In computing, booting is a process that begins when a user turns on a computer system and prepares the computer to perform its normal operations. On modern computers, this typically involves loading and starting an operating system. The boot sequence is the initial set of operations that the...
Windows NT is a family of operating systems produced by Microsoft, the first version of which was released in July 1993. It was a powerful high-level-language-based, processor-independent, multiprocessing, multiuser operating system with features comparable to Unix. It was intended to complement...
An operating system is a set of programs that manage computer hardware resources and provide common services for application software. The operating system is the most important type of system software in a computer system...
Windows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
Windows Server 2003 is a server operating system produced by Microsoft, introduced on 24 April 2003. An updated version, Windows Server 2003 R2, was released to manufacturing on 6 December 2005...
. NTLDR is typically run from the primary hard disk drive, but it can also run from portable storage devices such as a CD-ROM
CD-ROM
A CD-ROM is a pre-pressed compact disc that contains data accessible to, but not writable by, a computer for data storage and music playback. The 1985 “Yellow Book” standard developed by Sony and Philips adapted the format to hold any form of binary data....
A flash drive is a data storage device that consists of flash memory with an integrated Universal Serial Bus interface. flash drives are typically removable and rewritable, and physically much smaller than a floppy disk. Most weigh less than 30 g...
, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector
Boot sector
A boot sector or boot block is a region of a hard disk, floppy disk, optical disc, or other data storage device that contains machine code to be loaded into random-access memory by a computer system's built-in firmware...
in a file.
NTLDR requires, at the minimum, the following two files to be on the system volume
System partition and boot partition
In Microsoft Windows, the system partition and boot partition refer to:*The system partition is a disk partition that contains the boot sector and files such as NTLDR that are needed for booting Windows XP and earlier...
:
ntldr, the main boot loader itself
NTDETECT.COM, required for booting an NT-based OS, detects basic hardware information needed for successful boot
An additional important file is boot.ini, which contains boot configuration (if missing, NTLDR will default to \Windows on the first partition of the first hard drive).
A volume boot record is a type of boot sector introduced by the IBM Personal Computer...
of system partition, which is typically written to the disk by the Windows FORMAT
Disk formatting
Disk formatting is the process of preparing a hard disk drive or flexible disk medium for data storage. In some cases, the formatting operation may also create one or more new file systems...
Advanced RISC Computing is a specification promulgated by a defunct consortium of computer manufacturers , setting forth a standard MIPS RISC-based computer hardware and firmware environment....
-compatible platforms, relying on its boot manager support and providing only osloader.exe, a loading program accepting ordinary command-line arguments specifying Windows directory partition, location or boot parameters, which is launched by ARC
ARC
ARC may refer to:- Business :* African Rainforest Conservancy, an environmental nonprofit* Airport Regions Conference, a European organization of major airports* Amalgamated Roadstone Corporation, a British stone quarrying company...
-compatible boot manager when a user chooses to start specific Windows NT operating system. But because the x86 lacked any of the ARC
Advanced RISC Computing
Advanced RISC Computing is a specification promulgated by a defunct consortium of computer manufacturers , setting forth a standard MIPS RISC-based computer hardware and firmware environment....
support, the additional layer was added specifically for that platform: custom boot manager code presenting text menu allowing the user to choose from one or more operating system and its options configured in boot.ini configuration file, prepended by special StartUp module which is responsible for some preparations such as switching the CPU to the protected mode. When a user chooses an operating system from the boot menu, the following command-line arguments are then passed to the part of the osloader.exe common to all processor architectures:
In Windows versions starting from Windows Vista
Windows Vista
Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
and Windows Server 2008, NTLDR has been split off back to its boot manager and system loader parts: the Windows Boot Manager and winload.exe. Being boot manager part completely rewritten, it no longer uses boot.ini as a configuration file, although the bootcfg
Bootcfg
Bootcfg is a command on Windows NT operating systems which acts as a wrapper for editing boot.ini. A similar command exists in the Recovery Console for repairing or rebuilding boot configuration files....
utility for modifying boot.ini is still present for the case of multi-boot configurations with Windows versions up to Windows XP
Windows XP
Windows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
Windows Server 2003 is a server operating system produced by Microsoft, introduced on 24 April 2003. An updated version, Windows Server 2003 R2, was released to manufacturing on 6 December 2005...
.
The bootsect.exe utility program in the Windows PE
Windows Preinstallation Environment
Windows Preinstallation Environment is a lightweight version of Windows XP, Windows Server 2003, Windows Vista, Windows 7, or Windows Server 2008 R2 that is used for the deployment of workstations and servers...
tools has options /nt52 (NTLDR) and /nt60 (Vista) to store a NTLDR or Vista boot record in the first sector of a specified partition.
In IBM PC compatible computers, the basic input/output system , also known as the System BIOS or ROM BIOS , is a de facto standard defining a firmware interface....
follows the configured boot order to find a bootable device. This can be a harddisk, floppy, CD/DVD, network connection, USB-device, etc. depending on the BIOS. In the case of a floppy the BIOS interprets its boot sector (first sector) as code, for NTLDR
NTLDR
NTLDR is the boot loader for all releases of Windows NT operating system up to and including Windows XP and Windows Server 2003. NTLDR is typically run from the primary hard disk drive, but it can also run from portable storage devices such as a CD-ROM, USB flash drive, or floppy disk...
this could be a NTLDR boot sector looking for the ntldr file on the floppy. For a harddisk the code in the Master Boot Record
Master boot record
A master boot record is a type of boot sector popularized by the IBM Personal Computer. It consists of a sequence of 512 bytes located at the first sector of a data storage device such as a hard disk...
(first sector) determines the active partition. The code in the boot sector of the active partition could then be again a NTLDR boot sector looking for ntldr in the root directory of this active partition. In a more convoluted scenario the active partition can contain a Vista boot sector for the newer Vista boot manager with an {ntldr} entry pointing to another partition with a NTLDR boot sector.
When booting, the loader portion of NTLDR does the following in order:
Accesses the file system on the boot drive (either FAT
File Allocation Table
File Allocation Table is a computer file system architecture now widely used on many computer systems and most memory cards, such as those used with digital cameras. FAT file systems are commonly found on floppy disks, flash memory cards, digital cameras, and many other portable devices because of...
NTFS is the standard file system of Windows NT, including its later versions Windows 2000, Windows XP, Windows Server 2003, Windows Server 2008, Windows Vista, and Windows 7....
).
If Windows was put in the hibernation state, the contents of hiberfil.sys are loaded into memory and the system resumes where it left off.
Otherwise, reads boot.ini and prompts the user with the boot menu accordingly.
If a non NT-based OS is selected, NTLDR loads the associated file listed in boot.ini (bootsect.dos if no file is specified or if the user is booting into a DOS based OS) and gives it control.
If an NT-based OS is selected, NTLDR runs ntdetect.com
Ntdetect.com
ntdetect.com is a component of Microsoft Windows NT-based operating systems that operate on the x86 architecture. It is used during the Windows NT startup process, and is responsible for detecting basic hardware that will be required to start the operating system.Though it has the .COM extension,...
, which gathers information about the computer's hardware. (If ntdetect.com hangs during hardware detection, there is a debug version called ntdetect.chk that can be found on Microsoft support.)
ntoskrnl.exe is the kernel image for the family of Microsoft Windows NT operating systems...
, passing to it the information returned by ntdetect.com.
boot.ini
NTLDR allows the user to choose which operating system to boot from at the menu. For NT and NT-based operating systems, it also allows the user to pass preconfigured options to the kernel. The menu options are stored in boot.ini, which itself is located in the root of the same disk as NTLDR. Though NTLDR can boot DOS and non-NT versions of Windows, boot.ini cannot configure their boot options.
For NT-based OSs, the location of the operating system is written as an Advanced RISC Computing
Advanced RISC Computing
Advanced RISC Computing is a specification promulgated by a defunct consortium of computer manufacturers , setting forth a standard MIPS RISC-based computer hardware and firmware environment....
(ARC) path.
boot.ini is protected from user configuration by having the following file attribute
File attribute
A file attribute is metadata that describes or is associated with a computer file. For example, an operating system often keeps track of the date a file was created and last modified, as well as the file's size and extension . File permissions are also kept track of...
s: system, hidden, read-only. To manually edit it, one would first have to remove these attributes.
A more secure fashion to edit the file is to use the bootcfg command from a console. bootcfg will also relock the file (setting the file back to system, hidden, and read-only). Additionally, the file can be edited within Windows using a text editor if the folder view option "Show hidden files and folders" is selected, the folder view option "Hide protected operating system files" is unchecked, and the "Read-only" option is unchecked under file properties.
bootsect.dos is the boot sector loaded by NTLDR to load DOS, or if there is no file specified when loading a non NT-based OS.
Example
An example of a boot.ini file:
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
If the boot loader timeout option in boot.ini is set to 0, the NTLDR boot menu does not appear.
Extreme caution should be taken when modifying the boot loader, as erroneous information can result in an OS that fails to boot.
NT kernel switches
/3GB — Forces x86-based systems to increase the virtual address space allocated for user programs to 3 GB, and to decrease to 1 GB allocated to the kernel
Kernel (computing)
In computing, the kernel is the main component of most computer operating systems; it is a bridge between applications and the actual data processing done at the hardware level. The kernel's responsibilities include managing the system's resources...
and to executive components. Used for some programs that require more than the standard 2 GB allocated to user programs and 2 GB allocated to the system. Some configurations of Windows Server 2003
Windows Server 2003
Windows Server 2003 is a server operating system produced by Microsoft, introduced on 24 April 2003. An updated version, Windows Server 2003 R2, was released to manufacturing on 6 December 2005...
In computing, virtual memory is a memory management technique developed for multitasking kernels. This technique virtualizes a computer architecture's various forms of computer data storage , allowing a program to be designed as though there is only one kind of memory, "virtual" memory, which...
- intensive applications such as database servers or Microsoft Exchange Server 2003 may require this switch or may benefit from improved performance.
/BASEVIDEO — Forces the system into standard 640x480 16-color VGA mode by using a video device driver
Device driver
In computing, a device driver or software driver is a computer program allowing higher-level computer programs to interact with a hardware device....
that is compatible with any video adapter. If the operating system fails to load due to a faulty or incorrectly configured video driver, this switch allows the system to load, so the user may then remove, update, or roll back the problem video driver. Using this switch in conjunction with the /SOS switch helps to determine the driver that is triggering a failure.
/BAUDRATE=nnn — Sets the baud rate of the debug port that is used for kernel
Kernel (computing)
In computing, the kernel is the main component of most computer operating systems; it is a bridge between applications and the actual data processing done at the hardware level. The kernel's responsibilities include managing the system's resources...
debugging. Use of this switch automatically enables the /DEBUG switch. Specifies an override for the default baud rate (19200) at which a remote kernel debugger host will connect. Example: /BAUDRATE=115200.
/BOOTLOG — Turns on boot logging to a file named %SystemRoot%\Ntbtlog.txt.
/BOOTLOGO — Displays an alternate 640x480 16-color custom bitmap
Bitmap
In computer graphics, a bitmap or pixmap is a type of memory organization or image file format used to store digital images. The term bitmap comes from the computer programming terminology, meaning just a map of bits, a spatially mapped array of bits. Now, along with pixmap, it commonly refers to...
. The bitmap must be saved in the \Windows directory with the name boot.bmp. Use with the /NOGUIBOOT switch.
/BURNMEMORY=nnn — Specifies the amount of memory, in megabytes, that Windows cannot use. Use this parameter to confirm a performance problem or other problems that are related to RAM depletion.
/CHANNEL=nn — Use with the /DEBUG switch and the /DEBUGPORT=1394 switch to selects the IEEE 1394 interface
IEEE 1394 interface
The IEEE 1394 interface is a serial bus interface standard for high-speed communications and isochronous real-time data transfer, frequently used by personal computers, as well as in digital audio, digital video, automotive, and aeronautics applications. The interface is also known by the brand...
In computing, the kernel is the main component of most computer operating systems; it is a bridge between applications and the actual data processing done at the hardware level. The kernel's responsibilities include managing the system's resources...
A kernel debugger is a debugger present in some kernels to ease debugging and kernel development by the kernel developers. A kernel debugger might be a stub implementing low-level operations, with a full-blown debugger such as gdb, running on another machine, sending commands to the stub over a...
at OS startup, but it remains inactive until a Stop Error
Blue Screen of Death
To forse a BSOD Open regedit.exe,Then search: HKLM\SYSTEM\CurrentControlSet\services\i8042prt\ParametersThen make a new DWORD called "CrashOnCtrlScroll" And set the value to 1....
occurs. With this switch, the COM port can be used for normal operations while Windows is running. If Windows crashes, the switch converts the port to a debug port. (This action turns on remote debugging.)
A kernel debugger is a debugger present in some kernels to ease debugging and kernel development by the kernel developers. A kernel debugger might be a stub implementing low-level operations, with a full-blown debugger such as gdb, running on another machine, sending commands to the stub over a...
when Windows starts. Unlike the /CRASHDEBUG switch, /DEBUG uses the COM port whether you use debugging or not.
In computing, a serial port is a serial communication physical interface through which information transfers in or out one bit at a time...
to use for the debug port. By default, /DEBUGPORT uses COM2 if it exists. Otherwise, the default is COM1. Use of this switch automatically enables the /DEBUG switch.
/FASTDETECT[:comx[,comy]] — Turns off serial and bus mouse detection for the specified port(s), or for all ports if none are specified. Use this switch when there is a component other than a mouse attached to a serial port during the startup process. Ports may be separated with commas to turn off more than one port. (Note: In earlier versions of Windows, including Windows NT 4.0
Windows NT 4.0
Windows NT 4.0 is a preemptive, graphical and business-oriented operating system designed to work with either uniprocessor or symmetric multi-processor computers. It was the next release of Microsoft's Windows NT line of operating systems and was released to manufacturing on 31 July 1996...
, this switch was named /NOSERIALMICE.)
/HAL=filename — Defines the Hardware Abstraction Layer that is loaded at startup. This switch is useful to try out a different HAL before you rename the file to HAL.DLL. This switch is also useful when you want to try to switch between starting in multiprocessor mode and starting in single processor mode. To do this, use this switch with the /KERNEL switch.
/KERNEL=filename — Defines the kernel that is loaded at startup. With this switch, you can switch between a debug-enabled kernel that is full of debugging code and a regular kernel.
/MAXMEM=nnn — Specifies the maximum amount of RAM, in megabytes, that Windows can use. However, the /MAXMEM switch does not account for memory holes. Therefore, it is recommended to use the /BURNMEMORY switch instead.
Windows Preinstallation Environment is a lightweight version of Windows XP, Windows Server 2003, Windows Vista, Windows 7, or Windows Server 2008 R2 that is used for the deployment of workstations and servers...
(WinPE) and loads the Registry SYSTEM hive as a volatile hive such that changes made to it in memory are not saved back to the hive image.
/NODEBUG — Turns off debugging. This scenario can cause a Stop Error
Blue Screen of Death
To forse a BSOD Open regedit.exe,Then search: HKLM\SYSTEM\CurrentControlSet\services\i8042prt\ParametersThen make a new DWORD called "CrashOnCtrlScroll" And set the value to 1....
if a program has a debug hardcoded breakpoint in its software.
/NOEXECUTE={OPTIN|OPTOUT|ALWAYSON|ALWAYSOFF} — This option is only available on 32-bit versions of Windows when running on processors supporting Data Execution Prevention
Data Execution Prevention
Data Execution Prevention is a security feature included in modern operating systems.It is known to be available in Linux, Mac OS X, and Microsoft Windows operating systems and is intended to prevent an application or service from executing code from a non-executable memory region. This helps...
(DEP). It enables DEP, which results in the memory manager marking pages containing data as no-execute so that they cannot be executed as code. This can be useful for preventing malicious code from exploiting buffer overflow bugs with unexpected program input in order to execute arbitrary code. No-execute protection is always enabled on 64-bit versions of Windows on processors that support no-execute protection. There are several options you can specify with this switch:
/NOEXECUTE=OPTIN — Enables DEP for core system images and those specified in the DEP configuration dialog.
/NOEXECUTE=OPTOUT — Enables DEP for all images except those specified in the DEP configuration dialog.
/NOEXECUTE=ALWAYSON — Enables DEP on all images.
/NOEXECUTE=ALWAYSOFF — Disables DEP.
/NOGUIBOOT — Disables the bitmap that displays the progress bar
Progress bar
A progress bar is a component in a graphical user interface used to convey the progress of a task, such as a download or file transfer. Often, the graphic is accompanied by a textual representation of the progress in a percent format....
for Windows startup. This also disables the text output by chkdsk
CHKDSK
CHKDSK is a command on computers running DOS, OS/2 and Microsoft Windows operating systems that displays the file system integrity status of hard disks and floppy disk and can fix logical file system errors. It is similar to the fsck command in Unix.The command is implemented as an executable...
In computing, Physical Address Extension is a feature to allow x86 processors to access a physical address space larger than 4 gigabytes....
(PAE) version of the Windows kernel, even if the system is detected as supporting x86 PAEs and has more than 4 GB of physical memory.
/NOSERIALMICE[=comx] — (Obsolete on all versions post-Windows NT 4.0
Windows NT 4.0
Windows NT 4.0 is a preemptive, graphical and business-oriented operating system designed to work with either uniprocessor or symmetric multi-processor computers. It was the next release of Microsoft's Windows NT line of operating systems and was released to manufacturing on 31 July 1996...
) Replaced by the absence of the /FASTDETECT switch. Disables serial mouse detection on the specified COM ports. Using /NOSERIALMICE without specifying a COM port disables serial mouse detection on all COM ports.
The central processing unit is the portion of a computer system that carries out the instructions of a computer program, to perform the basic arithmetical, logical, and input/output operations of the system. The CPU plays a role somewhat analogous to the brain in the computer. The term has been in...
that Windows will run at startup. With this switch, you can force a multiprocessor system to use only the quantity of processors (number) that you specify. Useful for troubleshooting performance problems and defective CPUs.
/ONECPU — Equivalent to using /NUMPROC=1. Causes Windows to use only one CPU on a multiprocessor system.
Safe mode is a diagnostic mode of a computer operating system . It can also refer to a mode of operation by application software. Safe mode is intended to fix most, if not all problems within an operating system...
, the computer starts by using normal kernels, even if the /PAE switch is specified.
/PCILOCK — For x86-based systems, this stops the operating system
Operating system
An operating system is a set of programs that manage computer hardware resources and provide common services for application software. The operating system is the most important type of system software in a computer system...
from dynamically assigning hardware input, hardware output, and interrupt request
Interrupt request
The computing phrase "interrupt request" is used to refer to either the act of interrupting the bus lines used to signal an interrupt, or the interrupt input lines on a Programmable Interrupt Controller...
In IBM PC compatible computers, the basic input/output system , also known as the System BIOS or ROM BIOS , is a de facto standard defining a firmware interface....
Emergency Management Services provides an RS-232 accessible serial console interface to the bootloader menu on modern versions of Microsoft Windows....
(EMS) on a Windows Server 2003, Enterprise Edition-based computer. To turn on EMS by editing the Boot.ini on an x86-based computer, edit both the [boot loader] section and the [operating systems] section of the Boot.ini file.
/SAFEBOOT:{MINIMAL|NETWORK|DSREPAIR}[(ALTERNATESHELL)] — Causes Windows to start in Safe Mode
Safe Mode
Safe mode is a diagnostic mode of a computer operating system . It can also refer to a mode of operation by application software. Safe mode is intended to fix most, if not all problems within an operating system...
. You must include the colon plus one of the three types listed above. An additional option you can append is (ALTERNATESHELL), which tells Windows to use the program specified by the HKLM\SYSTEM\CurrentControlSet\SafeBoot\AlternateShell value as the graphical shell rather than to use the default, which is Windows Explorer. You can also combine other boot.ini parameters with /SAFEBOOT:type. The following examples illustrate the parameters that are in effect when you select a Safe Mode option from the startup recovery menu. (Note: The /SOS, /BOOTLOG, and /NOGUIBOOT switches are not required with any one of these settings, but the switches can help with troubleshooting.)
Safe Mode (/SAFEBOOT:MINIMAL /SOS /BOOTLOG /NOGUIBOOT) — Default: Uses a minimal set of device driver
Device driver
In computing, a device driver or software driver is a computer program allowing higher-level computer programs to interact with a hardware device....
s and services to start Windows.
Safe Mode with Networking (/SAFEBOOT:NETWORK /SOS /BOOTLOG /NOGUIBOOT) — Default mode together with the drivers necessary to load networking.
Safe Mode with Command Prompt (/SAFEBOOT:MINIMAL(ALTERNATESHELL) /SOS /BOOTLOG /NOGUIBOOT) — Default mode, except that Cmd.exe
Cmd.exe
Command Prompt is the Microsoft-supplied command-line interpreter on OS/2, Windows CE and on Windows NT-based operating systems...
This article is about the Windows file system browser. For the similarly named web browser, see Internet ExplorerWindows Explorer is a file manager application that is included with releases of the Microsoft Windows operating system from Windows 95 onwards. It provides a graphical user interface...
.
Windows in Directory Services Restore Mode (/SAFEBOOT:DSREPAIR /SOS) — (This mode is valid only for Windows-based domain controllers.) Performs a directory service repair.
/SOS — Displays the device driver names while they are being loaded. Use with the /BASEVIDEO switch to determine the driver that is triggering a failure.
/USEPMTIMER — Specifies that Windows uses the Power Management Timer (PM_TIMER) timer settings instead of the Time Stamp Counter
Time Stamp Counter
The Time Stamp Counter is a 64-bit register present on all x86 processors since the Pentium. It counts the number of ticks since reset. The instruction "RDTSC" returns the TSC in EDX:EAX. In x86_64 mode, RDTSC also clears the higher 32 bits of RAX. Its opcode is 0F 31. Pentium competitors such as...
(TSC) timer settings if the processor supports the PM_TIMER settings. By default, Windows Server 2003 Service Pack 2 (SP2) uses the PM timer for all multiprocessor APIC
Advanced Programmable Interrupt Controller
In computing, an Advanced Programmable Interrupt Controller is a more complex Programmable Interrupt Controller than Intel's original types such as the 8259A...
In computing, the Advanced Configuration and Power Interface specification provides an open standard for device configuration and power management by the operating system....
HALs. If you are not running Windows Server 2003 SP2, you must force the computer to use the PM timer by using the /USEPMTIMER switch.
/USERVA=nnn — Customizes the amount of memory, in megabytes, that is allocated to processes when using the /3GB switch. This switch permits more page table
Page table
A page table is the data structure used by a virtual memory system in a computer operating system to store the mapping between virtual addresses and physical addresses. Virtual addresses are those unique to the accessing process...
entry kernel memory but still maintains almost 3 GB of process memory space.
/WIN95 — Directs Ntldr to boot the Windows boot sector stored in bootsect.w40.
/WIN95DOS — Directs Ntldr to boot the MS-DOS boot sector stored in bootsect.dos.
/YEAR — Instructs the Windows core time function to ignore the year that the computer's real-time clock reports and instead use the one indicated. Example: /YEAR=2001. (This switch was created to assist in Y2K testing.)
The startup process of Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2 is different from any previous versions of Windows. For Windows Vista, the boot sector loads the Windows Boot Manager , which first looks for an active partition, then accesses the Boot Configuration...
The Windows NT startup process is the process by which Windows NT 4.0, Windows 2000, Windows XP and Windows Server 2003 operating systems initialize...
ntdetect.com is a component of Microsoft Windows NT-based operating systems that operate on the x86 architecture. It is used during the Windows NT startup process, and is responsible for detecting basic hardware that will be required to start the operating system.Though it has the .COM extension,...
Emergency Management Services provides an RS-232 accessible serial console interface to the bootloader menu on modern versions of Microsoft Windows....
The following tables compare general and technical information for a number of available boot loaders.-Features:- External links :* * Let you boot legacy PCs from CD-ROM and USB without BIOS support...
