After the POST test, the BIOS looks for the Master Boot Record (MBR) and runs
the MBR boot program. The program in the MBR then locates the active
partition and partition's boot sector, containing the start of the OS:
NTLDR.
The boot sequence uses NTLDR, BOOT.INI,
BOOTSECT.DOS (optional), NTDETECT.COM and
NTOSKRNL.EXE
NTLDR switches the processor from real mode to 32-bit flat
memory mode. Next, NTLDR starts the appropriate minifile
system drivers so that NTLDR can find and load Windows 2000
from partitions formatted with either FAT or NTFS.
If you format a floppy disk using Windows 2000, the boot sector is set
to look for NTLDR. If you leave a disk in your computer
when it is being rebooted, you will see this message "NTLDR is
Missing. Press any key to restart."
NTLDR reads the BOOT.INI file. This is a text
file that allows Windows NT to offer the user a choice of operating
systems. These other OSes will be installed in different folders or on
different partitions. Names follow Advanced RISC Computing
(ARC) standards. (From within Windows 2000 this file may be
edited by running BOOTCFG)
If the BOOT.INI file isn't present, NTLDR attempts
to load Windows 2000 from the Winnt folder on the first partition of the
first disk, typically C:\Winnt.
[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(1)rdisk(0)partition(1)\WINDOWS="WinXP Pro" /fastdetect multi(0)disk(0)rdisk(0)partition(2)\WINNT="Win2000Pro" /fastdetect
If you select an operating system other than Windows 2000 (e.g.
Windows 9x), NTLDR loads and executes
BOOTSECT.DOS, which is a copy of the boot sector that was on the
system partition at the time that Windows 2000 was installed.
NTDETECT.COM performs hardware detection. It collects a
list of currently installed hardware components and returns this list to
NTLDR for later inclusion in the Registry under the key
HKLM\Hardware
The Hardware Profile / Configuration Recovery Menu screen contains a
list of the hardware profiles that are set up on the computer. You can
press L to invoke the Last Known Good Configuration option. If there is
only a single hardware profile, NTLDR doesn't display the menu
and loads Windows 2000 using the default hardware profile configuration.
NTOSKRNL.EXE loads and initialises device drivers and
loads services. The screen clears and a series of white
rectangles appears across the bottom of the screen.
During the kernel load phase, NTLDR does the following:
NTOSKRNL.EXE but doesn't initialise it.
HAL.DLL).
HKLM\System\CurrentControlSet\Control\ServiceGroupOrder
After kernel load phase is complete NTLDR passes control to the
kernel. At this point, the system displays a graphical screen with a
status bar indicating load status.
First it creates registry key HKLM\Hardware. This contains
information about hardware components on the system board and the interrupts
used by specific hardware devices. Next the kernel creates the Clone
control set, an identical copy of the data used to configure the
computer. Finally, device drivers are loaded and initialised and
Session Manager (Smss.exe) starts the higher-order subsystems
and high-priority services.
Winlogon.exe starts Local Security Authority
(Lsass.exe) and displays the Logon dialog box. Further
services load during this phase.
After a successful logon, the system copies the Clone control set to the LastKnownGood control set.