The Windows NT, 2000 & XP Startup Process

When you startup a Windows NT, 2000 or XP based machine (which are all based on a similar set of code), the computer is loading and juggling many files in order to load the operating system. This is a basic breakdown of the NT/2000/XP startup process which comes in handy for troubleshooting startup problems.

The following files are loaded during the Windows NT/2000/XP startup process:

• Ntldr
• Boot.ini
• Bootsect.dos (for mutlibooting systems only)
• Ntbootdd.sys (loaded only if SCSI drives exist)
• Ntdetect.com
• Ntoskrnl.exe
• Hal.dll
• The Registry files in systemroot\System32\Config
• The Driver files in systemroot\System32\Drivers

The first part that is loaded is the Ntldr (NT Loader) which is started by the active partitions boot sector. It then changes the processor into protected mode, starts the file system and reads the contents of the boot.ini file. The boot.ini file determines startup options and the boot menu selections such as when you dual boot multiple OS’s.

If you are dual booting and you choose a non NT/2000/XP operation system (ie. Linux) then Bootsect.dos is loaded. If you are running any SCSI devices Ntbootdd.sys is loaded which contains the SCSI boot drivers.

Ntdetect.com gathers data regarding the current hardware configuration and passes this information to Ntldr. If your BIOS is ACPI compliant, Windows will use ACPI to initialize the devices. If the computer has multiple hardware profiles then Windows chooses the correct one based on the current hardware configuration.

The Windows kernel loads. Ntldr passes the information that was collected by Ntdetect.com to Ntoskrnl.exe. Ntoskrnl.exe then loads Windows kernel. Hal.dll (Hardware Extraction Layer) and the systems registry information. An indicator on the bottom of the screen (typically a green bar in XP) indicates the progress of this step.

The Windows drivers load and the user logs on. Networking components load such as TCP/IP along with other services and the Windows logon screen appears. After Windows loads successfully, Windows updates the “Last Known Good Configuration” option which you see when you press F8 during bootup to reflect the current configuration state.

Plug and Play detects and configures new devices found on the PC. If Windows finds new devices they are assigned system resources, Windows extracts the necessary drivers from a file called Driver.cab. If the correct driver file is not found in the Driver.cab archive then the user is prompted to provide them. This step occurs simultaneously with the Windows logon process.

In the event that your Windows computer does fail during bootup, you can press F8 on the screen just before the loading screen appears and choose “Enable Boot Logging” which will create a file called Ntbtlog.txt. This file will record all the events during bootup which can help you determine which part is not loading correctly.