Windows XP & Vista boot Process

Windows Vista Boot Process different than Windows XPPosted by Aseem on Monday, November 19th 2007 19
NovWindows Vista boot-up process is slightly different than windows XP, and to have an understanding on how windows vista boot process differ from windows XP, we should start by reviewing the XP process, follow by vista boot process, then we shall review the changes after that.

Windows XP boot up process:

System is powered on
The CMOS loads the BIOS and then runs POST
Looks for the MBR on the bootable device, and loads NTLDR
The BIOS/CMOS transfers control to the NTLDR
NTLDR first looks for Hiberfil.sys ( if present, the system resumes from where it was hibernated)
if the hiberfil.sys is not present, NTLDR looks for boot.ini
If you have more than one operating system installed on your computer, Boot.ini will give you the option to choose the operating system to boot from.
The selected operating system then boots, in windows XP involves the loading of the kernel
After system services and user required DLLs are loaded, finally msgina.dll brings up the login screen.
When the user logs on, the system checks for the user’s credentials in the SAM, if the credentials are correct, the user profile is loaded from documents and settings folder.
This brings up the desktop and at that point, the ControlSets are copied to the CurrentControlSet in the registry. Now, the system is considered booted.

Windows Vista boot-up process:

System is powered on
The CMOS loads the BIOS and then runs POST
Looks for the MBR on the bootable device
Through the MBR the boot sector is located and the BOOTMGR is loaded
BOOTMGR looks for active partition
BOOTMGR reads the BCD file from the \boot directory on the active partition
The BCD (boot configuration database) contains various configuration parameters( this information was previously stored in the boot.ini)
When windows vista is selected, BOOTMGR transfer control to the Windows Loader (winload.exe) or winresume.exe in case the system was hibernated.
Winloader loads drivers that are set to start at boot and then transfers the control to the windows kernel.
There is not msgina.dll in windows vista ( the shell draws the login screen)
OK. Now that we have the two boot-up processes on the board, we should examine what is different on windows vista boot up process. As we can see the difference starts at the MBR. In windows vista, NTLDR was replaced by three new boot loader components, supposedly designed to load windows quicker and more securely. Those components are;

Windows Boot Manager (Bootmgr.exe)
Windows OS Loader (Winload.exe)
Windows Resume Loader (Winresume.exe)

Windows Boot Manager reads the boot configuration data (BCD) and display an operating system selection menu to the user

Windows OS loader is the operating system boot loader. It is invoked by the windows boot manager in order to load the operating system kernel (ntoskrnl.exe) and boot-class device drivers.

Notice the Boot Configuration Data ( BCD) This new data store serves essentially the same purpose as boot.ini. However, BCD abstracts the underlying firmware and provides a common programming interface to manipulate the boot environment for all Windows-supported computer platforms) Boot Configuration Data allows for third party integration so anyone can implement tools like diagnostics or recovery options

Windows Resume loader replaces the Hiberfil.sys.

Another change that is worth noting is the msgina.dll file, I guess Microsoft sensed that was being abused too much and integrated the logon screen into the shell. Msgina.dll was used on windows XP to change custom login screens.

Well, as you can see it was quite a bit change, what do you think about

Boot issues

Black screen with blinking cursor - Unplug all the external peripherals and restart

Disable boot from USB in the BIOS

Amber light - harware issue - contact manufacturer


Green Led - Post complete
Amber / Red - No post


Video Troubleshooting

Green led - Check the connection, type monitor - flat or regular - run Power On Self Test on the monitor by disconnecting it from the tower

VGA cable is connected -monitor power light will be amber

Blank screen with blinking cursor - no boot

In case of laptop - no post is very rarely found - frequent issue is no power - check different power supply - check the light status on the connector - remove the battery and plug the charger directly and power on - try a known good charger


a. PCI Express - VGA(Blue - 15 pin) and DVI(white) and S-Video

b. AGP

c. PCI

Typical errors during post

beep codes, system hangs during pots - wrong BIOS settings, HDD inaccessible, hardware failure

invalid system disk, "Operating |System not found " - floppy in FDD, no partitions defined on HDD

"cannot load windows\system32\hal.dll" - BOOT.ini incorrect or damaged, NTLDR and NTDETECT.COM not present in the root of the active partition, boot.ini incorrect or damaged

cannot load x:\ windows \system32\ntoskrnl.exe" screens with
stop error - NTOSKRNL.exe is missing or corrupted, bad drivers installed, possible hardware failure



cannot logon, error message that application fail start - user profile incorrect or damaged, software problems



system hangs at EULA - hard drive may not be detected coz, it may be SCSI or SATA hdd, then install from xp sp2 not less, or put the serial number of the hdd from the bios - go to the manufactures website - put the serial number n download the scsi or sata controller - copy it in a floppy - on the xp setup screen press F5 to copy hdd controllers by inserting this floppy - then continue the setup


quick format clears indexing and partition info - partition boot record PBR is cleared

normal format is a low level format which scans the hdd surface for bad sectors - the hdd is realocated - after debugging no info can be retrieved - its a 2 minute process.


when hdd doesnt format then try debugging


after booting from a startup disk or floppy execute
c:\xp\i386\winnt.exe for 16 bit
c:\xp\i386\winnt.exe for 32 bit


39-34 minutes - installing device drivers & components

33 min - installing video card

32 min - installing network adapter - winsock contains tcp/ip stack


device manager indiactors


! - driver incompatibilty
? - other devices
red X - disabled


shift + F10 opens command promt while installation

if we try to open deveice manager by devmgmt.msc gives us microsoft management console error for unregistered mmcndmgr.dll
so register it by regsvr32 mmcdmgr.dll n then open device manager (/s - silent, /u - unregister)

then proceed with h/w clean boot as follows

disable communication devices like - network modem, bluetooth,Ir, com parallel, webcam, external periperhal

In case of cyclic redundancy error ie error with the disk
open notepad and copy the I386 folder to c:\

then open the registry - HKeyLocalMachine \ Software \ Microsoft \ Windows NT \ Current Version
click on current version and on the right window select the SourcePath change this path to C:\I386
after the installation completes RUN > SFC / SCANNOW to check whether all the files are copied or no


Typical installation settings for network adapter

1.TCP/IP IPv4 for SP2, IPv6 for SP3
2. File and printer sharing
3. Client for Microsoft
4. QOS packet scheduler




Collecting Information - reads n accepts the license agreement - product key

Dynamic Update - syncs up with internet - its only valid when installlation is done within oS

while parallel installation create a different folder for installation say windows1
while creating new user remember not to create the previous or existing user, give it a different name say Iyogi or else the My documents folder will be over written

Preparing Installation - copies files to ur hard drive - during repair teh files on the hard drive can be used for installation

C:\$WIN_NT$~BT - temp installation folder
C:\$WIN_NT$~LS - if copied from network

Repair install - Least amount of data is lost.

The following log files are created during the GUI mode setup:

setupact.log: File copies, net and display information, and pagefile data.
setuperr.log:Errors encountered in GUI Mode . Setuperr.log is usefu; for troubleshooting error msgs
setupapi.log Device installation info .it is useful for device installation problems
setuplog.txt device installation and OLE registration info


open devmgmt.msc - show hidden devices - view - resources by type - check for IRQ - check for exclamation mark then disable it

then click on view - devices by type - check plug n play devices - check fro exclamation mark -if found then disable it


Try repair installation in following scenarios :-

1. The customer cannot boot into safemode
2. Windows update, hotfixes, cause issue
3. When subinacl fails to reset the file/registry settings for user permissions
4. If any hardware causing problem is removed


Repair installation not recommended in following scenarios :-

1.When password is lost
2. 3rd party issue

Registry Errors: Fixing

The best way to fix registry errors is by using registry cleaner software. Registry cleaners are readily available for download on the Internet. However, you must be careful while selecting the registry cleaner for your PC. First and foremost, the registry cleaner you opt for must be compatible with the operating system on your PC. For instance, if you own a Windows XP PC then the registry cleaner you go in for must be compatible with the Windows XP registry. This is important because different Windows versions use different approaches to store information in the registry. If you buy an incompatible registry cleaner, you might end up with more errors than you initially had. A good registry cleaner enables you to scan and fix each and every registry error with just a few mouse clicks. Registry cleaner’s help you make regular backups of the registry that you can use to restore the registry to last known working state in case of problem. An advanced registry cleaner enables you to perform a deep scan to weed out obsolete entries, invalid entries, registry holes, and fragments from deep within the registry. An efficient registry cleaner also helps you eliminate embedded registry keys added by malicious software, which are otherwise untraceable and irremovable. Using a good registry cleaner you can also defragment the registry and make the registry files contiguous to ensure faster data access. A healthy registry is crucial for optimal performance of your PC. A single registry error can considerably bring down your system’s performance. To prevent registry errors, you must regularly run antivirus and anti-spyware scans on your system. You must also keep your computer updated with the latest virus definitions and security updates. Additionally, you must regularly use reliable and compatible registry cleaner software to scan and fix registry errors and enhance your computing experience

Registry Errors: Causes

Are you unable to open applications on your PC? Has your PC started behaving erratically quite often? Does system startup and shutdown take hours on your system? If yes, then it is time that you give the issue some thought. 90 out of 100 times registry errors are the cause of your PC problems. You may wonder how Windows registry can cause errors on your system. Well, the registry is the repository that stores on your computer all information about system hardware and software configuration, system and network settings, and user profiles. Therefore, each and every PC activity, such as accessing, installing, uninstalling, working on applications, and configuration change, such as modifying display settings, changing audio level, and changing window size, makes an entry or adds a key within the registry. Normally, an entry or key when no longer used—after you uninstall an application or close a program—are deleted automatically from the registry. However, at times some of these keys are either left behind and leave vacant spaces or registry holes. Over time, a large number of obsolete, redundant, and invalid entries and registry holes accumulate within the registry causing it to grow at an unwarranted rate. Eventually damaging, corrupting, and fragmenting the registry. Therefore, next time you cannot open an application and keep receiving an error message, then you must know that a registry error might be behind it. If you frequently browse the Web and download various freeware programs, audio, and games, then your computer opens up to attacks from malware such as viruses, Trojans, spyware, and adware.

These malicious programs add embedded keys within the registry. These keys are usually non-removable and cannot be deleted manually. A registry error that is caused due to a malicious entry can cause many serious problems to your system. These entries may change file associations and prevent you from opening executable files and cause system freezes whenever you start working on the system. In more severe cases, registry error due to malware may damage your system hardware and prevent your PC from booting up

Registry Value

A value in the Windows Registry contains specific instructions for your Windows installation. In Registry Editor; a value is located on the right hand side of the screen. Registry values are located under registry keys or subkeys, and ultimately within a registry hive.

Registry Key

A key in the Windows Registry can be thought of like a file folder. A key that sits within another key is called a "subkey."Registry keys may contain additional registry subkeys and registry values and will always exist under the highest key in the hierarchy called a registry hive.

In Registry Editor, keys and subkeys are shown as the folders on the left hand of the screen.

Also Known As: registry subkey, registry entry