Practical Lab: Boot Analysis

Objective

Watch and measure the boot of your own PC: see the boot messages, look at the boot settings (the BCD), try Safe Mode, read the start-up logs, and find out what slows your boot. Most parts only look. Two parts (Part 2 and Part 3) change a start-up option temporarily, and each tells you how to put it back.

Time: 30–40 minutes
You need: A Windows PC where you have an administrator account. No extra software is needed.

Before you start: Save your work. Parts 2 and 3 restart the PC. Know your sign-in password or PIN. If the disk is protected by BitLocker, make sure you have your recovery key available, because some boot changes can ask for it.

What to Open

Part 1: Facts About Your Boot (Look Only)

Open msinfo32 and write down:

1. BIOS Mode (UEFI or Legacy): ________________
2. Secure Boot State: ________________
3. BIOS Version/Date: ________________

Now ask PowerShell when the PC last started:

(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

4. Last boot time: ________________

Then check whether hibernation is available, because Fast Startup (Section 1.1) needs it:

powercfg /a

5. Does the output say Hibernation is available? (Fast Startup needs it.) ________________

Part 2: Observing Boot Messages

On modern Windows, the boot is hidden behind a logo. You can ask Windows to show more.

2A. Pause the boot menu (only if your PC shows one). If you have two operating systems, the Boot Manager shows a countdown (like Figure 6.7). Press any key, such as the Spacebar, to stop the countdown and read the menu. Press Esc or choose an entry to go on.

2B. Show the driver names while booting.

1. Open msconfig and go to the Boot tab.
2. Under Boot options tick OS boot information. (Optionally also tick No GUI boot, which hides the logo animation so that text shows more easily.)
3. Click OK and Restart.

During the boot, you should see a black screen with a list of driver file names scrolling past (ntfs.sys, disk.sys, ...). Each name is a driver being loaded (Section 6.2 and Section 7.4).

To undo it: go back to msconfig → Boot, untick OS boot information and No GUI boot, click OK, and restart.

6. Name two driver files you saw: ________________

(On a very fast PC the list passes in a blink. That is a good sign. You can record the screen with a phone camera and pause the video.)

Part 3: Safe Mode Boot

What you will do: Start Windows with only core drivers and services, to see the difference.

1. Open msconfig → Boot tab.
2. Tick Safe boot and choose Minimal.
3. Click OK → Restart.

When the PC comes up, you will see "Safe Mode" in the corners of the screen. The picture looks simple (low resolution, plain background), and there is no network.

7. What is different about the screen? ________________
8. Open Task Manager → Details. Is the number of running processes higher or lower than usual? ________________

To get back to normal (do not skip this):

1. Open msconfig → Boot tab.
2. Untick Safe boot.
3. Click OK → Restart.

If you cannot reach msconfig in Safe Mode: Open an administrator Command Prompt and type: bcdedit /deletevalue {current} safeboot, then restart. (That removes the Safe Mode flag. See Part 4 for how bcdedit shows it.)

Another way (no settings change): Hold Shift and click Restart (Start menu → Power). Choose Troubleshoot → Advanced options → Startup Settings → Restart, then press 4 for Safe Mode. The next restart goes back to normal.

Part 4: Checking the BCD with bcdedit

Open Command Prompt as administrator and type:

bcdedit /enum

Find these fields (Section 5.3):

9. Windows Boot Manager → path: ________________ (does it end in bootmgfw.efi or is it \bootmgr?)
10. Windows Boot Manager → timeout: ________________
11. Windows Boot Loader → path: ________________ (winload.efi or winload.exe?)
12. Windows Boot Loader → description: ________________

Now look at everything, including hidden entries:

bcdedit /enum all

13. How many entries does the output contain (count the headings)? ________________

If you did Part 3, run bcdedit /enum {current} while in Safe Mode. You should see a line safeboot Minimal. After you returned to normal, that line should be gone.

Look, do not touch. Only the /enum commands are used in this lab. Before changing the BCD in the future, back it up with bcdedit /export C:\BCD_backup.

Part 5: Viewing System Startup Logs

5A. Boot logging. Windows can write the list of loaded drivers to a text file. Turn it on in msconfig → Boot tab → tick Boot log → OK → Restart. After the restart, open the file:

notepad C:\Windows\ntbtlog.txt

14. Find a line that says "Did not load driver". Which driver? ________________ (A few are normal: they are drivers for hardware you do not have.)

To undo it: untick Boot log in msconfig and restart.

5B. Event Viewer. Open Event Viewer → Windows Logs → System. Use Filter Current Log (right panel) and set Event sources to Kernel-General. Look for the event that says "The operating system started at system time ..." (Event ID 12) near your last boot.

15. At what time did the OS start? ________________

Next, the Event Log service: in the same System log, filter for Event ID 6005 ("The Event log service was started"). This marks the start of user-mode services (Section 8). Compare it to Event ID 12.

You can also use PowerShell:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=12,6005} -MaxEvents 6 | Format-Table TimeCreated, Id, Message -AutoSize

16. Look for errors: in the System log, filter Event level: Error and read the oldest few after the last boot. Is there a 7000-series (service) error? ________________

Part 6: Analyzing Boot Performance

6A. Task Manager.

1. Open Task Manager → Startup apps.

2. Look at the top right: Last BIOS time (the firmware's share of the boot, shown on UEFI PCs).

3. Click the Status or Startup impact column header to sort.

4. Last BIOS time: ________________ seconds

5. Which three apps have the highest Startup impact? ________________

(Disabling an app here does not uninstall it, and you can turn it on again. Only do so if you understand what it is.)

6B. The Windows boot-time record. Open Event Viewer → Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance → Operational. Find Event ID 100. It describes how long the last boot took. Or use PowerShell:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Diagnostics-Performance/Operational'; Id=100} -MaxEvents 3 | Format-List TimeCreated, Message

19. Boot time (from the event's message, in milliseconds): ________________

(If the log is empty or the command finds nothing, the log may be disabled or cleaned on your PC. That is fine; skip this step.)

Other events in this log (IDs about 101 to 110) name what slowed down the boot: a slow app, driver or service. Look for any and read their messages.

6C. Startup list from PowerShell.

Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location

20. How many items start with Windows? ________________

What Should Happen

• Part 1 tells you your boot mode and last boot time.
• Part 2 and 3 show that boot can be changed by one setting, and that Safe Mode loads far less than normal mode.
• Part 4 shows the same BCD fields as Section 5.3.
• Part 5 shows that Windows keeps a written record of the boot.
• Part 6 shows which part of your boot is long, and which apps add to it.

Interpretation Guide

Follow-Up Questions

1. Which of the phases in Section 10.2 is the longest on your PC? How do you know?
2. Why does Safe Mode run fewer processes than normal mode?
3. The BCD tells the boot manager where Windows is. What could happen if bcdedit pointed at the wrong partition?
4. You changed one setting in msconfig and forgot to reverse it. How could bcdedit /enum {current} show you?
5. Why does Restart show a different boot time from a Shutdown followed by power-on, when Fast Startup is on?