Windows 10 — Boot Process

What is the Detailed Phases, Steps and sub-steps of the Windows 10 Boot Process ?

«http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx» is an old article from 2011, that is similar to what I’m looking for.

Gives a general Idea, but how does Windows 10 compare to Windows 7,8,8.1?

I’m specifically looking at a traditional Desktop computer for best comparison.

From what I can tell, several of the boot decisions are made at the UEFI level, well before the kernel loads (ntoskrnl.exe in previous versions) And the boot process decision is no longer at the registry, it’s at an earlier phase (Secure boot.). Looking for details/info on these types of things.

Replies (4) 

Thank you for posting in Microsoft Community.

As the your post you have already accumulated articles on the comparison of different boot processes and have come to an conclusion, for which we at Microsoft Community appreciate you for your interest.

Certainly, we would be mainly focusing in provided/assisting any kind of help with Windows 10.

Thanks and Regards

1 person found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

3 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Mr. Ahmed (And Microsoft Community),

Sir, so what is the detailed boot process, what stages and files specifically are used?

Every Version of Windows has had changes to the boot process. Is there an article or read that spells out stage by stage, and file by file, of the traditional «normal» boot process for Windows 10? I know that we have several versions of windows 10 (Including the IoT version.) so can I read about the other boot sequence options if they are different?

It’s safe to assume, I hope, that Windows 10 it has:
POST stage -> Boot Loader/UEFI stage/TPM stage -> Kernel loading -> Windows Login -> Post Login stage. .

If you have a useful link please reply. (This is probably already solved by now.)

5 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

6 Steps In Booting Process Of A Computer

Booting is a process of switching on a computer. Two types of booting are cold booting and warm booting. Six steps of the booting process are BIOS and Setup Program, The Power-On-Self-Test (POST), The Operating System Loads, System Configuration, System Utility Loads, and Users Authentication.

Types of Booting

Booting is a process of switching on the computer and starting the operating system. When a computer is switched on, The boot process loads the operating system into main memory (RAM) installed inside it. Types of computer booting are Cold Booting And Warm Booting.

• Cold Boot: when the user switches on a computer after it has been power off completely,
• Warm Boot: when the user restarts the computer.

Best Apk Apps:

Booting Process With Diagram

When the booting process takes place, it copies kernel and important instructions of an operating system from hard disk to main memory (RAM). The kernel is the most important part of the operating system that manages memory and devices, maintains the computer clock, starts applications.
It assigns compute resources like devices, programs, data, and information also. The kernel also remains in memory permanently when the computer starts.

Steps In the Booting Process

Booting is the process of switching on the computer and starting the operating system. Six steps of the booting process are BIOS and Setup Program, The Power-On-Self-Test (POST), The Operating System Loads, System Configuration, System Utility Loads and Users Authentication.

• 1: BIOS and Setup Program
• 2: The Power-On-Self-Test (POST)
• 3: The Operating System (OS) Loads
• 4: System Configuration
• 5: System Utility Loads
• 6: Users Authentication

Step 1: BIOS and Setup Program

• ROM (read-only memory): it is a permanent and unchanging memory also
• BIOS (basic input/output system ): the part of the system software that includes the instructions that the computer uses to accept input and output
• Load: to transfer from a storage device to memory. The ROM loads BIOS into the computer’s memory
• Setup program: a special program containing settings to control hardware. Furthermore, the program can only be accessed while the BIOS information is visible

Step 2: The Power-On-Self-Test (POST)

• POST (Power-On Self-Test): a series of tests conducted on the computer’s main memory, input/output devices, disk drives, and the hard disk.
• BIOS conducts Power-On-Self-Test to check the input/ output system for operability.
• The computer will produce a beeping sound if any problem occurs. An error message will also appear on the monitor

Step 3: The Operating System (OS) Loads

BIOS searches for the operating system.

• Setting in CMOS: complementary metal oxide semiconductor determines where to look for the operating system.
• In this step, the operating system’s kernel is also loaded into the computer’s memory.
• The operating system takes control of the computer and begins loading system configuration information.

Step 4: System Configuration

• Registry: a databaseto store information about peripherals and software
• Peripheral: a device connected to a computer
• Drive: a utility program that makes peripheral devices function properly
• The operating system’s registry configures the system.
• In this step, drivers are also loaded into memory.

Step 5: System Utility Loads

• System utilities are loaded into memory.
• Volume control
• Antivirus software
• PC card unplugging utility

Step 6: Users Authentication

• Authentication or user login occurs
• Username
• Password

After all this process, the user interface starts, enabling user interaction with the computer and its programs also.

Related Video:

Advanced troubleshooting for Windows boot problems

This article is intended for use by support agents and IT professionals. If you’re looking for more general information about recovery options, see Recovery options in Windows 10.

Summary

There are several reasons why a Windows-based computer may have problems during startup. To troubleshoot boot problems, first determine in which of the following phases the computer gets stuck:

Phase	Boot Process	BIOS	UEFI
1	PreBoot	MBR/PBR (Bootstrap Code)	UEFI Firmware
2	Windows Boot Manager	%SystemDrive%\bootmgr	\EFI\Microsoft\Boot\bootmgfw.efi
3	Windows OS Loader	%SystemRoot%\system32\winload.exe	%SystemRoot%\system32\winload.efi
4	Windows NT OS Kernel	%SystemRoot%\system32\ntoskrnl.exe

1. PreBoot

The PC’s firmware initiates a Power-On Self Test (POST) and loads firmware settings. This pre-boot process ends when a valid system disk is detected. Firmware reads the master boot record (MBR), and then starts Windows Boot Manager.

2. Windows Boot Manager

Windows Boot Manager finds and starts the Windows loader (Winload.exe) on the Windows boot partition.

3. Windows operating system loader

Essential drivers required to start the Windows kernel are loaded and the kernel starts to run.

4. Windows NT OS Kernel

The kernel loads into memory the system registry hive and additional drivers that are marked as BOOT_START.

The kernel passes control to the session manager process (Smss.exe) which initializes the system session, and loads and starts the devices and drivers that are not marked BOOT_START.

Here is a summary of the boot sequence, what will be seen on the display, and typical boot problems at that point in the sequence. Before starting troubleshooting, you have to understand the outline of the boot process and display status to ensure that the issue is properly identified at the beginning of the engagement.

Click to enlarge

Each phase has a different approach to troubleshooting. This article provides troubleshooting techniques for problems that occur during the first three phases.

If the computer repeatedly boots to the recovery options, run the following command at a command prompt to break the cycle:

Bcdedit /set recoveryenabled no

If the F8 options don’t work, run the following command:

Bcdedit /set bootmenupolicy legacy

BIOS phase

To determine whether the system has passed the BIOS phase, follow these steps:

1. If there are any external peripherals connected to the computer, disconnect them.
2. Check whether the hard disk drive light on the physical computer is working. If it is not working, this indicates that the startup process is stuck at the BIOS phase.
3. Press the NumLock key to see whether the indicator light toggles on and off. If it does not, this indicates that the startup process is stuck at BIOS.

If the system is stuck at the BIOS phase, there may be a hardware problem.

Boot loader phase

If the screen is completely black except for a blinking cursor, or if you receive one of the following error codes, this indicates that the boot process is stuck in the Boot Loader phase:

• Boot Configuration Data (BCD) missing or corrupted
• Boot file or MBR corrupted
• Operating system Missing
• Boot sector missing or corrupted
• Bootmgr missing or corrupted
• Unable to boot due to system hive missing or corrupted

To troubleshoot this problem, use Windows installation media to start the computer, press Shift+F10 for a command prompt, and then use any of the following methods.

Method 1: Startup Repair tool

The Startup Repair tool automatically fixes many common problems. The tool also lets you quickly diagnose and repair more complex startup problems. When the computer detects a startup problem, the computer starts the Startup Repair tool. When the tool starts, it performs diagnostics. These diagnostics include analyzing startup log files to determine the cause of the problem. When the Startup Repair tool determines the cause, the tool tries to fix the problem automatically.

To do this, follow theseВ steps.

For additional methods to start WinRE, see Windows Recovery Environment (Windows RE).

Start the system to the installation media for the installed version of Windows. For more information, see Create installation media for Windows.

On the Install Windows screen, select Next > Repair your computer.

On the System Recovery Options screen, select Next > Command Prompt.

After Startup Repair, select Shutdown, then turn on your PC to see if Windows can boot properly.

The Startup Repair tool generates a log file to help you understand the startup problems and the repairs that were made. You can find the log file in the following location:

%windir%\System32\LogFiles\Srt\Srttrail.txt

Method 2: Repair Boot Codes

To repair boot codes, run the following command:

To repair the boot sector, run the following command:

Running BOOTREC together with Fixmbr overwrites only the master boot code. If the corruption in the MBR affects the partition table, running Fixmbr may not fix the problem.

Method 3: Fix BCD errors

If you receive BCD-related errors, follow these steps:

Scan for all the systems that are installed. To do this, run the following command:

Restart the computer to check whether the problem is fixed.

If the problem is not fixed, run the following command:

You might receive one of the following outputs:

If the output shows windows installation: 0, run the following commands:

After you run the command, you receive the following output:

1. Try restarting the system.

Method 4: Replace Bootmgr

If methods 1, 2 and 3 do not fix the problem, replace the Bootmgr file from drive C to the System Reserved partition. To do this, follow these steps:

At a command prompt, change the directory to the System Reserved partition.

Run the attrib command to unhide the file:

Run the same attrib command on the Windows (system drive):

Rename the Bootmgr file as Bootmgr.old:

Navigate to the system drive.

Copy the Bootmgr file, and then paste it to the System Reserved partition.

Restart the computer.

Method 5: Restore System Hive

If Windows cannot load the system registry hive into memory, you must restore the system hive. To do this, use the Windows Recovery Environment or use Emergency Repair Disk (ERD) to copy the files from the C:\Windows\System32\config\RegBack to C:\Windows\System32\config.

If the problem persists, you may want to restore the system state backup to an alternative location, and then retrieve the registry hives to be replaced.

Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check this article.

Kernel Phase

If the system gets stuck during the kernel phase, you experience multiple symptoms or receive multiple error messages. These include, but are not limited to, the following:

A Stop error appears after the splash screen (Windows Logo screen).

Specific error code is displayed. For example, «0x00000C2» , «0x0000007B» , «inaccessible boot device» and so on.

The screen is stuck at the «spinning wheel» (rolling dots) «system busy» icon.

A black screen appears after the splash screen.

To troubleshoot these problems, try the following recovery boot options one at a time.

Scenario 1: Try to start the computer in Safe mode or Last Known Good Configuration

On the Advanced Boot Options screen, try to start the computer in Safe Mode or Safe Mode with Networking. If either of these options works, use Event Viewer to help identify and diagnose the cause of the boot problem. To view events that are recorded in the event logs, follow these steps:

Use one of the following methods to open Event Viewer:

Click Start, point to Administrative Tools, and then click Event Viewer.

Start the Event Viewer snap-in in Microsoft Management Console (MMC).

In the console tree, expand Event Viewer, and then click the log that you want to view. For example, click System log or Application log.

In the details pane, double-click the event that you want to view.

On the Edit menu, click Copy, open a new document in the program in which you want to paste the event (for example, Microsoft Word), and then click Paste.

Use the Up Arrow or Down Arrow keyВ to view the descriptionВ of the previous or next event.

Clean boot

To troubleshoot problems that affect services, do a clean boot by using System Configuration (msconfig). Select Selective startup to test the services one at a time to determine which one is causing the problem. If you cannot find the cause, try including system services. However, in most cases, the problematic service is third-party.

Disable any service that you find to be faulty, and try to start the computer again by selecting Normal startup.

If the computer starts in Disable Driver Signature mode, start the computer in Disable Driver Signature Enforcement mode, and then follow the steps that are documented in the following article to determine which drivers or files require driver signature enforcement: Troubleshooting boot problem caused byВ missing driver signature (x64)

If the computer is a domain controller, try Directory Services Restore mode (DSRM).

This method is an important step if you encounter Stop error «0xC00002E1» or «0xC00002E2»

Examples

Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

Error code INACCESSIBLE_BOOT_DEVICE (STOP 0x7B)

To troubleshoot this Stop error, follow these steps to filter the drivers:

Go to Window Recovery Environment (WinRE) by putting an ISO disk of the system in the disk drive. The ISO should be of same version of Windows or a later version.

Open the registry.

Load the system hive, and name it as «test.»

Under the following registry subkey, check for lower filter and upper filter items for Non-Microsoft Drivers:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class

For each third-party driver that you locate, click the upper or lower filter, and then delete the value data.

Search through the whole registry for similar items. Process as an appropriate, and then unload the registry hive.

Restart the server in Normal mode.

For additional troubleshooting steps, see the following articles:

To fix problems that occur after you install Windows updates, check for pending updates by using these steps:

Open a Command Prompt window in WinRE.

Run the command:

If there are any pending updates, uninstall them by running the following commands:

Try to start the computer.

If the computer does not start, follow these steps:

Open A Command Prompt window in WinRE, and start a text editor, such as Notepad.

Navigate to the system drive, and search for windows\winsxs\pending.xml.

If the Pending.xml file is found, rename the file as Pending.xml.old.

Open the registry, and then load the component hive in HKEY_LOCAL_MACHINE as a test.

Highlight the loaded test hive, and then search for the pendingxmlidentifier value.

If the pendingxmlidentifier value exists, delete the value.

Unload the test hive.

Load the system hive, name it as «test».

Navigate to the following subkey:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrustedInstaller

Change the Start value from 1 to 4

Unload the hive.

Try to start the computer.

If the Stop error occurs late in the startup process, or if the Stop error is still being generated, you can capture a memory dump. A good memory dump can help determine the root cause of the Stop error. For details, see the following articles:

For more information about page file problems in Windows 10 or Windows Server 2016, see the following:

For more information about Stop errors, see the following Knowledge Base article:

If the dump file shows an error that is related to a driver (for example, windows\system32\drivers\stcvsm.sys is missing or corrupted), follow these guidelines:

Check the functionality that is provided by the driver. If the driver is a third-party boot driver, make sure that you understand what it does.

If the driver is not important and has no dependencies, load the system hive, and then disable the driver.

If the stop error indicates system file corruption, run the system file checker in offline mode.

To do this, open WinRE, open a command prompt, and then run the following command:

If there is disk corruption, run the check disk command:

If the Stop error indicates general registry corruption, or if you believe that new drivers or services were installed, follow these steps:

1. Start WinRE, and open a Command Prompt window.
2. Start a text editor, such as Notepad.
3. Navigate to C:\Windows\System32\Config.
4. Rename the all five hives by appending «.old» to the name.
5. Copy all the hives from the Regback folder, paste them in the Config folder, and then try to start the computer in Normal mode.