CompTIA A_ Certification All-In-One Exam Guide, Seventh Edition - Michael Meyers [241]
Once NTLDR finishes detections, it loads NTOSKRNL.EXE, HAL.DLL, some of the Registry, and some basic device drivers; then it passes control to the NTOSKRNL.EXE file. NTOSKRNL.EXE completes the Registry loading, initializes all device drivers, and starts the WINLOGON.EXE program, which displays the Windows 2000/XP logon screen (Figure 14-52).
Figure 14-52 Where do you want to go today?
Take the time to memorize the primary boot files and the boot process for Windows 2000/XP. Most boot errors are easily repaired if you know which files are used for booting and in which order they load.
* * *
EXAM TIP The Recovery Console can be used to restore damaged/corrupt or missing NTLDR and NTDETECT.COM files from the Windows XP CD.
The Vista/7 Boot Process
Windows Vista has a very different boot process than previous versions of Windows. For one thing, Vista supports both BIOS and UEFI, whereas older versions of Windows did not, so things are a bit more complex right off the bat. Instead of having a unified Windows Vista boot process, there are actually two slightly different boot processes: one for systems using BIOS and one for systems with UEFI.
The very first thing that happens when you power on a system with Windows Vista is that either the BIOS or the UEFI starts up. The difference between BIOS and UEFI systems is in what happens next. In a BIOS-based system, the BIOS uses its boot order to scan partitions, one by one, for a Master Boot Record (MBR). The MBR holds a small bit of file system boot code that scans the system’s partition table for the system partition and then loads its boot sector. The boot sector in turn contains code that does nothing but point the boot process toward a file called BOOTMGR (pronounced “boot manager,” or “boot mugger” if you’re trying to make nerds laugh). On an UEFI system, on the other hand, neither the MBR nor the file system boot code are run and UEFI simply loads up BOOTMGR directly.
* * *
NOTE If you use Vista long enough, you may encounter an error message saying that Windows cannot boot because the BOOTMGR is missing. This message is generated when the boot sector code is unable to locate the BOOTMGR, which can be caused by file system corruption, a botched installation, or viruses.
If you’ve ever run a dual-boot system with Vista on it, you’re probably already somewhat familiar with the BOOTMGR; one of its jobs is displaying that “Which operating system do you want to load?” screen and then loading the appropriate operating system. When the BOOTMGR starts, it reads data from a Boot Configuration Data (BCD) file that contains information about the various operating systems installed on the system as well as instructions for how to actually load (bootstrap) them. Once an operating system is selected (or immediately if only one is present), BOOTMGR loads a program called WINLOAD.EXE, which readies your system to load the operating system kernel itself rather like the way you clean up your house before Aunt Edna comes to visit. It does this by loading into memory the hardware abstraction layer, the system Registry, and the drivers for any boot devices before the operating system itself takes over.
* * *
NOTE BOOTMGR is also responsible for bringing Windows out of hibernation, so if your computer refuses to wake up, blame BOOTMGR!
Once the operating system process (called NTOSKRNL.EXE) takes over, it loads up all of the various processes and systems that comprise Windows, the Windows Vista logo comes up, and you’re happily computing, completely oblivious to all of the complex electronic communication that just took place inside your computer.
* * *
NOTE Unlike with Windows 2000 and XP, the boot files and the system files must all reside on the same partition in Vista and Windows 7.
No Installation Is