Boot Process

Boot Process

1. Bios -> Post

   • Bios -> Loads the MBR
     • MBR -> Locates the active partition and loads the boot sector
       • Boot Sector -> loads ntldr
         • Ntldr ->switches from real to protected mode
           • Ntldr -> Loads/Reads boot.ini
             • Ntldr -> loads/executes ntdetect.com
               • Ntldr ->loads ntoskrnl.exe & hal.dll
                 • Ntldr -> loads HKLM\system & loads drivers w/ start value of 0
                   • ntoskrnl.exe -> loads drivers w/start value of 1
                     • ntoskrnl.exe -> creates HKLM\hardware
                       • ntoskrnl.exe -> starts session manager (smss.exe)
                         • Session mgr -> starts subsystem, setup pagefile for VMM, and winlogon.exe
                           • winlogon.exe -> starts LSA and SCM
                             • SCM -> starts services w/start value of 2
                               • Process Branching Down:
                                 • Ntoskrnl.exe
                                   • Smss.exe
                                     • csrss.exe
                                       • winlogon.exe
                                         • lsass.exe
                                           • services.exe
                                             • explorer.exe