Windows Startup Sequence | Windows Boot Sequence

Turn on your computer;
The Computer initiates a POST (Power On Self Test) for devices that have a BIOS (Basic Input/Output System);
- Test the memory & various Subsystems
  - Examples: AGP and Network cards
BIOS then attempts to find the MBR (Master Boot Record)
- A 512-byte sector (LBA 0 or HD0)
If successful, the Windows OS takes Control, and looks for NTLDR (Boot Loader for Windows NT based OSes)
1. In Vista and Server 2008, this has been replaced with:
  - Winload.exe
  - Windows Boot Manger
2. NTLDR allows:
  1. Memory Addressing
  2. Initiates the File System
  3. Reads boot.ini
    - Additional NT Kernel switches (General)
    - Available Switches for XP and 2003
    - ARC Path Naming Conventions
3. NTLDR has to be at the ROOT of an active partition to detect:
  1. NTDETECT.COM
  2. BOOT.INI
  3. BOOTSECT.DOS (needed for multi-OS installs)
  4. NTBOOTDD.SYS (need for SCSI adapters)
    - Only used if:
      - Boot Drive is SCSI;
      - Not using real-mode INT 0x13;
    - Then a copy of the SCSI miniport driver is loaded for Windows to run
  5. Troubleshooting:
    - "Reconstructing BOOTSECT.DOS"
    - "NTLDR is Missing"
If XP is selected in the Boot Menu, NTLDR runs:
1. NTDETECT.COM
  - Gathers basic information from hardware BIOs
2. BOOT.INI
3. BOOTSECT.DOS
4. The systems starts in 16-bit real mode, and then moves into 32-bit protected mode
5. It is possible to select F8 for Additional Boot Modes (Safe Mode, Last Known Good Configuration, etc.)
NTLDR then loads NTOSKRNL.EXE and HAL.DLL
1. Located at: %SystemRoot%\System32
2. Additional files/locations loaded:
  1. kdcom.dll (Kernel Debugger HW)
  2. bootvid.dll (Windows Logo & Side-Scrolling bar)
NTLDR reads the Registry for the following information:
1. Hardware Profile
2. Authorized Device Drivers
3. And needs to be in the Exact Order
"Session Manager" is then started
1. Smss.exe starts Autochk
  1. Mounts all drives
  2. Checks drives for a Clean shutdown state
2. Starts win32k.sys for the Graphical User Interface (GUI) interface
3. Starts csrss.exe (Client/Server Runtime Subsystem)
  1. User-Mode Applications
4. Creates Virtual Memory/Paging file
  1. HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
NTOSKRNL.EXE takes control and starts WINLOGON.EXE which in turn starts LSASS.EXE
1. LSASS.EXE (Local Security Authority Subsystem Service) provides the Logon screen