The Windows Boot Process

Once a Windows Desktop/Server machine is booted, the following steps are executed in this order:
BIOS Initialization

  1. The firmware identifies and initializes hardware devices. The CMOS loads the BIOS and then runs POST (power-on-self-test).
  2. The BIOS detects a valid system disk and reads the MBR (master boot record) section.
  3. The Boot manager software (Bootmgr.exe) will be launched which in turn will look and start the Winload.exe process. Once Winload is executed, the OS Loader phase starts.
OS Loader
  1. The Windows Loader Binary (Winload.exe) is used to load system drives that are required to read data from the disk.
  2. Initializes the System to allow the Windows kernel to start its execution.
  3. The system registry hive and the drivers that are marked as BOOT_START are loaded.

OS Initialization

  1. PreSMSS: Kernel Initialization kernel initializes data structures and components and starts the PnP manager which will initialize the BOOT_START drivers that were previously loaded
  2. SMSSInit : Session Initialization – This phase starts when the kernel gives the session manager process (Smss.exe) the right to start its operation. The System will initialize the registry, load and start devices and drivers that are not marked as BOOT_START, and will start the subsystem processes.
  3. WinLogonInit: Winlogon Initialization – Once the SMSSInit phase is completed, the control is passed to Winlogon.exe. In this phase the user logon screen is displayed, the Service Control Manager starts Windows services, and Group Policy scripts are executed.
  4. ExplorerInit: Explorer Initialization – Once the WinLogonInit phase is completed, Explorer.exe is started. During the ExplorerInit phase, the system creates the Desktop Window Manager (DWM) process, which initializes and displays the Desktop.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s