The XP Bootloader to Logon Process

NTLDR

Initial Boot Loader Phase
Switches the CPU to protected mode, sets up memory paging and accesses the file system on the boot drive.

Operating System selection
If Windows was put in the hibernation state, the contents of hiberfil.sys are loaded into memory and the system resumes where it left off.

Otherwise it reads the boot.ini file and prompts the user with the boot menu if more than one option is available (dual boot for example). In our example it points to the C:\Windows directory. If there is no boot.ini file, it will attempt a default XP boot from C:\Windows.

Hardware Detection
NTLDR then runs ntdetect.com, which gathers information about the computer’s hardware. This list will later be loaded in the registry under the HKEY_LOCAL_MACHINE\HARDWARE key.

Configuration Selection
If you have multiple hardware profiles it will ask you to choose one at this point.

Load Kernel
Starts Ntoskrnl.exe phase 0, passing to it the information returned by ntdetect.com.The Hardware Abstraction Layer (HAL.dll) is loaded to sit between the hardware and the kernel.The screen is cleared and a series of white rectangles progress across the bottom of the screen.

Load Boot Device Drivers
Any driver under HKEY_LOCAL_MACHINE\SYSTEM\Services that has a Start value of SERVICE_BOOT_START is loaded. A period is printed to the screen for each loaded file.

NTLDR is done here and Ntoskrnl carries on.
At this point, the system displays the XP splash screen with a status bar indicating load status.

Ntoskrnl.exe phase 1

The HAL begins accepting interrupts from devices. If more than one processor is present the additional processors are initialized at this point. All Executive subsystems are reinitialized in the following order:

1) Object Manager
2) Executive
3) Microkernel
4) Security Reference Monitor
5) Memory Manager
6) Cache Manager
7) LPCS
8) I/O Manager
9) Process Manager

I/O Manager assembles a prioritized list of drivers and attempts to load them. Failure of a driver to load may prompt NT to reboot and try to start the system using the values stored in the Last Known Good Configuration.


The Session Manager Subsystem (SMSS) is loaded.

SMSS

SMSS is responsible for creating the user-mode environment.
SMSS loads the win32k.sys device driver which switches the screen into graphics mode. The Services Subsystem now starts all services mark as Auto Start. Once all devices and services are started the boot is deemed successful and this configuration is saved as the “Last Known Good Configuration”.

Logon

Winlogon.exe file is loaded as a service and loads the Local Security Authority Subsystem (LSASS.EXE) which displays the logon dialog box or logs into the OS automatically depending upon your settings.

Check the disk’s health

Download and run the disk diagnostics program provided by your hard drive’s manufacturer from their website. If you have a preloaded computer,there is a chance that it has a diagnostic utility built into it. Consult your computer’s manual for details.

You could run a free copy of PartedMagic for this. It is free but be sure to donate to him if his product helps you.
http://partedmagic.com/
Follow the directions there to make a boot CD.
Boot your broken computer from the CD and Select
1. Default Settings (Runs from RAM)

Self-Monitoring, Analysis and Reporting Technology (SMART) diagnostic report of the hard drive.
After PartedMagic loads, double-click the Disk Health icon on the desktop and then double-click the icon for your hard drive and select the Attributes tab.
I usually look for bad sectors “Reallocated Sector Count” represented by the raw value of attribute ID 5 (and C5 to a lesser extent).
If this value is greater than 0 then the disk may be going bad. Click on the Perform Tests tab and run the “Short Self Test” to make sure that it runs with a test result of “Completed without error”. If you see problems here, then the drive is probably going bad and you should focus on data recovery and replace it. If it has no errors from the short test, run the “Extended Self-Test” to make sure that the disk is okay.

You could also run CHKDSK from the recovery console if you found errors on the disk but since we are dealing with system files and sectors, CHKDSK does not usually solve the problem and can in some cases make it more difficult to recover data from the drive. A bad drive needs to be replaced. See my data recovery posts for instructions on getting your data from the bad drive.

FIXBOOT command in the Recovery Console

Boot your computer from the Windows XP CD (see the manual for your computer for instructions on booting from a CD)

When the ‘Welcome to Setup’ screen appears, press the R button on your keyboard to start the Recovery Console.

The Recovery Console will start. If you have multiple Windows installations, it will list them, and you enter the number associated with the installation you want to work on and press enter. If you have just one Windows installation, type 1 and press enter.

You will then be prompted for the Administrator’s password. If there is no password, press enter. Otherwise type in the password and then press enter.

You will now see a C:\Windows> prompt and you can start using the Recovery Console.

Attempt to repair the boot sector with the fixboot command.
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/bootcons_fixboot.mspx?mfr=true

If you are attempting to repair the default boot drive, you can type
fixboot
and hit enter.
Answer y when asked if you are sure. Type exit to close and reboot the computer.

Copy a good NTLDR or NTDETECT.COM file to your disk

Boot your computer from the Windows XP CD (see the manual for your computer for instructions on booting from a CD)

When the ‘Welcome to Setup’ screen appears, press the R button on your keyboard to start the Recovery Console.

The Recovery Console will start. If you have multiple Windows installations, it will list them, and you enter the number associated with the installation you want to work on and press enter. If you have just one Windows installation, type 1 and press enter.

You will then be prompted for the Administrator’s password. If there is no password, press enter. Otherwise type in the password and then press enter.

You will now see a C:\Windows> prompt and you can start using the Recovery Console.

For NTLDR type
copy C:\WINDOWS\ServicePackFiles\i386\ntldr c:\

For NTDETECT.COM type
copy C:\WINDOWS\ServicePackFiles\i386\ntdetect.com c:\

Examine the boot.ini file for errors

Here is an example of a default boot.ini file for a typical Windows XP install.

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

BOOTCFG /REBUILD command in the Recovery Console

Boot your computer from the Windows XP CD (see the manual for your computer for instructions on booting from a CD)

When the ‘Welcome to Setup’ screen appears, press the R button on your keyboard to start the Recovery Console.

The Recovery Console will start. If you have multiple Windows installations, it will list them, and you enter the number associated with the installation you want to work on and press enter. If you have just one Windows installation, type 1 and press enter.

You will then be prompted for the Administrator’s password. If there is no password, press enter. Otherwise type in the password and then press enter.

You will now see a C:\Windows> prompt and you can start using the Recovery Console.

Attempt to rebuild the boot.ini file
It will scan your drives and then tell you what Windows Installations it found and ask which ones you want in your boot list. Typically, it will find one.
Choose YES

Then it will ask for a Load Identifier, which is the name it displays when it lists the OS. You can put something like
Windows XP

Then it asks for OS Load Options. Normally you can put
/fastdetect

Type
exit
to reboot the computer.

Registry Repair from Linux Boot Disk

I like to run a free copy of PartedMagic for this. It is free but be sure to donate to him if his product helps you.
http://partedmagic.com/
Follow the directions there to make a boot CD.
Boot your broken computer from the CD and Select
1. Default Settings (Runs from RAM)

Now use either the graphical File Manager or the command line in a terminal to execute the commands in the Microsoft instructions

http://support.microsoft.com/kb/307545

without the limitation of accessing protected files. Because of this you must be careful to always back files up properly before making changes to them.

Try Last Known Good Configuration

When you turn on your computer start tapping the F8 key about once per second until the Windows Advanced Options menu appears on the screen. Select

Last Known Good Configuration (your most recent settings that worked)

and then press ENTER. The computer will reboot and try to use the configuration that was used the last time that it booted successfully.

Edit boot.ini with debugging switches

This is a trick that will help you identify what mysterious driver or setting is causing the computer not to boot past the Windows XP splash screen.

There are two switches that I like to use for this…

The /sos switch displays the device driver names while they are being loaded. With this you can find the file that the crash is occurring at and can try renaming it temporarily to see if it boots and if it does then reinstall the device or program associated with it.

The /basevideo switch forces XP to use the generic video drivers so you can see if the video drivers are causing the computer not to boot. If they are, you can then try to reinstall or replace your video driver, remove the /basevideo switch and see if it is fixed.

To add the switches you can use commands in Recovery Console or edit the boot.ini file directly from a Linux boot CD (make a backup of the file first).
The command in Recovery Console to add the /sos switch to a default boot.ini file is…

bootcfg /addsw SO /ID n

To remove it type
bootcfg /rmsw SO /ID n

The command in Recovery Console to add the /basevideo switch to a default boot.ini file is…

bootcfg /addsw BV /ID 1

To remove it type
bootcfg /rmsw BV /ID 1

If directly editing the boot.ini file here is what a default one looks like with the switches added…

[boot loader]
timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /sos /basevideo

The list of available switches is here http://support.microsoft.com/kb/833721

Once you find the driver you suspect is causing the problem use Recovery Console commands to disable the driver or service. Remember that if you disable a driver or service in Recovery Console that you want to look at it first with the listsvc command and write down the start type so you can enable it properly at a later time.
http://support.microsoft.com/kb/314058

Enable Boot Logging to find which driver is causing the error.

When you turn on your computer start tapping the F8 key about once per second until the Windows Advanced Options menu appears on the screen. Select

Enable Boot Logging

and then press ENTER. The computer will reboot and create a report about the drivers it loads or tries to load during the boot process.
The log is saved in a text file in C:\Windows\Ntbtlog.txt. Look at this file for errors to help find what is causing the problem.

Once you find the driver you suspect is causing the problem use Recovery Console commands to disable the driver or service. Remember that if you disable a driver or service in Recovery Console that you want to look at it first with the listsvc command and write down the start type so you can enable it properly at a later time.
http://support.microsoft.com/kb/314058

Copy a good ntoskrnl.exe or hall.dll to the windows\system32 directory of the system drive

Boot your computer from the Windows XP CD (see the manual for your computer for instructions on booting from a CD)

When the ‘Welcome to Setup’ screen appears, press the R button on your keyboard to start the Recovery Console.

The Recovery Console will start. If you have multiple Windows installations, it will list them, and you enter the number associated with the installation you want to work on and press enter. If you have just one Windows installation, type 1 and press enter.

You will then be prompted for the Administrator’s password. If there is no password, press enter. Otherwise type in the password and then press enter.

You will now see a C:\Windows> prompt and you can start using the Recovery Console.

For ntoskrnl.exe type
copy c:\windows\system32\ntoskrnl.exe c:\windows\system32\ntoskrnl.bak

copy C:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe c:\windows\system32

For hall.dll type
copy c:\windows\system32\hall.dll c:\windows\system32\hall.bak

copy C:\WINDOWS\ServicePackFiles\i386\hall.dll c:\windows\system32