Talk:Booting process of Windows NT

message: startup process as graphics, graphical representation of a chronological sequence of events could be very helpful Amigor (talk) 22:40, 24 September 2008 (UTC)
thread_title:  startup process as graphic 

message: when hklm\software will be loaded and which parts/keys of hklm\software will be processed in which order? 
Amigor (talk) 23:03, 24 September 2008 (UTC)
thread_title:  HKLM\Software hive 

message: This is where(?)
*System Idle Process
*SYSTEM
process starts?
:In short, yes.  The "System Idle Process" isn't well-named...  It's actually a thread that resides in the kernel (one per CPU) that swallows up any time not used by another process, and puts the CPU into idle mode (which reduces power usage). The "System" process is where most of the kernel threads hang out and do their work. Warrens 03:52, 13 February 2006 (UTC)
thread_title:  Kernel Loading Phase 

message: is this where user.exe is loaded?
Where does WPA come into the boot process?
What services are typically started, and from what?
explorer.exe, services.exe, svchost.exe.
Maybe some pictures of various logon boxes?
:These are good things to be added to the article.  user.exe, however, is not a part of Windows NT-based systems, save for providing backwards compatibility with 16-bit Windows 3.x applications. Should also note that images of Windows boot screens is unfortunately a violation of their copyright, so such things can't really be used here. I agree it'd be nice, though. Warrens 03:52, 13 February 2006 (UTC)
replies: text: He said logon boxes, not boot screens, although that may be what he meant. I don't think there's anything wrong with screeshots of logon boxes though, and there is already one in the article. Which, I might add, could stand to be updated with one from Vista, XP or even Windows 2000. Things are similar, but have changed since NT 4. Also, perhaps some mention of the windows Welcome screen? --Tech Nerd 02:05, 16 March 2007 (UTC)
replies: text: Oh, and why are boot screens violation of copyright, wouldn't that fall under the software-screenshots fair-use category? If no-one minds, I think I'll upload an updated version of the logon prompt. 
Where also does userinit.exe fall into play? 70.82.42.107 05:48, 1 March 2006 (UTC)

text: WPA is integrated into winlogon.exe. Services are launched by services.exe and their definition is in SCM database, which is in fact stored in registry under HKLM\SYSTEM\CurrentControlSet\Services key. Svchost.exe is process used to host many system services and this process is launched as these services are started. And finally, explorer.exe, or more generally comma-separated list of processes under the Shell value in the HKLM\SOFTWARE\Microsoft\Windows NT\Winlogon key, is launched from userinit.exe. And this process (or more generally, comma-separated list of processes under Userinit value) is launched from GINA. Jakub Horky 14:00, 6 November 2006 (UTC)
thread_title: Log on phase 

message: I'll be working on this page (and most of its descendants) through Fri Jan 27 and Sat Jan 28.  Given that there are probably thousands of computers going through this exact startup process even as I type this, surely we can do a better job of explaining it. :-)  Warrens 02:21, 28 January 2006 (UTC)
thread_title: Expansion

message: Worth mentioning loading the shell, as other startup items have been mentioned but not this?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Win XP)
: Yes, shell is launched by userinit.exe and that information should surely be included in the article. But I won't do that because I'm pretty sure  Warrens will come and revert it by abusing again his "no source = no inclusion" rule. Jakub Horky 23:41, 6 November 2006 (UTC)
thread_title: Loading Shell (if any)

message: Curious as to what others think in regards to setting the format to numbered lists. 
Paragraph explanation
#step
#*explanation...
#step 2
SNIa 14:05, 19 February 2006 (UTC)
thread_title:  Structure 

message: I don't think system partition and boot partition should be merged as this can be involved into boot processes of other systems. SNIa 04:29, 1 March 2006 (UTC)
thread_title: System partition and boot partition Merge

message: Where in this process would 
HKLM\SYSTEM\SETUP\CmdLine appear?
This would be before scandisk?
SNIa 07:27, 4 June 2006 (UTC)
replies: text: I think that key is only ever called during the GUI stage of Setup.  The Chkdsk stuff is called as part of SMSS's initialization, and I don't think SMSS is able to run yet before the GUI setup is completd.  Warrens 04:44, 5 June 2006 (UTC)

text: I did a test and I set this value back to setup -newsetup and this process started on the next boot. SNIa 04:28, 29 June 2006 (UTC)
replies: text:  Process specified by CmdLine value is started by winlogon.exe (even on already installed system) when SetupType value is set to 0x1 or 0x4. It is started after the start of processes such as SCM or SMSS, but before loading GINA. Winlogon then doesn't do anything else - it just waits and when the process quits, winlogon initiates system shutdown. Jakub Horky 23:26, 6 November 2006 (UTC)

text:  According to [Technet], SetupType=2 also causes CmdLine to be taken in account. I suspect that more values or combinations of these values can also cause the same effect :-). Antoinel 12:01, 19 February 2007 (UTC)
thread_title:  setup.exe 

message: === Name of kernel : ntoskrnl, ntkrnlmp, ntkrnlpa, ntkrpamp===
* NTOSKRNL.EXE : 1 CPU
* NTKRNLMP.EXE : N CPU SMP
* NTKRNLPA.EXE : 1 CPU, PAE
* NTKRPAMP.EXE : N CPU SMP PAE
=== Autochk and smss.exe ===
Autochk and smss.exe
HKLM\SYSTEM\CurrentControlSet\ControlSessionManager\BootExecute
the default value of this key is AUTOCHK.
: The default value is "autocheck autochk *". These parts have various meanings: "autocheck" is just the flag for SMSS (another such flag is e.g. "async"). "autochk" is name of the process which has to be launched (autochk.exe) and "*" is command-line argument for the process. Jakub Horky 23:37, 6 November 2006 (UTC)
thread_title:  Precision 

message: Autochk and smss.exe
HKLM\SYSTEM\CurrentControlSet\ControlSessionManager\BootExecute
the default value of this key is AUTOCHK.
: The default value is "autocheck autochk *". These parts have various meanings: "autocheck" is just the flag for SMSS (another such flag is e.g. "async"). "autochk" is name of the process which has to be launched (autochk.exe) and "*" is command-line argument for the process. Jakub Horky 23:37, 6 November 2006 (UTC)
thread_title:  Autochk and smss.exe 

message: See also  boot-time policy
Romanc19s 15:07, 20 August 2006 (UTC)
thread_title:  sp1 of Windows Server 2003 : Boot-time policy 

message: I find this to be a bit confusing: If the boot disk is a SCSI disk and cannot be accessed using the BIOS's firmware support, an additional file, Ntbootdd.sys is loaded.  If the BIOS doesn't provide disk access then how does the bootsector code load NTLDR and how does NTLDR load ntbootdd.sys?
:NTBootDD.sys is located at the same place as NTLDR, and loaded the same way, using BIOS. Later, NTLDR relies on NTBootDD.sys to load the kernel, normally from another disk which cannot be accessed by BIOS. AntoineL 08:37, 16 February 2007 (UTC)
replies: text: The article about booting seems to me to be a good and indeep explanations of the basic points. I am not sure more detailled technicals details fit into the wikipedia. Antoinel 15:20, 19 February 2007 (UTC)
thread_title:  Bootstrap Without BIOS Disk Access 

message: According to [present version], for x64 versions the processor is switched to long mode just after the selection of the target OS, before loading NtOsKrnl, Hal and all the stuff. I believe the effective switch is done much later, after all the boot-time drivers are loaded and just before control is passed to the kernel bootstrap routine. Reason for that is that long mode and real mode are incompatible, and NTLDR still needs to switch into real mode to load everything using Bios. One can check for sure by trying to use NtBootDD.sys and scsi(x) instead of Bios: for this to work, you should not use the (x64) version used by the OS, but rather a i386 (that is, 32-bit) version of the SCSI miniport, the same you would use to load a 32-bit kernel.This process is not adequately documented, so I cannot provide official sources, sorry. NT6 (Vista) is different here, but I do not know how it works exactly. Antoinel 09:49, 16 February 2007 (UTC)
thread_title:  Switching to long mode 

message: http://www.youtube.com/watch?v=hBc9WePkliE
http://www.emboot.com —The preceding unsigned comment was added by 66.183.241.105 (talk) 06:30, 11 April 2007 (UTC)
thread_title:  Able to Boot over Software iSCSI initiator 

message: I think the Windows XP welcome screen needs to be mentioned in the winlogon section. The welcome screen has a different method for logging users in. the user clicks their name, then the system tried to log them in with no password; if that doesn't work, then it prompts for a password. It makes for messy audit logs :| --Tech Nerd 03:05, 14 July 2007 (UTC)
replies: text: Sounds like it would make a nice addition to the article. Be bold. Also, please sign your comments with four tildes (~~~~) --Android Mouse 03:53, 13 July 2007 (UTC)
replies: text: OK, I'll maybe add a separate section. And an image. Sorry about not signing; I always forget. --Tech Nerd 03:05, 14 July 2007 (UTC)
thread_title:  Welcome screen 

message: Sysinternals had a great tool to see the order that devices are loaded on a win NT / 2k system.
http://www.microsoft.com/technet/sysinternals/Utilities/LoadOrder.mspx  —Preceding unsigned comment added by 216.232.115.128 (talk) 22:38, 13 December 2007 (UTC)
thread_title:  Load Order 

message: The boot.ini switches link in the article (under "External links") points to a list which is incomplete. For example it is missing the switches /execute and /NOPAE , that are mentioned in the MS KB 900524. Does anyone know a comprehensive list of switches ?
--Xerces8 (talk) 09:28, 26 April 2008 (UTC)
thread_title:  Complete list of boot switches ? 

message: The following attempts to document the order of processing the system and user policies following a system reboot and as part of the user logon:
#Network starts, then Remote Procedure Call System Service (RPCSS) and multiple universal naming convention provider (MUP) start.
#Where Active Directory is involved, an ordered list of GPOs is downloaded and applied. The list may include GPOs that:
#*Apply to the location of machines in a directory.
#*Apply only when settings have changed.
#*Depend on configuration of the scope of applicability: local, site, domain, organizational unit, and so on.
#*No desktop user interface is presented until the above have been processed.
#Execution of startup scripts (hidden and synchronous by default).
#A keyboard action to effect start of logon (Ctrl-Alt-Del).
#User credentials are validated, user profile is loaded (depends on policy settings).
#An ordered list of user GPOs is obtained. The list contents depends on what is configured in respect of:
#*Is the user a domain member, thus subject to particular policies?
#*Loopback enablement, and the state of the loopback policy (merge or replace).
#*Location of the Active Directory itself.
#*Has the list of GPOs changed? No processing is needed if not changed.
#User policies are applied from Active Directory. Note: There are several types.
#Logon scripts are run. New to Windows 200x and Active Directory, logon scripts may be obtained based on GPOs (hidden and executed synchronously). NT4-style logon scripts are then run in a normal window.
#The user interface as determined from the GPOs is presented. Note: In a Samba domain (like an NT4 domain), machine (system) policies are applied at startup; user policies are applied at logon. 
Credit: http://us1.samba.org/samba/docs/man/Samba-HOWTO-Collection/PolicyMgmt.html#id436916
SNIa (talk) 03:50, 6 May 2008 (UTC)
thread_title:  System Startup and Logon Processing Overview 

message: I'm a bit confused by the Winlogon section. Firstly, it is stated that winlogon has changed significantly in Vista, then 3 points are displayed below. I believe these 3 points are detailing the process in XP and earlier OS's. I think the wording of the first paragraph should be changed to be clearer - on reading that paragraph I was expecting the 3 following points to detail the changes made in Vista. Also, a link to the differences of Winlogon in Vista would be appropriate if possible.
Secondly, step 2 states that "LSA determines which account database is to be used", then step 3 states that lsass.exe is started. Is the LSA mentioned in step 2 a separate entity to lsass.exe? If not then I assume winlogon creates lsass.exe in step 2, then passes the users credentials on to it?
Thirdly, below step 3 is a single floating dot point labelled "userinit.exe" that looks out of place. There is no other mention of userinit in the article, so maybe this was a stub left to remind the author to come back and talk further about it?59.167.119.53 (talk) 02:31, 30 November 2008 (UTC)
replies: text: I have now updated the article to make these three changes (I wrote the above comment 'LSA the same as lsass.exe?' before I had a wikipedia account). In fact I have rearranged this section quite heavily. I believe this section of the article is clearer now. I still have not found any documents detailing the changes to winlogon in Vista though. Anyone?Gechurch (talk) 11:40, 10 January 2009 (UTC)
thread_title:  LSA the same as lsass.exe? 

message: Hello fellow Wikipedians,
I have just added archive links to  on Windows NT startup process. Please take a moment to review my edit. If necessary, add  after the link to keep me from modifying it. Alternatively, you can add  to keep me off the page altogether. I made the following changes:
*Added archive http://web.archive.org/web/20070311183615/http://www.microsoft.com:80/resources/documentation/Windows/XP/all/reskit/en-us/prkd_tro_mdca.asp to http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/prkd_tro_mdca.asp
When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).
Cheers.—cyberbot IITalk to my owner:Online 20:01, 29 February 2016 (UTC)
thread_title:  External links modified 

message: There is a move discussion in progress on Talk:Booting process of Windows NT since Vista which affects this page. Please participate on that page and not in this talk page section. Thank you.  —RMCD bot 22:46, 20 March 2023 (UTC)
thread_title:  Move discussion in progress 

message: https://web.archive.org/web/20110514163940/http://support.microsoft.com/kb/103000
lists the meanings of values for boot drivers (hopefully hasn't changed since windows 7)
summary:
Each key in HKLM\System\CurrentControlSet\services has a value named Start
Value Data:
0x0 = Boot driver
0x1 = System driver
0x2 = Autoload Driver
0x3 = Load on demand driver
0x4 = Disabled driver
Hope this helps Bloctans (talk) 01:56, 8 November 2023 (UTC)
thread_title:  Boot, System and AutoLoad Driver Flags