Previous Page | Next Page

  1. Introduction
  2. Capabilities
  3. Structure
  4. The Registry
  5. System and Configuration Files
  6. Security
  7. Application Support
  8. Requirements
  9. Installation
  10. Unattended Installation
  11. Booting
  12. Filesystems
  13. Programs
  14. Control Panel
  15. Tool
  16. Commands
  17. Customization
  18. Environment Variables
  19. Printing
  20. Performance
  21. System Services
  22. Permissions
  23. Groups
  24. User Rights and Auditing
  25. User Profiles
  26. Policies
  27. Network Model
  28. Resource Access
  29. Network Browsing
  30. Protocol Support
  31. RAS
  32. Networking
  33. Backups
  34. Events
  35. Error Handling
  36. Diagnostic Tools
  37. Items to Memorize
  38. Terms
  39. Credits

Windows NT Booting

The Boot process

The phases of NT booting are:

  • Boot - The computer hardware is detected, the operating system is initialized, and executive services is loaded.
  • Load - Services are started and user modes are set up.

Steps that occur during the NT boot process:

  1. The NT loader program, ntldr.exe is loaded from the boot sector of the hard drive.
  2. The NT loader changes memory to a flat 32 bit model and opens the boot.ini file and uses it to present a menu of operating systems that can be booted.
  3. The NT loader builds a system hardware list by running
  4. The user selects a system to run or runs the default system.
  5. If the user selects MS-DOS or Windows 95, ntldr will load BOOTSECT.DOS, which contains the boot sector information for the other operating system and its system files.
  6. If the user selects NT and there is a SCSI drive that has the SCSI adapter BIOS disabled on the system, ntldr will use NTBOOTDD.SYS to initialize the SCSI device.
  7. The kernel loads - The HAL is loaded then the system hive is loaded from the registry. At this time the user can press spacebar to load the LastKnownGood configuration. The dots are presented at the top of the screen as the drivers are loading.
  8. Kernel initialization involves initialization of kernel modules and device drivers by NTOSKERNEL.EXE based on system registry entries. The CurrentControlSet and CloneControlSet registry areas are saved. A driver can report the following errors to the kernel.
    • Ignore - No error is displayed.
    • Normal - Booting continues with error displayed.
    • Severe - The LastKnownGood configuration is used to boot.
    • Critical - Booting fails if LastKnownGood configuration is being used to boot.
  9. Services are loaded by the Session Manager (SMSS.EXE).
    • The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute registry key is read and entries in it are run. The entry that is normally on by default in this key is "autocheck" which checks files and attempts to repair problems with them or directories.
    • Paging files in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management registry key are initialized.
    • The CurrentControlSet and CloneControlSet registry areas are saved.
    • Subsystems defined in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems are loaded. Initially only the WIN32 subsystem is required.
  10. The WIN32 subsystem loads the logon program, WINLOGON. EXE. It starts the LSASS.EXE, local security authority (LSASS.EXE) program, that displays login screen. The WIN32 subsystem also starts the Service Controller (SCREG.EXE) program. This program starts system services configured to start automatically.
  11. The user logs on.
  12. The clone control set is copied to LastKnownGood.

Required files

On Intel based machines:

  • NTLDR - The boot loader
  • BOOT.INI - Contains the boot menu with selections the user can boot from.
  • BOOTSECT.DOS - A boot sector file for DOS for booting DOS or Windows 3.1 or 95.
  • NTDETECT.COM - Detects the hardware for the NTLDR program.
  • NTOSKRNL.EXE - The NT kernel.
  • NTBOOTDD.SYS - Used for booting SCSI devices when no SCSI BIOS is available.

On RISC based machines:

  • OSLOADER.EXE - The RISC boot loader
  • NTOSKRNL.EXE - The kernel
  • NTBOOTDD.SYS - Used for booting SCSI devices when no SCSI BIOS is available.


BOOT.INI is stored in the root directory of the computers primary boot partition and contains the menu of operating systems that may be booted. Has two sections:

  1. [Boot Loader]
    • Timeout - The number of seconds the bootloader waits for the user to select an operating system other than the default.
    • Default - The path of the default operating system that is booted if the user makes no selection
  2. [Operating Systems] - Lists the operating systems that may be booted and their paths using the Advanced RISC Computer (ARC) naming convention which is:
    • scsi(n) or multi(n) - The option scsi(n) is used for SCSI adapters that do not include BIOS support or have it enabled on their adapter. The multi(n) term is used for all other types of hard drives. The value of n indicates the number of the hardware adapter to use.
    • disk(n) - The value of n is 0 if the multi option is used, above, but for SCSI, the value indicates the SCSI bus number.
    • rdisk(n) - The SCSI LUN number. If scsi is used above, this value will be 0, "rdisk(0)". Otherwise this value is 0 for primary or 1for secondary.
    • partition(n) - The partition with the system files. This starts with 1 for the first partition. It does not use 0 to indicate the first partition.
    • \path - The directory with the operating system files with the default being \Winnt.
    Options are:
    • /NOSERIALMICE=[COMx | COMy] - Useful if hooking up a UPS to the serial port, so NT will not probe the port.
    • /BASEVIDEO - Standard VGA mode is used to load which is needed if the video card drivers are incorrect.
    • /CRASHDEBUG - Enables automatic recovery and restart. Can be set from the control panel. Sends debut output to COM1, not a file.
    • /SOS - Displays names of device drivers as they are loaded.
    • /NODEBUG - Debugging information is not monitored.
    • /MAXMEM:n - Limits the amount of RAM to be used by NT.
    • /SCSIORDINAL:n - Selects the SCSI controller to be used to boot when there are more than one controller.
    To modify this file, you must change its properties so it is not system and read only. Then it may be edited and the properties must be restored when complete.

An example BOOT.INI file:

[boot loader]
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT40="Windows NT Workstation Version 4.00"
multi(0)disk(0)rdisk(0)partition(1)\WINNT40="Windows NT Workstation Version 4.00 [VGA mode]" /basevideo /sos
C:\="Windows 95"

Boot Option configuration

The system applet in the control panel may be used to select the default operating system to boot and modify the boot.ini timeout value. The Startup/Shutdown tab supports this function. However it will not allow renaming of the bootable systems. Boot options are not configurable from the registry since it is not loaded at the time the boot selection is made. Most boot option changes are done by editing the boot.ini file directly.

Modifying boot configuration in the registry


  • Add variable DontDisplayLastUserName with value of 1 so the last user who logged on will not have their name displayed for new logons.
  • To add a legal notice at the time of logon: Modify the variable LegalNoticeCaption to have a value of "Unauthorized Access Warning!" or something like it, then modify the variable LegalNoticeText to something like "Unauthorized access is a crime punishable by death!".
  • To change the default shell: Modify the value Shell from explorer.exe to progman.exe.
  • Change the variable ShutdownWithoutLogon to 1 to allow the computer to be shutdown by a user that has not logged on. 1 enables the shutdown button and 0 disables the shutdown button.
  • To automate logon,
    • Set the value DefaultDomainName to your domain name value string.
    • Set DefaultUserName to the user you want to be logged on.
    • Set the DefaultPassword value to the user's password.
    • Set the AutoAdminLogon value to 1.
  • PowerdownAfterShutdown - Set the value to 1 to allow the computer to powerdown after shutdown. A value of 0 disables it. This feature works for computers that have BIOS that supports powering down at shutdown.

Boot Error Indications

This message indicated an boot attempt of a DOS disk that does not have DOS system files on it. If this happens on a floppy that you've tried to set up as a boot floppy, reformat the floppy in NT then copy the boot files onto it.

Non-System disk or disk error
Replace and press any key when ready

This message indicates that the boot attempt was on an NT filesystem but the bootloader program does not reside on the disk or it is in the wrong location on the disk. It should be on the master boot record which is the first partition on the drive.

Boot: Couldn't find NTLDR
Please insert another disk

BOOT.INI points to a failed device or an unrecognized partition (This problem may be caused by a noncompliant SCSI adapter):

OS Loader V4.00
Windows NT could not start because of a computer disk hardware configuration problem
Could not read from the selected boot disk. check boot path and disk hardware
Please check the Windows NT documentation about hardware disk configuration and your hardware reference manuals for additional information.

The following message indicates NTDETECT is damaged or missing:

NTDETECT V1.0 Checking Hardware ...
NTDETECT V1.0 Checking Hardware ...

The boot sector is missing or corrupt:

I/O Error accessing boot sector file

The below message indicates one of the following:

  • The operating system is missing or damaged
  • BOOT.INI is missing or tries to load from a location that the kernel does not exist
  • NT is not on the WINNT directory

Windows NT could not start because the following file is missing or corrupt:
\<winnt root>\system32\ntoskrnl.exe
Please re-install a copy of the above file