Booting process of Windows

Thebootingprocess ofMicrosoft Windowsvaries between different releases.

DOS-based Windows

Windows 1.x/2.x

In Windows versions 1.01 to Windows 2.11, the system was loaded whenWIN.COMwas executed. It then loadedWIN100.BINorWIN200.BINandWIN100.OVLorWIN200.OVL,along with the configuration settings fileWIN.INI.The default shell is theMS-DOS Executive.

The modulesGDI.EXE,KERNEL.EXEandUSER.EXE,fonts, and the various device drivers (such asCOMM.DRV,MOUSE.DRV,KEYBOARD.DRV) are incorporated inWIN100.BIN/WIN200.BINandWIN100.OVL/WIN200.OVL.

Windows 3.x/9x

Main article:Architecture of Windows 9x § Boot sequence

InWindows 3.xand95/98/ME,the boot loader phase is handled byMS-DOS.During the boot phase,CONFIG.SYSandAUTOEXEC.BATare executed, along with the configuration settings filesWIN.INIandSYSTEM.INI.Virtual device drivers are also loaded in the startup process: they are most commonly loaded from the registry (HKLM\System\CurrentControlSet\Services\VxD) or from theSYSTEM.INIfile.

MS-DOS startsWIN.COM.In Windows 3.x, theWIN.COMstartsKRNL286.EXE(standard mode) orKRNL386.EXE(386 enhanced mode). In Windows 9x, theWIN.COMstartsVMM32.VXD.

When all system configuration files and device drivers have been loaded, the 16-bit modules,KRNL386.EXE,GDI.EXE,andUSER.EXE,are loaded, then the 32-bit DLLs (KERNEL32.DLL,GDI32.DLL,andUSER32.DLL) are loaded. The 32-bit VxD message server (MSGSRV32) startsMPREXE.EXE,which is responsible for loading the network logon client (such as Client for Microsoft Networks, Microsoft Family Logon or Windows Logon).

When a user is logging on to Windows, the startup sound is played, the shell (usuallyEXPLORER.EXE) is loaded from the [boot] section of theSYSTEM.INIfile, and startup items are loaded.

In all versions of Windows 9x except ME, it is also possible to load Windows by booting to a DOS prompt and typing "win". There are some command line switches that can be used with the WIN command: with the/Dswitch, Windows boots tosafe mode,and with the/D:nswitch, Windows boots to safe mode with networking. The latter switch only works properly with Windows 95.In Windows 3.1, additional options are available, such as/3,which starts Windows in 386 enhanced mode, and/S,which starts Windows in standard mode

A startup sound was first added in Windows 3.0 after installing the Multimedia Extensions (MME),but not enabled by default until Windows 3.1.

Windows NT

InWindows NT,the booting process is initiated byNTLDRin versions before Vista and theWindows Boot Managerin Vista and later.The boot loader is responsible for accessing the file system on the boot drive, startingntoskrnl.exe,and loading boot-time device drivers into memory. Once all the boot and system drivers have been loaded, the kernel starts thesession manager,which begins thelogin process.After the user has successfully logged into the machine, winlogon applies User and ComputerGroup Policysetting and runs startup programs declared in theWindows Registryand in "Startup" folders.

In Windows 95/98/ME, it was also possible to run a program before the user logs on by using RunServicesOnce or RunServices keys. In Windows NT, this has been replaced by the services.exe program, which is able to load a set of system services before a user logs on. Additionally, in English-language versions of Windows, the startup folder was called "StartUp" instead of "Startup" in Win9x.

Due to the minimally restricted environment of these operating systems, any program can add itself to the Startup registry key or system folder. This method is frequently used bymalware.

See also

• Booting process of Linux