision 2.4)". Microsoft Support. Microsoft Corporation. February 28, 2007. Retrieved October 24, 2011.
  4. "Definition of the RunOnce Keys in the Registry (revision 2.3)". Microsoft Support. Microsoft Corporation. January 19, 2007. Retrieved October 24, 2011.
  5. "Available switch options for the Windows XP and the Windows Server 2003 Boot.ini files (revision 6.3)". Microsoft Support. Microsoft Corporation. November 28, 2007. Retrieved October 24, 2011.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Booting_process_of_Windows_NT&oldid=1145893711"