View source for Booting process of Windows

{{short description|Process by which the Microsoft Windows of operating system family initializes}}
The [[Booting|booting]] process of [[Software:Microsoft Windows|Microsoft Windows]] varies between different releases. 

==DOS-based Windows==
===Windows 1.x/2.x===
In Windows versions 1.01 to Windows 2.11, the system was loaded when <code>WIN.COM</code> was executed. It then loaded <code>WIN100.BIN</code> or <code>WIN200.BIN</code> and <code>WIN100.OVL</code> or <code>WIN200.OVL</code>, along with the configuration settings file <code>[[Software:WIN.INI|WIN.INI]]</code>. The default shell is the MS-DOS Executive.

The modules <code>GDI.EXE</code>, <code>KERNEL.EXE</code> and <code>USER.EXE</code>, fonts, and the various device drivers (such as <code>COMM.DRV</code>, <code>MOUSE.DRV</code>, <code>KEYBOARD.DRV</code>) are incorporated in <code>WIN100.BIN</code>/<code>WIN200.BIN</code> and <code>WIN100.OVL</code>/<code>WIN200.OVL</code>.

===Windows 3.x/9x===
In [[Software:Windows 3.1x|Windows 3.x]] and [[Software:Windows 9x|95/98/ME]], the boot loader phase is handled by [[Software:MS-DOS|MS-DOS]]. During the boot phase, <code>CONFIG.SYS</code> and <code>AUTOEXEC.BAT</code> are executed, along with the configuration settings files <code>[[Software:WIN.INI|WIN.INI]]</code> and <code>[[Software:SYSTEM.INI|SYSTEM.INI]]</code>. Virtual device drivers are also loaded in the startup process: they are most commonly loaded from the registry (<code>HKLM\System\CurrentControlSet\Services\VxD</code>) or from the <code>[[Software:SYSTEM.INI|SYSTEM.INI]]</code> file.

When all system configuration files and device drivers have been loaded, the 16-bit modules, <code>KRNL386.EXE</code>, <code>GDI.EXE</code>, and <code>USER.EXE</code>, are loaded, then the 32-bit DLLs (<code>KERNEL32.DLL</code>, <code>GDI32.DLL</code>, and <code>USER32.DLL</code>) are loaded. The 32-bit VxD message server (MSGSRV32) starts <code>MPREXE.EXE</code>, which is responsible for loading the network logon client (such as Client for Microsoft Networks, Microsoft Family Logon or Windows Logon).

When a user is logging on to Windows, the startup sound is played, the shell (usually <code>EXPLORER.EXE</code>) is loaded from the [boot] section of the <code>SYSTEM.INI</code> file, and startup items are loaded.

In all versions of Windows 9x except ME, it is also possible to load Windows by booting to a DOS prompt and typing "win". There are some command line switches that can be used with the WIN command: with the <code>/D</code> switch, Windows boots to [[Safe mode|safe mode]], and with the <code>/D:n</code> switch, Windows boots to safe mode with networking. The latter switch only works properly with Windows 95.<ref>{{cite web|url=http://support.microsoft.com/kb/196249|title=Unable to Start Windows 98 in Safe Mode with Network Support|date=January 23, 2007|website=Support|publisher=[[Company:Microsoft|Microsoft]]|url-status=dead|archive-url=https://web.archive.org/web/20071014014634/http://support.microsoft.com/kb/196249|archive-date=October 14, 2007}}</ref> In Windows 3.1, additional options are available, such as <code>/3</code>, which starts Windows in 386 enhanced mode, and <code>/S</code>, which starts Windows in standard mode<ref>{{cite web|url=http://support.microsoft.com/kb/82731|title=Windows 3.1 WIN.COM Command Switches|date=October 13, 2003|website=Support|publisher=[[Company:Microsoft|Microsoft]]|url-status=dead|archive-url=https://web.archive.org/web/20070423060547/http://support.microsoft.com/kb/82731|archive-date=April 23, 2007}}</ref>

A startup sound was first added in Windows 3.0 after installing the Multimedia Extensions (MME),<ref>{{Citation|title=Windows 3.0 MME... actually has a startup sound (and more!)|url=https://www.youtube.com/watch?v=FsIBUJleu5U |archive-url=https://ghostarchive.org/varchive/youtube/20211213/FsIBUJleu5U |archive-date=2021-12-13 |url-status=live|language=en|access-date=2021-06-22}}{{cbignore}}</ref> but not enabled by default until Windows 3.1.

==Windows NT before Vista==
{{Main|Booting process of Windows NT before Vista}}
In [[Software:Windows NT|Windows NT]], the boot loader is called [[Software:NTLDR|NTLDR]]. It is responsible for accessing the file system on the boot drive, for starting ntoskrnl.exe and for loading boot-time device drivers into memory. Once all the Boot and System drivers have been loaded, the kernel (system thread) starts the Session Manager Subsystem (smss.exe), which in turn starts [[Software:Winlogon|winlogon]], which loads the [[Software:Graphical identification and authentication|graphical identification and authentication]] library.

After a user has successfully logged into the machine, winlogon does the following:

* User and Computer [[Software:Group Policy|Group Policy]] settings are applied.
* Startup programs are run from the following locations:
*#<code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce</code>
*#<code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run</code>
*#<code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</code>
*#<code>HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run</code>
*#<code>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</code>
*#<code>HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce</code>
*#<code>''All Users ProfilePath''\Start Menu\Programs\Startup\</code> (this path is localized on non-English versions of Windows)
*#<code>''Current User ProfilePath''\Start Menu\Programs\Startup\</code> (this path is localized on non-English versions of Windows)

In Windows 95/98/ME, it was also possible to run a program before the user logs on by using RunServicesOnce or RunServices keys. In Windows NT, this has been replaced by the services.exe program, which is able to load a set of system services before a user logs on.

Additionally, in English-language versions of Windows, the startup folder was called "StartUp" instead of "Startup" in Win9x.

Due to the minimally restricted environment of these operating systems, any program can add itself to the Startup registry key or system folder. This method is frequently used by [[Malware|malware]].

==Windows NT since Vista==
{{Main|Software:Booting process of Windows NT since Vista}}
The sequence of booting [[Software:Windows Vista|Windows Vista]] and later versions is different from any previous version of Windows that uses the NT kernel. The operating system [[Booting|boot loader]] in Vista is called winload.exe, and is invoked by [[Software:Windows Boot Manager|Windows Boot Manager]]. Additionally, the [[Software:Graphical identification and authentication|GINA]] that has been in use with all versions of Windows NT since 3.1 has been entirely replaced by "Credential Providers".

==See also==
*[[Booting process of Linux]]

==References==
{{Reflist}}

{{Windows Components}}

{{DEFAULTSORT:Windows Startup Process}}
[[Category:Booting]]

{{Sourceattribution|Booting process of Windows|1}}