CHAPTER
22
THE WINDOWS 2000 BOOT PROCESS
Windows 2000 boot
process occurs in five stages, and they are:
An Intel-based Boot Sequence requires certain files. See the table which lists the Windows 2000
Intel-based boot process, the appropriate location of each file, and the stages of the boot process
associated with each file.
NOTE: to view the files listed, open Windows Explorer and click Folder Options on Tools menu.
On the view tab of the folder Options, click Show Hidden Files and folders, and clear the Hide
Protected Operating System Files, Click Yes to display them.
****** Insert the table at the bottom of Page 502 ******
NOTE: The string systemroot (types as %systemroot%) is a placeholder for the folder in the
boot partition that contains the Windows 2000 system files.
Preboot Sequence
During strartup, a Windows 2000-based computer initializes and then locates the boot portion
of the hard disk.
=======================================================================
winpro22.html PAGE
2
2001/12/14
The following four steps occur during the preboot sequence:
1) The computer runs power-on self test (POST) routines to determine the amount of physical
memory, whether the hardware components are present, and so on. If the computer as
Plug and Play basic input/output system (BIOS), enumeration and configuration of hardware
devices occurs at this stage.
2) The computer BIOS locates the boot device and loads and runs the master boot record (MBR).
3) The MBR scans the partition table to locate the active partition, loads the boot sector
on the active partition into memory, and then executes it.
4) The computer loads and initializes the Ntldr file, which is the operating system loader.
NOTE: Windows 2000 modifies the boot sector during installation so that Ntldr loads during system startup.
Boot Sequence
After the computer loads Ntldr into memory, the boot sequence gathers information about hardware and
drivers in preparation for the Windows 2000 load phase. The boot sequence uses the following files:
Ntldr, Boot.ini, Bootsect.doc (optional),
Ntdetect.com and Ntoskrnl.exe.
Initial Boot Loader
During the initial boot loader phase, Ntldr switches the microprocessor from real mode to 32-bit flat
memory mode, which Ntldr requires to carry out any additional functions. Next Ntldr start the
appropriate minifile system drivers. You can have the partitions formatted with FAT or NTFS.
Operating System Selection
During the boot sequence, Ntldr reads the Boot.ini file. If more than one operating system selection
is available in the Boot.ini file, then the Please Select The Operating System To Start screen appears,
listing the available operating system listed in the Boot.ini file. If you do not select an entry before
the timer reaches zero, Ntldr loads the operating system specified by the default parameter in the
Boot.ini file. Windows 2000 uses a default to use the most recently used installation.
NOTE: If the boot.ini file is not present, Ntldr attempts to load Windows 2000 from the Winnt folder
on the first partition of the first disk, typically C:\\Winnt.
=======================================================================
winpro22.html PAGE
3
2001/12/14
Hardware Detection
On Intel-based computers, Ntdetect.com and Ntoskrnl.exe
perform hardware detection. Ntdetect.com
executes after you select Windows 2000 on the Please select the Operating system To Start screen
(or after the timer times out).
NOTE: If you select an operating system other than Windows 2000, such as Microsoft Windows 98,
Ntldr loads and executes Bootsect.dos.
Ntdetect.com collects a list of currently installed hardware components and returns this list to Ntldr
for later inclusion in the registry under the HKEY_LOCAL_MACHINE\HARDWARE key.
Ntdetect.com detects the following components:
Configuration Selection
After Ntldr starts loading Windows 2000 and collects hardware information, the operating system
loader process presents you with the Hardware Profile/Configuration Recovery Menu screen. You
can use the down arrow to select another profile, you can press L to invoke Last Known Good
Configuration option.
Kernel Load
After configuration selection, the Windows 2000 kernel (Ntoskrnl.exe) loads and initializes. Ntposkrn.exe
loads and initializes device drivers and loads services.
=======================================================================
winpro22.html PAGE
4
2001/12/14
Kernel Initialization
When the kernel load phase is complete, the kernel initializes, and then Ntldr passes control to the
kernel. At this point, the system displays a
graphical screen with a status bar indicating load status.
Four tasks are
accomplished during the kernel initialization stage:
The Hardware key is created. Upon successful initialization, the kernel uses the data collected during
hardware detection to create the registry key HKEY_LOCAL_MACHINE\HARDWARE.
The Clone Control Set is created. The kernel creates the Clone control set by copying the control
set referenced by the value of Current entry in the HKEY_LOCAL_MACHINE\SYSTEM\Select s
subkey of the registry.
Device drivers are loaded and initialized. After creating the Clone control set, the kernel initializes the
low-level device drivers that were loaded during the kernel load phase. The kernel then scans the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services subkey of the registry for
device drivers with a value of 0X1 for the Start key.
If an error occurs while loading and initializing a device driver, the boot process proceeds based on
the value specified in the Error Control entry for the driver.
Services are started. After the kernel load and initializes device drivers, Session Manager (Smss.exe)
starts the higher-order subsystems and services.
Logon
The logon process begins at the conclusion of the kernel initialization phase. The Win32 subsystem
automatically starts Winlogon.exe, which starts Local Security Authority (Lass.exe) and displays the
Logon dialog box.
Next, the Service Controller executes and makes a final scan of the HKEY_LOCAL_MACHINE\
system\CurrentControlSet\Services subkey, looking for services with a value of 0X2 for the Start entry.
=======================================================================
winpro22.html PAGE
5
2001/12/14
Windows 2000 startup is not considered good until a user successfully logs on to the system. After a success-
ful logon, the system copies the Clone Control Set to the Last Known Good Control Set.
Lesson Summary:
There are five stages of the preboot sequence: Preboot sequence, Boot sequence, Kernel Load,
kernel initialization and logon.
Lesson 2:
Control Sets in the Registry
A control set contains configuration data used to control the system, such as a list of which device drivers
and services to load and start.
A typical Windows 2000 installation, contains the following control set subkeys: Clone, ControlSet001,
ControlSet002 and CurrentControlSet. Control sets are stored as subkeys of the registry key
HKEY_LOCAL_MACHINE\SYSTEM.
The CurrentControlSet subkey is a pointer to one of the Control Set00X keys. The Clone control
et is a clone of the control set used to initialize the computer (either Default or LastKnownGood) and
is created by the kernel initialization process each time that you start your computer.
The Registry Subkey HKEY_LOCAL_MACHINE\SYSTEM\Select. The entries for this subkey
are as follows:
Current. Identifies which control set is the Current Control Set.
Default. Identifies the control set to use the next time that Windows 2000 starts, unless you
select the LastKnownGood control set.
Failed. Identifies the control set that was designated as failed the last time that the computer
was started using the LastKnownGood control set.
LastKnownGood. Identifies a copy of the control set that was used the last time that the
computer started Windows 2000 successfully. After a successful logon, the Clone control
set is copied to the LastKnownGood Control Set.
The Last Known Good Process
If you change the Windows 2000 configuration to load a driver and have problems rebooting, you
can use the last known good process to recover your working configuration.
Windows 2000 provides two configurations for starting a computer, Default, and LastKnownGood.
=======================================================================
winpro22.html PAGE
6
2001/12/14
After you reboot the computer, the kernel copies the information in the Current control set to the
Clone control set during the kernel initialization phase.
If you experience startup problems that you think might relate to Windows 2000 configuration changes,
shut down the computer without logging on, and then restart it. When you are prompted to select the
operating system to start from a list of the operating systems specified in the Boot.ini file, press F8 to
open the Windows 2000 Advanced Options Menu screen.
Using the LastKnownGood Control
set does not help in the following situations:
When the problem isn’t related to Windows 2000 configuration changes. Such a problem might arise
from incorrectly configured user profiles or incorrect file permissions.
After you log on. The system updates the LastKnownGood control set with Windows 2000
configuration changes after a successful logon. When startup failures relate to hardware failures or
missing or corrupted files.
IMPORTANT Starting Windows 2000 using the LastKnownGood control set overwrites any
hanges made since the last successful boot of Windows 2000.
Lesson Summary:
and a typical Windows 2000 installation contains the following control sets: Clone, ControlSet001,
ControlSet002, and CurrentControl Set.
last known good process so that you don’t have to reinstall your Windows 2000 software to restart
your computer.
Lesson 3:
Advanced Boot Options
Windows 2000 advanced boot options are: Safe Mode, Enable Boot Logging, Enable VGA Mode,
ast Known Good Configuration, Directory Services Restore Mode, and Debugging Mode.
=======================================================================
winpro22.html PAGE
7 2001/12/14
Safe Mode
If your computer won’t start, you might be able to start it by using the Safe Mode advanced boot
option. Pressing F8 during the operating system
selection phase displays a screen with advanced
options for booting Windows 2000. If you select Safe Mode, Windows 2000 loads and uses only
basic files and drivers.
Safe Mode has a couple of variations. You can select Safe Mode with Networking, which is
identical to Safe Mode except that it adds the drivers and services necessary to enable networking
to function when you start your computer.
Other Advanced Boot Options
Enable Boot Logging. This advanced boot option logs the loading and initialization of
drivers and services for troubleshooting boot problems.
Enable VGA Mode. Starts the Windows 2000 with a basic VGA driver.
Last Known Good Configuration. Windows 2000 save the Registry.
Directory Services Restore Mode. This advanced boot option allows the restoration
of directory services based on Active Directory technology on domain controllers.
Debugging Mode. Selecting this option turns on debugging, and advanced feature
that administrators can use to attempt to track down problems in programming code.
Boot Normally
Allows you to abort the screen of advanced boot options and proceed with a normal
boot.
NOTE: When using the Advanced boot options in Windows 2000, logging is enabled with every
option except Last Known Good Configuration. The system writes the log file (ntbtlog.txt) to the
systemroot folder. In addition, each option except Last Known Good Configuration loads the
default VGA driver.
Using an advanced boot option to boot the system sets the
environment variable SAFEBOOT_OPTION
to indicate the mode used to boot the system.
Lesson Summary:
Safe Mode with Networking, and Safe Mode with command Prompt, Enable Boot Logging,
Enable VGA Mode; Last Known Good Configuration; Directory Services Restore Mode
and Debugging Mode. There options allow you to attempt to restart your computer when a
problem occurs with a normal boot.
=======================================================================
winpro22.html PAGE
8
2001/12/14
Lesson 4:
The Boot.ini File
Windows 2000 Setup saves the Boot.ini file in the Active partition. Ntldr uses information in the
Boot.ini file to display the Please Select The Operating System to Start Menu, from which you
select the operating system to start.
Components in the Boot.ini File
The Boot.ini file includes two sections, [boot loader] and [operating systems], which contain
information that Ntldr uses to create the Please Select The Operating System to Start menu.
A typical Boot.ini file might contain the following lines:
ARC Paths
During installation, Windows 2000 generates the Boot.ini file, which contains Advanced RISC
Computing (ARC) paths pointing to the computer’s boot partitions. RISC stands for reduced
instruction set computing, a microprocessor design that uses a small set of simple instructions for
fast execution.
In both multi and scsi conventions, multi, scsi, dis, and rdisk numbers are assigned starting with (0).
Partition numbers start with (1). All nonextended partitions are assigned numbers first, followed by
logical drives in extended partitions.
The scsi ARC naming convention varies the disk(y) paramenter for successive disks on one controller,
while the multi format varies the rdisk(z) parameter.
=======================================================================
winpro22.html PAGE
9
2001/12/14
Boot.ini Switches (See the table)
Modifications to Boot.ini
You can modify the timeout and default parameter values in the Boot.ini file by using System Properties
in Control Panel. During Windows 2000 installation, Windows 2000 setup sets the read-only and
system attributes for the Boot.ini file. Before editing the Boot.ini file with a text editor, you must make
the file visible and turn off the read-only attribute. You can change file attributes by using My computer,
Windows Explorer or the Command Prompt.
To change the file attributes by using the command prompt, change to the folder containing the Boot.ini
file, if necessary and then type:
Attrib^-s^-r^-h^boot.ini
Lesson Summary:
Windows 2000 Setup save the Boot.ini file in the active partition.
Ntldr uses information in the Boot.ini file to display the Please Select the Operating System to Start menu
You can edit Boot.ini file, including modifying ARC paths and using the optional Boot.ini switches.
=======================================================================
winpro22.html PAGE
10
2001/12/14
Lesson 5:
Using the Recovery Console
To install the Recovery Console, insert the Microsoft Windows 2000 Professional CD into your
CD-ROM drive, and close the Microsoft Window 2000 CD dialog box. Open the run or command
prompt and access the I386 folder.
********
DO SOME OF THE EXERCISES IN CLASS *********
Lesson Summary:
perform a variety of troubleshooting and recovery tasks, including starting and stopping
services, reading and writing data on a local drive, and formatting hard drives.
I386 folder on Windows 2000 CD-ROM, and running the Winnt32 command
with the /cmdcons switch.