Understanding Windows Vista & 7 boot process

 1. Performs initial hardware checks, such as determining the amount of memory present

 2. Verifies that the devices needed to start an operating system, such as a hard disk, are present

1.  3. Retrieves system configuration settings from nonvolatile memory, which is located on

the motherboard

After the motherboard POST completes, add-on adapters that have their own firmware
(for example, video and hard drive controllers) carry out internal diagnostic tests.
If startup fails before or during POST, your computer is experiencing a hardware failure.
Generally, the BIOS or EFI displays an error message that indicates the nature of the problem.
If video is not functioning correctly, the BIOS or EFI usually indicates the nature of the failure
with a series of beeps.

After the POST, the settings that are stored in the nonvolatile memory, such as boot order,
determine the devices that the computer can use to start an operating system. In addition to
floppy disks or hard disks attached to Advanced Technology Attachment (ATA), Serial ATA,
and small computer system interface (SCSI) controllers, computers can typically start an operating system from other devices, such as the following:
 CDs or DVDs
 Network adapters
 Universal serial bus (USB) flash drives
 Removable disks
 Secondary storage devices installed in docking stations for portable computers.

When booting from the hard disk or any medium, the computer reads the boot code instructions located on the MBR. The MBR is the first sector of data on the startup hard disk. The MBR contains instructions (called boot code) and a table (called a partition table) that identify primary and extended partitions. The BIOS reads the MBR into memory and transfers control to the code in the MBR. The computer then searches the partition table for the active partition, also known as a bootable partition. The first sector of the active partition contains boot code that enables the computer to do the following:

1.  Read the contents of the file system used.
2.  Locate and start a 16-bit stub program (Bootmgr) in the root directory of the boot volume.
3. This stub program switches the processor into32-or 64-bit Protected mode and loads the32-or 64-bit Windows Boot Manager,which is stored in the same Bootmgr file.
4. After the Windows Boot Manager loads, startup is identical for both BIOS and EFI computers.

Startup for EFI computers initially differs from startup for BIOS computers. EFI computers
have a built-in boot manager that enables the computer’s hardware to choose from multiple
operating systems based on user input. When you install Windows 7 on an EFI computer,
Windows adds a single entry to the EFI boot manager with the title Windows Boot Manager.
This entry points to the \Efi\Microsoft\Boot\Bootmgfw.efi 32-bit or 64-bit EFI executable program—the Windows Boot Manager. This is the same Windows Boot Manager that is eventually loaded on BIOS-based
computers. Windows configures the EFI boot
manager to display the EFI startup menu for
only 2 seconds and then load the Windows Boot
Manager by default to minimize complexity and
startup time.
If you install a different operating system or manually change the EFI boot manager settings,
EFI might no longer load the Windows Boot Manager.

The Windows Boot Manager is capable of natively reading supported file systems, and it uses that capability to parse the BCD registry file without fully loading the file system.
For computers that have a single operating system, Windows Boot Manager never displays
a user interface. It does, however, wait for a few moments to allow the user to press a key to
display the standard boot menu, as shown in Figure 29-3, or to press F8 to choose Advanced
Boot Options. If the user does not press a key within a few seconds of POST completing, Windows Boot Manager starts the Windows Boot Loader, which in turn starts Windows 7.

The BCD is stored in a data file that uses the same format as the registry and is located on either the Extensible Firmware Interface (EFI) system partition (for computers that support EFI)
or on the system volume. On BIOS-based operating systems, the BCD registry file is located
at \Boot\Bcd on the active partition. On EFI-based operating systems, the BCD registry file is
located in the \EFI\Microsoft\Boot\ folder on the EFI system partition.
The BCD registry file can contain the following types of information:

1. Entries that describe Windows Boot Manager (\Bootmgr) settings.

2. Entries to start the Windows Boot Loader (\Windows\System32\WinLoad.exe), which can then load Windows Vista.

 3.Entries to start Windows Resume Application (\Windows\System32\WinResume.exe), which can then restore Windows Vista from hibernation.

4. Entries to start Windows Memory Diagnostic (\Boot\MemTest.exe)

5. Entries to start Ntldr to load previous versions of Windows.

6. Entries to load and execute a Volume Boot Record, which typically starts a non-Microsoft boot loader.

Note: Additionally, you can add more entries to load custom applications, such as recovery tools.

The Windows Boot Manager starts the Windows Boot Loader phase when the user chooses to load Windows Vista or Windows 7. The Windows Boot Loader does the following:

 1. Loads the operating system kernel, Ntoskrnl.exe, but does not yet run it.

 2. Loads the Hardware Abstraction Layer (HAL), Hal.dll. This will not be used until the
kernel is run.

 3. Loads the system registry hive (System32\Config\System) into memory.

 4. Scans the HKEY_LOCAL_MACHINE\SYSTEM\Services key for device drivers and loads all
drivers that are configured for the boot class into memory. The Windows Boot Loader does not, however, initiate the drivers. Drivers are not initiated until the kernel loading phase.

 5. Enables paging.

 6. Passes control to the operating system kernel, which starts the next phase.

The Windows Boot Loader is responsible for loading the Windows kernel (Ntoskrnl.exe) and the HAL into memory. Together, the kernel and the HAL initialize a group of software features that are called the Windows executive. The Windows executive processes the configuration information stored in the registry in HKLM\SYSTEM\CurrentControlSet and starts services and drivers. The following sections provide more detail about the kernel loading phase.

Control Sets:

The Windows Boot Loader reads control set information from the registry key
HKEY_LOCAL_MACHINE\SYSTEM, which is stored in the file %SystemRoot%\System32.

The HKEY_LOCAL_MACHINE\SYSTEM subkeys used during startup are:

 \CurrentControlSet, a pointer to a ControlSetxxx subkey (where xxx represents a control set number, such as 001) designated in the \Select\Current value.
 \Select, which contains the following entries:

 Default Points to the control set number (for example, 001=ControlSet001) that the system has specified for use at the next startup. If no error or manual invocation of the LastKnownGood startup option occurs, this control set number is designated as the value of the Default, Current, and LastKnownGood entries (assuming that a
user is able to log on successfully).
 Current Points to the last control set that was used to start the system.
 Failed Points to a control set that did not start Windows Vista successfully. This value is updated when the LastKnownGood option is used to start the system.
 LastKnownGood  Points to the control set that was used during the last user session. When a user logs on, the LastKnownGood control set is updated with
configuration information from the previous user session.
\Config\System, so that the kernel can determine which device drivers need to be loaded
during startup. Typically, several control sets exist, with the actual number depending on how often system configuration settings change.

The Windows Boot Loader uses the control set identified by the \Select\Default value unless
you choose the Last Known Good Configuration from
the Advanced Boot Options menu. The kernel creates the registry key HKEY_LOCAL_MACHINE\HARDWARE, which contains the hardware data collected at system startup. Windows supports an extensive set of devices, with additional drivers not on the Windows operating system DVD provided by hardware
manufacturers. Drivers are kernel-mode features required by devices to function within an
operating system. Services are features that support operating system and application functions and
act as network servers. Services  can run in a different
context than user applications and typically do not
offer many user-configurable options.

Drivers are also services. Therefore, during kernel initialization, the Windows Boot  Loader and Ntoskrnl use the information stored in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Servicename registry subkeys to determine both the drivers and services to load. In the Servicename subkeys, the Start entry specifies when to start the service. For example, the Windows Boot Loader loads all drivers for which Start is 0, such as
device drivers for hard disk controllers. After execution is transferred to the kernel, the kernel loads drivers and services for which Start is 1.

 
Value & Start Type: 0 -Boot, 1- System, 2- Auto Load, 3- Load on Demand, 4- Disabled, 5- Delayed Start

Boot: Specifies a driver that is loaded (but not started) by the boot loader. If no errors occur, the driver is started during kernel
initialization prior to any non-boot drivers being loaded.
System: Specifies a driver that loads and starts during kernel initialization after drivers with a Start value  of 0 have been started.
Auto load: Specifies a driver or service that is initialized at system startup by Session Manager (Smss.exe) or the Services Controller(Services.exe).
 Load on demand: Specifies a driver or service that the Service Control Manager(SCM) will start only on demand. These drivers have to be started manually by calling a Win32 SCM application programming interface (API),such as the Services snap-in.
Disabled : Specifies a disabled (not started) driver or service.
Delayed :start Specifies that less-critical services will start shortly after startup to allow the operating system to be responsive to the usersooner. This start type was first introduced in Windows Vista.