Chapter 6 · Complete Boot Process

Knowledge Check

10 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. Which wire tells the motherboard that the power supply's voltages are steady?
  2. At what address does an x86 CPU run its first instruction after reset?
  3. What does POST stand for, and what is it for?
  4. How many bytes is an MBR, and which two bytes end it?
  5. What is the ESP, and which file system does it use?
  6. Which file is the Windows Boot Manager on a UEFI PC?
  7. What does the BCD store, and which tool reads it?
  8. Which file is the Windows kernel?
  9. What is the first user-mode process the kernel starts?
  10. Which process checks your password at sign-in?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. Power Good

PWR_OK ("Power Good"), the grey wire in the big power plug. The PSU raises it after its voltages are stable. The CPU is held in reset until then.

2. The reset vector

0xFFFFFFF0, just 16 bytes below 4 GB. The chipset connects it to the firmware flash chip.

3. POST

Power-On Self-Test. The firmware checks that the CPU, RAM, graphics and other basics work and finds what is plugged in, before it tries to start the operating system.

4. The MBR

512 bytes, ending with the signature 55 AA. (446 bytes of code, 64 bytes of partition table, 2 bytes of signature.)

5. The ESP

The EFI System Partition, a small partition holding the UEFI boot files. It is formatted FAT32.

6. bootmgfw.efi

\EFI\Microsoft\Boot\bootmgfw.efi on the ESP.

7. BCD

The Boot Configuration Database: the list of operating systems and boot options (timeout, default entry, Safe Mode flags). bcdedit reads and changes it.

8. The kernel

ntoskrnl.exe in C:\Windows\System32.

9. smss.exe

smss.exe, the Session Manager.

10. lsass.exe

lsass.exe, the Local Security Authority Subsystem Service. (Winlogon passes your credentials to it.)

UNDERSTANDING QUESTIONS

Q1. Why does the CPU start in real mode even though it is a modern 64-bit chip?

Answer For compatibility. Every x86 CPU resets into the simple, old 16-bit real mode so that old firmware and boot code keep working. The firmware (UEFI) switches to a bigger mode early, and later steps bring the CPU to 64-bit long mode with paging.

Q2. The firmware runs before RAM works. How can a program run without RAM?

Answer It uses the CPU's cache as temporary RAM ("cache-as-RAM"). That gives the first firmware code a small working area. After the real RAM is trained, the firmware copies itself into it and carries on from there.

Q3. Why are some drivers loaded by the loader (winload), before the kernel starts?

Answer Windows has to read its own files from the disk, but the disk driver and file system driver are themselves files on that disk. The loader loads these boot-start drivers (Start = 0) into RAM first, using the firmware's simple disk reading, so the kernel can then read everything else.

Q4. Why does Windows keep services in Session 0, away from the user?

Answer For security (session 0 isolation). Services run with high privileges. If they had windows on the user's desktop, a normal program could talk to them and attack them. In Session 0 they have no desktop that a user program can reach.

Q5. Why does the sign-in screen use Ctrl + Alt + Del in secure environments?

Answer Only Windows itself can see this key combination, so a fake sign-in screen written by a malicious program cannot catch it. Pressing it proves you are talking to the real Winlogon before you type a password.

SCENARIO QUESTIONS (Troubleshooting)

S1. You press the power button. The fans spin and the lights come on, but the screen stays black and there is no beep. What do you check first?

Answer First the simple things: the monitor cable must be in the **graphics card** (not the motherboard) and the monitor on the right input. Then reseat the RAM, check the debug LEDs or POST code display, remove extra devices and clear CMOS. This is a pre-POST or POST problem (Sections 2, 3 and 11.1).

S2. A PC shows "Reboot and Select proper Boot device". It worked yesterday. What are the likely causes and fixes?

Answer The firmware cannot find a bootable program. Causes: a USB drive or another disk is first in the boot order, the boot entry or ESP is damaged, the disk is not detected, or the boot mode was changed (UEFI vs Legacy). Unplug USB drives, check that the disk shows in firmware setup, check the boot order and mode. If needed, use WinRE: Startup Repair, or `bcdboot` to rebuild the boot files (Section 11.3).

S3. After installing a new storage driver, Windows shows a blue screen "INACCESSIBLE_BOOT_DEVICE" at the logo. What happened and what can you do?

Answer Windows cannot read its boot disk. The new or wrong storage driver (a boot-start driver) failed to load or fit the controller. Boot into WinRE and use **Uninstall Updates**, **System Restore**, or Safe Mode to remove the driver. Also check that the disk mode in firmware (AHCI/RAID) was not changed.

S4. The PC reaches the sign-in screen, but after typing the password you see only a black screen with a mouse pointer. Where in the chain is the problem and how do you test it?

Answer Sign-in worked (LSASS and the token are fine), but the shell, `explorer.exe`, did not start (Section 9.6). Press Ctrl + Alt + Del → Task Manager → File → Run new task → `explorer.exe`. If it starts, look for a damaged profile or a broken Shell/Userinit registry value, and for a faulty startup app. Try another account and `sfc /scannow`.

S5. A PC takes 3 minutes to become usable. The firmware time shown in Task Manager is 6 seconds. How do you find the cause?

Answer The firmware is not the problem. Look at the later stages: the Startup apps tab (sort by impact), the Diagnostics-Performance log (Event ID 100 and the related slow-item events), slow services, and the disk (a hard drive instead of an SSD). Disable unneeded startup apps and check the disk's health.

INTERVIEW QUESTIONS

I1. Walk me through what happens from power button to desktop on Windows with UEFI.

Answer Power: the PSU raises PWR_OK, the CPU is released from reset and runs the firmware from the flash chip. Firmware: trains RAM, runs POST, enumerates devices, runs option ROMs. It then reads the boot entries and runs `bootmgfw.efi` from the ESP. The boot manager reads the BCD, may unlock BitLocker, and starts `winload.efi`. Winload loads `ntoskrnl.exe`, the HAL, the SYSTEM hive and the boot drivers, and starts the kernel. The kernel starts its managers and the PnP drivers, then runs `smss.exe`, which creates sessions and starts `wininit` (then `services.exe`, `lsass.exe`) and `winlogon`. Winlogon shows the sign-in screen; LSASS checks the credentials; the profile loads; `userinit.exe` starts `explorer.exe`.

I2. What is the difference between MBR/BIOS boot and GPT/UEFI boot?

Answer BIOS reads the first 512-byte sector (MBR), runs its tiny code, which chains to the partition's boot sector and then `bootmgr`. UEFI understands partitions and FAT32: it reads boot entries from NVRAM, loads a `.efi` file from the ESP and runs it. GPT supports huge disks, 128 partitions by default, a backup table and checksums. UEFI also supports Secure Boot.

I3. What is the BCD and how do you repair it?

Answer The Boot Configuration Database holds the boot manager's settings and the list of OS entries; it replaced `boot.ini`. It is viewed with `bcdedit /enum`. If damaged, boot to WinRE and run Startup Repair, or use `bootrec /rebuildbcd`, or on UEFI `bcdboot C:\Windows /s S: /f UEFI` (S: being the ESP) to recreate the boot files.

I4. What does the Windows loader (winload) do before it hands over to the kernel?

Answer It reads the boot options, checks signatures (Code Integrity, Secure Boot), loads the kernel and HAL, mounts the SYSTEM hive, loads the boot-start drivers (ELAM first), builds the memory map and page tables, sets up hardware tables and puts all of this in the Loader Parameter Block. It then calls ExitBootServices (UEFI) and jumps to the kernel entry.

I5. How would you find which startup program or driver slows a Windows boot?

Answer Task Manager's Startup apps tab (impact and Last BIOS time), Event Viewer's Diagnostics-Performance log (Event ID 100 for total boot time, related events for slow apps, drivers and services), and boot logging (`ntbtlog.txt`) for drivers. Then disable unneeded apps, update drivers and consider an SSD.

PRACTICAL TASK

Draw your own boot timeline. Using your lab results (Last BIOS time, Event ID 100 boot time and your startup app list), draw a horizontal bar on paper with these parts in order: firmware, boot manager and loader, kernel, services and sign-in, desktop and startup apps. Make each part as long as its measured or estimated time. Mark which stage is longest, and write one action you could take to shorten it.

Why This Matters

When someone says "my PC is slow to start", you will know that the answer depends on where the time goes. A slow firmware needs a different fix than a slow sign-in. The timeline also shows that only some steps are in your control (startup apps, services), while others (POST, the loader) are small or fixed.

CHAPTER SUMMARY

  • Boot is a chain: each program starts the next one, and the failure point tells you what to fix.
  • Pre-boot: the PSU raises Power Good, the chipset releases RESET, the CPU starts in real mode at 0xFFFFFFF0, and the firmware trains RAM using cache-as-RAM first.
  • POST tests the CPU and memory, discovers devices, loads the firmware settings and option ROMs, and reports problems with beeps, LEDs or codes.
  • Boot device selection: the firmware follows the boot order. MBR (512 bytes, 55 AA) is the legacy way; GPT and the ESP are the UEFI way.
  • Windows Boot Manager (bootmgfw.efi or bootmgr) reads the BCD, shows a menu and starts the loader. UEFI is already in 64-bit mode; legacy BIOS climbs from real to protected mode.
  • Winload loads the kernel, HAL, SYSTEM hive and boot-start drivers, sets up paging and passes the Loader Parameter Block.
  • The kernel (ntoskrnl.exe) starts the memory, process, PnP, I/O and configuration managers, loads drivers and starts smss.exe.
  • User mode: smss.exe makes sessions; wininit starts services.exe (SCM) and lsass.exe; services and the network stack come up.
  • Sign-in: winlogon.exe and LogonUI collect credentials, LSASS authenticates and builds the access token, the profile loads, and explorer.exe draws the desktop; startup apps follow.
  • Failures: black screen (power, RAM, display), POST codes, no bootloader (boot order, BCD, ESP), blue screens (drivers, disk, memory), service or profile faults. WinRE, bootrec, bcdboot, sfc, DISM and Safe Mode are the main tools.
  • Previous: Chapter 5 — BIOS and UEFI
  • Next: Part 3 — Operating System, Chapter 7 (coming soon)
  • Related: Chapter 6 Overview