Section 10: Complete Boot Chain Diagram

The Big Picture: The Whole Journey on One Page

You have now met every step. This section puts them together on one map, adds rough timings, and shows which steps are critical (the boot dies if they fail) and which are non-critical (the boot goes on without them). Keep this page nearby when you troubleshoot: finding where the chain stopped usually tells you what to fix.

10.1 Visual Representation of the Entire Sequence

What it is: A single top-to-bottom chain. Each box starts the one below it. The tag in square brackets shows which section of this chapter explains that step.

┌──────────────────────────────────────────────────────────────────────┐
│ POWER BUTTON  ->  PSU: PS_ON# low, rails rise, Power Good (PWR_OK)   │
│ [Sec 2]  Hardware only. No software is running yet.                  │
└──────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌──────────────────────────────────────────────────────────────────────┐
│ CPU RESET  ->  first instruction at 0xFFFFFFF0 (SPI flash)           │
│ [Sec 2]  CPU starts in a very simple mode                            │
└──────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌──────────────────────────────────────────────────────────────────────┐
│ FIRMWARE: set up RAM, chipset, PCIe  ->  POST  ->  option ROMs       │
│ [Sec 2-3]  Beeps or error LEDs if a part fails                       │
└──────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌──────────────────────────────────────────────────────────────────────┐
│ BOOT DEVICE SELECTION: BootOrder (UEFI) or first sector (BIOS)       │
│ [Sec 4]  UEFI: ESP file.  BIOS: MBR code at 0x7C00                   │
└──────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌──────────────────────────────────────────────────────────────────────┐
│ WINDOWS BOOT MANAGER: bootmgfw.efi (or bootmgr) + BCD                │
│ [Sec 5]  Menu (if more than one OS), BitLocker unlock                │
└──────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌──────────────────────────────────────────────────────────────────────┐
│ WINLOAD.EFI / WINLOAD.EXE                                            │
│ [Sec 6]  Loads ntoskrnl, hal, SYSTEM hive, boot drivers              │
└──────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌──────────────────────────────────────────────────────────────────────┐
│ NTOSKRNL.EXE: memory, objects, processes, PnP, I/O, registry         │
│ [Sec 7]  Starts the System process and then smss.exe                 │
└──────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌──────────────────────────────────────────────────────────────────────┐
│ SMSS.EXE  ->  session 0 (WININIT) and session 1 (WINLOGON)           │
│ [Sec 8]  Paging files, sessions, services.exe, lsass.exe             │
└──────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌──────────────────────────────────────────────────────────────────────┐
│ SERVICES.EXE (SCM): automatic services, network stack, svchost.exe   │
│ [Sec 8]  Drivers and services keep starting                          │
└──────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌──────────────────────────────────────────────────────────────────────┐
│ WINLOGON -> LogonUI -> LSASS checks password -> profile loads        │
│ [Sec 9]  Your user token and HKCU registry hive                      │
└──────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌──────────────────────────────────────────────────────────────────────┐
│ USERINIT.EXE -> EXPLORER.EXE -> desktop -> startup apps              │
│ [Sec 9]  You can work                                                │
└──────────────────────────────────────────────────────────────────────┘

Who runs the show at each moment?

One chain, two entrances (UEFI and legacy BIOS). The middle of the chain differs, the ends are the same:

UEFI:   Firmware ─► ESP: bootmgfw.efi ─► winload.efi ─┐
                                                      ├─► ntoskrnl.exe ─► smss.exe ─► ...
BIOS:   Firmware ─► MBR ─► VBR ─► bootmgr ─► winload.exe ─┘

This is the screen where the chain is easiest to see: the boot manager, on a PC with two operating systems. Look at how it simply lists what the BCD holds:

Figure 6.8 — The Windows Boot Manager again (Windows 7 era): the stop in the chain where the BCD is read. It lists Windows 7 and Ubuntu, counts down from 10 seconds and offers the tool Windows Memory Diagnostic. Screenshot: Champion, CC BY 3.0, via Wikimedia Commons.

10.2 Timing Information (Rough)

What it is: How long does each stage take? It depends heavily on the PC. The numbers below are only typical ranges on a modern PC with an SSD. Treat them as a feel for the proportions, not as promises.

Where the time goes is often a surprise:

Firmware (POST) ██████████              (often the longest on a new PC)
Boot mgr+loader █
Kernel          █████
Services        ██████
Sign-in/desktop ████████████████        (grows with every startup app)

(Bars are an illustration, not measurements.)

What speeds things up:

• An SSD, instead of a hard drive. (The biggest change you can make.)
• Fast Startup (the hybrid shutdown from Section 1.1), which skips most of the kernel's start-up.
• Fewer startup apps (Section 9.7).
• Fast Boot in firmware.
• Keeping drivers and firmware up to date.

How to measure your own boot (Windows):

• Task Manager → Startup apps → Last BIOS time shows the firmware time.
• Event Viewer → Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance → Operational. Event ID 100 records a full boot's time. The lab (Practical Lab page) shows how to read it.

10.3 Critical vs Non-Critical Paths

What it is: A critical path is a step that must work, or the boot stops. A non-critical step can fail and the PC will still reach the desktop, perhaps with something missing. A related term: the critical path in time is the chain of steps that decides the total time. Speeding up other steps does not shorten the boot.

Critical (boot stops if it fails):

Non-critical (boot goes on):

Parallel work: The later steps happen in parallel. After the kernel starts, many services and drivers start at the same time on different cores, and the sign-in screen can appear while the delayed services are still starting. Only the early steps are one-by-one, because each needs the one before it.

Serial (must wait):       Firmware ─► Boot mgr ─► Loader ─► Kernel ─► smss.exe
Parallel (side by side):                                                ├─► services.exe ─► many services
                                                                        ├─► lsass.exe
                                                                        └─► winlogon.exe ─► sign-in screen

Troubleshooting tip: Use the critical list as a map. Note the last thing you saw (a logo, the spinning dots, a blue screen with a code). That tells you which box in the chain broke. Section 11 walks through each.

Summary