Chapter 22, The Windows 2000 Boot Process Chapter 22, Lesson 1 The Boot Process

|1| 1. Files Used in the Boot Process

A. Ntldr

B. Boot.ini

C. Bootsect.dos

D. Ntdetect.com

E. Ntbootdd.sys

F. Ntoskrnl.exe

G. Hal.dll

H. System

I. Device drivers

|2| 2. Preboot Sequence

A. The computer runs power-on self test (POST) routines.

1. Determines the amount of physical memory

2. Determines whether the hardware components are present

3. Enumeration and configuration of hardware devices occurs if the computer has a Plug and Play BIOS.

B. The computer BIOS

1. Locates the boot device

2. Loads and runs the master boot record (MBR)

C. The MBR

1. Scans the partition table

2. Locates the active partition

3. Loads the boot sector on the active partition into memory

4. Executes the boot sector

D. The computer loads and initializes the Ntldr file.

|3| 3. Boot Sequence

A. Gathers information about hardware and drivers

B. Uses the following files: Ntldr, Boot.ini, Bootsect.dos (optional), Ntdetect.com, and Ntoskrnl.exe

C. Consists of four phases:

1. Initial boot loader

a. Ntldr switches the microprocessor from real mode to 32-bit flat memory mode.

b. Ntldr starts the appropriate minifile system drivers.

2. Operating system selection

a. Ntldr reads the Boot.ini file.

b. Ntldr prompts user to select the operating system if more than one operating system is available.

c. Ntldr loads the operating system.

3. Hardware detection

a. Ntdetect.com and Ntoskrnl.exe perform hardware detection.

b. Ntdetect.com executes and collects a list of currently installed hardware components, which is used to update the registry.

4. Configuration selection

a. Operating system loader process presents the Hardware Profile/Configuration Recovery Menu screen, if more than one profile is available.

b. User can select a profile or the default will be loaded.

|4| 4. Kernel Load

A. Ntldr loads Ntoskrnl.exe but does not initialize it.

B. Ntldr loads the hardware abstraction layer file (hal.dll).

C. Ntldr loads the HKEY_LOCAL_MACHINE\SYSTEM registry key from systemroot\System32\Config\System.

D. Ntldr selects the control set it will use to initialize the computer.

E. Ntldr loads device drivers with a value of 0x0 for the Start entry.

|5| 5. Kernel Initialization

A. Ntldr passes control to the kernel.

B. The system displays a graphical screen with a status bar indicating load status.

C. The kernel creates the HKEY_LOCAL_MACHINE\HARDWARE key using the data collected during hardware detection.

D. The kernel creates the Clone control set by copying the control set referenced by the registry subkey HKEY_LOCAL_MACHINE\
SYSTEM\Select.

E. The kernel loads and initializes device drivers.

1. The kernel initializes the low-level device drivers that were loaded during the kernel load phase.

2. The kernel scans the HKEY_LOCAL_MACHINE\SYSTEM\
CurrentControlSet\Services subkey for device drivers with the value 0x1 for the Start entry.

F. Session Manager (Smss.exe) starts the higher-order subsystems and services.

G. Session Manager executes the instructions in the BootExecute data item, and in the Memory Management, DOS Devices, and SubSystems keys.

|6| 6. Logon

A. The Win32 subsystem automatically starts Winlogon.exe.

B. Winlogon.exe starts Local Security Authority (Lsass.exe) and displays the Logon dialog box.

C. The Service Controller executes and makes a final scan of the HKEY_LOCAL _MACHINE\SYSTEM\CurrentControlSet\Services subkey, looking for services with the value 0x2 for the Start entry.

D. Windows 2000 startup is not considered good until a user successfully logs on to the system.

E. After a successful logon, the system copies the Clone control set to the LastKnownGood control set.

|7| 1. Windows 2000 Control Sets

A. The control sets are stored as subkeys of the registry key HKEY_LOCAL_MACHINE\SYSTEM.

B. The CurrentControlSet subkey is a pointer to one of the ControlSet00x keys.

C. The Clone control set

1. Is a clone of the control set used to initialize the computer (either Default or LastKnownGood)

2. Is created by the kernel initialization process each time you start your computer

3. Is not available after you log in

|8| D. The HKEY_LOCAL_MACHINE\SYSTEM\Select registry subkey contains

1. Current

a. Identifies which control set is the CurrentControlSet

b. Modified as you use Control Panel options or the Registry Editor to change the registry

2. Default

a. Identifies the control set to use the next time Windows 2000 starts, unless you select the LastKnownGood control set

b. Contains the same control set number as Current

3. Failed identifies the control set that was designated as failed the last time the computer was started using the LastKnownGood control set.

4. LastKnownGood

a. Identifies a copy of the control set that was used the last time the computer started Windows 2000 successfully

b. Created when the Clone control set is copied to the LastKnownGood control set after each successful login

|9| 2. The Last Known Good Process

A. Recovers your working configuration if you change the Microsoft Windows 2000 configuration to load a driver and it causes problems rebooting

B. Uses the LastKnownGood control set, which is stored in the registry, to boot Windows 2000

|10| C. Situations when you use the Last Known Good Configuration option

1. After a new device driver is installed, Windows 2000 restarts, but the system stops responding.

2. You accidentally disable a critical device driver.

|11| D. Situations when using the Last Known Good Configuration option will not help

1. When the problem isn’t related to Windows 2000 configuration changes. Such a problem might arise from incorrectly configured user profiles or incorrect file permissions.

2. After you log on. The system updates the LastKnownGood control set with Windows 2000 configuration changes after a successful logon.

3. When startup failures relate to hardware failures or missing or corrupted files

|12| 1. Safe Mode

A. If your computer won’t start, try the Safe Mode option.

B. Press F8 during the operating system selection phase and select Safe Mode.

C. Safe Mode loads and uses only basic files and drivers, including the mouse, VGA monitor, keyboard, mass storage, default system services, and no network connections.

D. If your computer won’t work in Safe Mode, try Windows 2000 Automatic System Recovery.

|13| 2. Other Advanced Options

A. Enable Boot Logging

1. Logs the loading and initialization of drivers and services for troubleshooting boot problems

2. All drivers and services that are loaded and initialized or that are not loaded in a file are logged.

3. The log file, ntbtlog.txt, is located in the windir folder.

4. All three versions of Safe Mode create this log.

B. Enable VGA Mode starts Windows 2000 with a basic VGA driver.

C. Last Known Good Configuration

D. Directory Services Restore Mode

1. Allows the restoration of directory services based on domain controllers

2. Applies only to computers running Windows 2000 Server

E. Debugging Mode

1. Starts debugging to help track down problems in programming code

2. Applies only to computers running Windows 2000 Server

F. Boot Normally allows you to abort the screen of advanced boot options and proceed with a normal boot.

|14| 1. Components of the Boot.ini File

A. [boot loader]

1. The timeout value indicates the amount of time a user has to select an operating system, if more than one operating system is available on the computer.

2. The default value indicates the default operating system to boot, if no selection is made from the list of operating systems to boot.

B. [operating systems]

1. Contains a line for each available operating system on the computer

2. Uses ARC paths

|15| 2. ARC Paths

A. The Advanced RISC Computer (ARC) paths point to the computer’s boot partition.

B. Multi(x) or scsi(x) – The adapter/disk controller

C. Disk(y) – The SCSI ID. For multi the value is always 0.

D. Rdisk(z) – A number (z) that identifies the disk. This is ignored by SCSI.

E. Partition(a) – A number (a) that identifies the partition

|16| 3. Boot.ini Switches

A. /basevideo

1. Boots the computer using the standard VGA video driver

2. If a new video driver isn’t working correctly, use this switch to start Windows 2000, and then change to a different driver.

B. /fastdetect=[comx | comx,y,z]

1. Disables serial mouse detection

2. Without a port specification, this switch disables all COM ports.

3. This switch is included in every entry in the Boot.ini file by default.

C. /maxmem:n

1. Specifies the amount of RAM that Windows 2000 uses

2. Use this switch if you suspect that a memory chip is bad.

D. /noguiboot boots the computer without displaying the graphical boot status screen.

E. /sos

1. Displays the device driver names as they are loading

2. Use this switch when startup fails while loading drivers to determine which driver is triggering the failure.

|17| 4. Modifications to Boot.ini

A. Modify the timeout and default parameter values in the Boot.ini file by using System Properties in Control Panel.

B. Manually edit parameter values in the Boot.ini file.

C. Clear the read-only and system attributes of the Boot.ini file to edit it.

a. Use Windows Explorer.

b. Use the command prompt and the Attrib command.

|18| 1. Installing and Starting the Recovery Console

A. Install the Recovery Console from the Windows 2000 Professional source files on CD-ROM or a network share.

B. Run i386/winnt32/cmdcons to install the Recovery Console.

C. Access the Recovery Console from the Please Select Operating System To Start menu.

|19| 2. Accessing the Recovery Console from CD-ROM

A. Boot off the CD-ROM or Setup Boot diskettes.

B. Press Enter at the Setup Notification message.

C. Press R to repair an installation.

D. Press C to start the Recovery Console.

E. Type the number of the Windows 2000 installation you wish to repair.

F. Type the Administrator password and press Enter.

G. Type Help and press Enter to view the list of available commands.

3. Practice: Using the Windows 2000 Recovery Console