Windows booting process

Short description: Process by which the Microsoft Windows of operating system family initializes

The booting process of Microsoft Windows varies between different releases.

## Contents

* 1 DOS-based Windows
* 1.1 Windows 1.x/2.x
* 1.2 Windows 3.x/9x
* 2 Windows NT
* 3 Windows NT 6
* 4 See also
* 5 References

## DOS-based Windows

### Windows 1.x/2.x

In Windows versions 1.01 to Windows 2.11, the system was loaded when `WIN.COM` was executed. It then loaded `WIN100.BIN` or `WIN200.BIN` and `WIN100.OVL` or `WIN200.OVL`, along with the configuration settings file `WIN.INI`. The default shell is the MS-DOS Executive.

The modules `GDI.EXE`, `KERNEL.EXE` and `USER.EXE`, fonts, and the various device drivers (such as `COMM.DRV`, `MOUSE.DRV`, `KEYBOARD.DRV`) are incorporated in `WIN100.BIN`/`WIN200.BIN` and `WIN100.OVL`/`WIN200.OVL`.

### Windows 3.x/9x

In Windows 3.x and 95/98/ME, the boot loader phase is handled by MS-DOS. During the boot phase, `CONFIG.SYS` and `AUTOEXEC.BAT` are executed, along with the configuration settings files `WIN.INI` and `SYSTEM.INI`. Virtual device drivers are also loaded in the startup process: they are most commonly loaded from the registry (`HKLM\System\CurrentControlSet\Services\VxD`) or from the `SYSTEM.INI` file.

When all system configuration files and device drivers have been loaded, the 16-bit modules, `KRNL386.EXE`, `GDI.EXE`, and `USER.EXE`, are loaded, then the 32-bit DLLs (`KERNEL32.DLL`, `GDI32.DLL`, and `USER32.DLL`) are loaded. The 32-bit VxD message server (MSGSRV32) starts `MPREXE.EXE`, which is responsible for loading the network logon client (such as Client for Microsoft Networks, Microsoft Family Logon or Windows Logon).

When a user is logging on to Windows, the startup sound is played, the shell (usually `EXPLORER.EXE`) is loaded from the [boot] section of the `SYSTEM.INI` file, and startup items are loaded.

In all versions of Windows 9x except ME, it is also possible to load Windows by booting to a DOS prompt and typing "win". There are some command line switches that can be used with the WIN command: with the `/D` switch, Windows boots to safe mode, and with the `/D:n` switch, Windows boots to safe mode with networking. The latter switch only works properly with Windows 95.[1] In Windows 3.1, additional options are available, such as `/3`, which starts Windows in 386 enhanced mode, and `/S`, which starts Windows in standard mode[2]

A startup sound was first added in Windows 3.0 after installing the Multimedia Extensions (MME),[3] but not enabled by default until Windows 3.1.

## Windows NT

Main article: Windows NT startup process

In Windows NT, the boot loader is called NTLDR. It is responsible for accessing the file system on the boot drive, for starting ntoskrnl.exe and for loading boot-time device drivers into memory. Once all the Boot and System drivers have been loaded, the kernel (system thread) starts the Session Manager Subsystem (smss.exe), which in turn starts winlogon, which loads the graphical identification and authentication library.

After a user has successfully logged into the machine, winlogon does the following:

* User and Computer Group Policy settings are applied.
* Startup programs are run from the following locations:
1. `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce`
2. `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run`
3. `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`
4. `HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run`
5. `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
6. `HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce`
7. `All Users ProfilePath\Start Menu\Programs\Startup\` (this path is localized on non-English versions of Windows)
8. `Current User ProfilePath\Start Menu\Programs\Startup\` (this path is localized on non-English versions of Windows)

In Windows 95/98/ME, it was also possible to run a program before the user logs on by using RunServicesOnce or RunServices keys. In Windows NT, this has been replaced by the services.exe program, which is able to load a set of system services before a user logs on.

Additionally, in English-language versions of Windows, the startup folder was called "StartUp" instead of "Startup" in Win9x.

Due to the minimally restricted environment of these operating systems, any program can add itself to the Startup registry key or system folder. This method is frequently used by malware.

## Windows NT 6

Main article: Software:Windows NT 6 startup process

The sequence of booting Windows Vista and later versions is different from any previous version of Windows that uses the NT kernel. The operating system boot loader in Vista is called winload.exe, and is invoked by Windows Boot Manager. Additionally, the GINA that has been in use with all versions of Windows NT since 3.1 has been entirely replaced by "Credential Providers".

## See also

* Linux startup process

## References

1. ↑ "Unable to Start Windows 98 in Safe Mode with Network Support". Microsoft. January 23, 2007. http://support.microsoft.com/kb/196249.
2. ↑ "Windows 3.1 WIN.COM Command Switches". Microsoft. October 13, 2003. http://support.microsoft.com/kb/82731.
3. ↑ (in en) Windows 3.0 MME... actually has a startup sound (and more!), https://www.youtube.com/watch?v=FsIBUJleu5U, retrieved 2021-06-22

* v
* t
* e

Microsoft Windows components

Management
tools|

* App Installer
* Command Prompt
* Control Panel
* Applets
* Device Manager
* Disk Cleanup
* Disk Defragmenter
* Driver Verifier
* DxDiag
* Event Viewer
* IExpress
* Management Console
* Netsh
* Performance Monitor
* Recovery Console
* Resource Monitor
* Settings
* Sysprep
* System Configuration
* System File Checker
* System Information
* System Policy Editor
* System Restore
* Task Manager
* Windows Error Reporting
* Windows Ink
* Windows Installer
* PowerShell
* Windows Update
* Windows Insider
* WinRE
* WMI

Apps|

* Alarms & Clock
* Calculator
* Calendar
* Camera
* Character Map
* Cortana
* Edge
* Fax and Scan
* Feedback Hub
* File Manager
* Get Help
* Groove Music
* Magnifier
* Mail
* Messaging
* Maps
* Media Player
* Movies & TV
* Mobility Center
* Money
* News
* Narrator
* Notepad
* OneDrive
* OneNote
* Paint
* Paint 3D
* People
* Phone Companion
* Photos
* Quick Assist
* Snipping Tool
* Speech Recognition
* Skype
* Sports
* Sticky Notes
* View 3D
* Store
* Tips
* Voice Recorder
* Wallet
* Weather
* Windows To Go
* Windows Story Remix
* WordPad
* Xbox Console Companion
* Your Phone

Shell|

* Action Center
* Aero
* AutoPlay
* AutoRun
* ClearType
* Explorer
* Search
* Indexing Service
* IFilter
* Saved search
* Namespace
* Special folder
* Start menu
* Taskbar
* Task View
* Windows Spotlight
* Windows XP visual styles

Services|

* Service Control Manager
* BITS
* CLFS
* Multimedia Class Scheduler
* Shadow Copy
* Task Scheduler
* Error Reporting
* Wireless Zero Configuration

File systems|

* CDFS
* DFS
* exFAT
* IFS
* FAT
* NTFS
* Hard link
* Junction point
* Mount Point
* Reparse point
* Symbolic link
* TxF
* EFS
* ReFS
* UDF

Server|

* Domains
* Active Directory
* DNS
* Group Policy
* Roaming user profiles
* Folder redirection
* Distributed Transaction Coordinator
* MSMQ
* Windows Media Services
* Rights Management Services
* IIS
* Remote Desktop Services
* WSUS
* SharePoint
* Network Access Protection
* PWS
* DFS Replication
* Remote Differential Compression
* Print Services for UNIX
* Remote Installation Services
* Windows Deployment Services
* System Resource Manager
* Hyper-V
* Server Core

Architecture|

* Architecture of Windows NT
* Startup process
* NT
* Vista
* CSRSS
* Desktop Window Manager
* Portable Executable
* EXE
* DLL
* Enhanced Write Filter
* Graphics Device Interface
* hal.dll
* I/O request packet
* Imaging Format
* Kernel Transaction Manager
* Library files
* Logical Disk Manager
* LSASS
* MinWin
* NTLDR
* Ntoskrnl.exe
* Object Manager
* Open XML Paper Specification
* Registry
* Resource Protection
* Security Account Manager
* Server Message Block
* Shadow Copy
* SMSS
* System Idle Process
* USER
* WHEA
* Win32 console
* Winlogon
* WinUSB

Security|

* Security and Maintenance
* AppLocker
* BitLocker
* Credential Guard
* Data Execution Prevention
* Family Safety
* Kernel Patch Protection
* Mandatory Integrity Control
* Protected Media Path
* User Account Control
* User Interface Privilege Isolation
* Windows Defender
* Windows Firewall

Compatibility|

* COMMAND.COM
* Virtual DOS machine
* Windows on Windows
* WoW64
* Windows Subsystem for Linux

API|

* Active Scripting
* WSH
* VBScript
* JScript
* COM
* ActiveX
* ActiveX Document
* COM Structured storage
* DCOM
* OLE
* OLE Automation
* Transaction Server
* DirectX
* .NET Framework
* Universal Windows Platform
* Windows Mixed Reality
* Windows Runtime
* WinUSB

Games|

* Solitaire Collection

Discontinued|

| Games|

* 3D Pinball
* Chess Titans
* FreeCell
* Hearts
* InkBall
* Hold 'Em
* Purble Place
* Reversi
* Spider Solitaire
* Solitaire
* Tinker

|

Apps|

* ActiveMovie
* Anytime Upgrade
* Address Book
* Backup and Restore
* Cardfile
* CardSpace
* CD Player
* Contacts
* Desktop Gadgets
* Diagnostics
* DriveSpace
* DVD Maker
* Easy Transfer
* Fax
* Food & Drink
* Help and Support Center
* Health & Fitness
* HyperTerminal
* Internet Explorer
* Journal
* Media Center
* Meeting Space
* Messaging
* Messenger
* Mobile Device Center
* Movie Maker
* MSN Dial-up
* NetMeeting
* NTBackup
* Outlook Express
* Travel
* Photo Gallery
* Photo Viewer
* Program Manager
* Steps Recorder
* Syskey
* WinHelp
* Write

Others|

* ScanDisk
* File Protection
* Media Control Interface
* Next-Generation Secure Computing Base
* POSIX subsystem
* Interix
* Video for Windows
* Windows SideShow
* Windows Services for UNIX
* Windows System Assessment Tool
* WinFS

Spun off to
Microsoft Store|

* DVD Player
* Hover!
* Mahjong
* Minesweeper

0.00

(0 votes)

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Windows_booting_process&oldid=331940"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template