12.15

Unified Extensible Firmware Interface (UEFI)

A newer specification that defines the software interface between an operating system and a computer's firmware.

RT(Run Time)

After the operating system and devices are configured, the system waits for user logon. Following logon, the operating system is configured with user-specific settings. Control of the system is passed to ntoskrnl.exe. At this point, the Windows logo is displayed and ntoskrnl.exe:Loads device drivers.Starts services.Configures the OS environment. The wininit and winlogon programs run to allow user logon (at this point, the Welcome screen is displayed). Following logon, all remaining device drivers and user settings are loaded. In addition, the current configuration profile is copied to the Last Known Good Configuration registry.

Logon and user configuration

After the operating system and devices are configured, the system waits for user logon. Following logon, the operating system is configured with user-specific settings. The wininit and winlogon programs run to allow user logon. At this point, the Welcome or user logon screen is displayed. Following logon, all remaining device drivers and user settings are loaded. In addition, the current configuration profile is copied to the Last Known Good Configuration registry.

Basic Input/Output System (BIOS)

An older specification that controls much of a computer's input/output functions, such as communication with the keyboard and the monitor.

Disable Automatic Restart on System Failure

By default, Windows is configured to reboot whenever a critical system error occurs (Blue Screen of Death). When the error occurs, you will have only a short time before the system reboots. This might not be sufficient time to read and record the error information. If the error occurs while you are away from your computer, you will see a message that the system has restarted, but won't have seen the error. If the error occurs during startup, the system might continually reboot.

DXE(Driver Execution Environment)

DXE initializes configured devices, mounts drives, and prepares to boot the OS. Device drivers are loaded into memory. Hardware devices are initialized simultaneously (e.g., video card, network card, USB controllers). System drives are mounted and initialized. The EFI boot manager is initialized.

TSL(Transient System Load)

During TSL stage, the operating system loader is located and booted. The BCD store is used to identify the location of the operating system loader (for Windows, the default location is C:\Windows\system32\winload.efi). The operating system loader winload.efi is started. Winload.efi then loads the following elements:System registryNtoskrnl.exeEssential device drivers

Boot loader

During the boot loader stage, the following process occurs: On the boot device, the BIOS searches for and loads the boot code in the master boot record (MBR). The MBR is located in the first sector on the disk. The MBR boot code uses the partition table to identify the active disk partition. On the active partition, it looks for and loads the bootmgr.exe program. The bootmgr.exe program looks for the BCD store in either the C:\ directory or the System Reserved partition. The BCD store contains a list of all Windows installations on the disk. If only one installation exists, bootmgr.exe automatically loads the OS. If multiple installations exist, a list of bootable operating systems is displayed.

OS startup

During this stage, the operating system is started. The operating system configures system devices and loads necessary files. The following process occurs: The operating system loader winload.exe is started. At this stage, advanced startup options (e.g., Safe Mode) can be accessed by pressing the F8 key . Winload.exe then loads the following:System registryNtoskrnl.exeEssential device drivers Control of the system is passed to ntoskrnl.exe. At this point, the Windows logo is displayed and ntoskrnl.exe:Loads device drivers.Starts services.Configures the OS environment.

Service Fails to Start

If a service fails to start, you will see a message such as: At least one service or driver failed during system startup. Use Event Viewer to examine the event log for details. Use Event Viewer to view details about the service that did not start, then try starting the service manually. If necessary, re-enable or re-install the service.

Missing or Corrupt File

If the boot manager cannot locate needed operating system files on the selected boot partition, you might see the following errors occur: Windows could not start because the following file is missing or corrupt: <filename>Please re-install a copy of the above file. A blue screen error that describes a corrupt or missing file. This problem is caused either by a corrupt disk, corrupt files, or missing files. To correct the problem, boot the system from the installation disc and repair the system. Boot from the installation DVD (or the recovery USB). At the Welcome screen, select Repair your computer. Select Troubleshoot. Select Advanced Options. Select Startup Repair. Alternatively, you can select the Command Prompt option and then use the copy command to replace the file referenced by the error message with a known good copy.

System Does not Power on

If the system does not power on: Make sure the system is plugged in and the power strip or UPS is turned on. Check the power switch and the power type (110 or 220 volts) on the back of the power supply. If your computer is a notebook or tablet, make sure the battery is installed. Ensure that the AC adapter is plugged in. If you have just installed a new system, make sure the system case power switch is connected to the motherboard. When you turn on the computer, you should hear both the power supply fan and the CPU fan start to spin.

System Powers on, but No Display Is Visible

If the system powers on but there is nothing on the display, check the following: Verify that the monitor is connected to the computer, plugged in, and turned on. Verify that the BIOS/UEFI is configured to use the correct video adapter. Most motherboards can be configured to use either the integrated video adapter or a PCIe video adapter installed in an expansion slot. To display startup information on the screen, the computer needs at a minimum the CPU, memory, and a video card. Other components are not necessary. Verify that these three components are properly installed. If necessary, reduce the system to the three components listed above and try starting the system. If that does not work, swap out components to identify the failed component. Some computers will use a series of beeps to indicate specific problems when those messages cannot be shown on the screen. In this case, consult the motherboard documentation for the meaning of the audible messages.

Corrupt or Missing DLL or System File

If you see errors about corrupt or missing DLLs or system files, either during startup or after Windows starts, boot the system from the installation disc and repair the system. To do this: Boot from the installation DVD (or the recovery USB). At the Welcome screen, select Repair your computer. Select Troubleshoot. Select Advanced Options. Select Startup Repair. Alternatively, you can select Command Prompt and use the sfc command to run the System File Checker utility. The syntax to use with sfc is as follows: Use sfc /scannow to scan the integrity of all protected system files and repair any file that has problems. Use sfc /verifyonly to scan the integrity of all protected system files, but not repair them. Use sfc /scanfile to scan the integrity of a specific file and repair it if it has problems. Use sfc /verifyfile to scan the integrity of a specific file, but not repair it.

SEC(Security)

Immediately after the system is powered on, the SEC sequence begins. Power is supplied to the CPU. The CPU switches from 16-bit Real Mode to 64-bit Protected Mode. The CPU executes a specific set of instructions to prepare the system for PEI to run.

POST(power-on self-test)

On a system using BIOS, the following steps take place: Power is supplied to the CPU. The CPU is hard-coded to look at a special memory address that contains a pointer (or jump program), that instructs the CPU where to find the BIOS program. The CPU loads the BIOS program. The first BIOS process to run is the POST, which performs the following tasks:Verifies the integrity of the BIOS code.Tests and initializes the following hardware devices one by one:Locates, sizes, and verifies system memoryVerifies and initializes video card (output displayed on monitor)Identifies available hard disks After POST tests complete, the BIOS identifies other system devices. It uses CMOS settings and information supplied by the devices themselves to identify and configure hardware devices. Plug-and-play devices are allocated system resources. The system typically displays information about the keyboard, mouse, and SATA drives in the system. Following this summary, you will also see information about devices and system resources. The BIOS then searches for a boot drive (using the boot order specified in the CMOS).

PEI(Pre-EFI Initialization)

PEI initializes the system and prepares for the DXE. The CPU and chipset are verified and fully initialized. System memory is initialized, verified, and allocated. PEI modules are loaded to allocate system resources. The DXE is initialized and the system is prepared to transition to DXE.

Enable Safe Mode with Command Prompt

Safe Mode with Command Prompt starts the computer in Safe Mode and displays a command prompt.

Enable Safe Mode with Networking

Safe Mode with Networking is a variation of Safe Mode that also loads a network driver and protocol so the system can communicate on the network. This option is useful in situations where an updated driver needs to be downloaded from the internet and installed on the system to correct a problem.

Disable Driver Signature Enforcement

Selecting this option causes Windows to not require a digital signature when loading a driver.

BDS(Boot Device Selection)

The BDS stage runs the EFI boot manager, which identifies the system's boot configuration settings and decides how to boot the system. If an EFI System Partition (ESP) exists, the following process occurs:On the ESP in the \EFI\Microsoft directory, the boot manager looks for and runs the bootmgfw.efi file.The bootmgfw.efi looks for the BCD store in the same directory that contains a list of all Windows installations.If only one installation exists, UEFI automatically loads it. If multiple installations exist, a list of bootable operating systems is displayed. If no ESP exists, the boot manager uses Legacy BIOS mode to complete the boot sequence:The MBR looks for and loads the bootmgr.exe program.The bootmgr.exe program looks for the BCD store in either the C:\ directory or the System Reserved partition.If only one installation exists, bootmgr.exe automatically loads the OS. If multiple installations exist, a list of bootable operating systems is displayed.

Inaccessible Boot Disk

The boot loader program uses the boot configuration database (BCD) to locate valid Windows installations to start. If the database points to a location that does not include any operating system files, you will see a message similar to the following: Windows could not start because of a computer disk hardware configuration problem. Could not read from the selected boot disk. Check boot path and disk hardware. To correct the problem, boot the system from the installation disc and repair the system. Boot from the installation DVD (or the recovery USB). At the Welcome screen, select Repair your computer. Select Troubleshoot. Select Command Prompt. When the Command Prompt loads, type the following command:bootrec /RebuildBcd (The /RebuildBcd option causes the bootrec command to scan all storage devices for operating systems and add them to the BCD database.)

Corrupt Boot Sector

The boot sector (also called the volume boot record or volume boot code) is responsible for loading the operating system boot loader program (BOOTMGR). At this point in the process, the MBR has loaded, located an active partition, but there is a problem in loading the VBR, the VBR does not specify a boot loader program, or the boot loader specified in the VBR is missing or corrupt. Symptoms of a corrupt or missing boot sector include: System hangs following the BIOS information screen. Any of the following errors:Non-system disk or disk errorRemove disks or other mediaInvalid system diskInvalid media typeDisk Boot failureA disk read error occurredBOOTMGR is missingMissing GRUB/LILO To correct the problem you can check the following: Check the boot order in the BIOS/UEFI to make sure the system is booting from the correct storage device.

Corrupt MBR or Partition Table

The master boot record (MBR) is responsible for locating the system (active) partition and loading the volume boot record (VBR). A corrupt or missing master boot record or a corrupt partition table prevents the system from loading the boot record code, finding the volume boot record, and loading the boot loader program. Symptoms of a corrupt MBR or partition table include: The system hangs immediately after the BIOS information is shown. Any of the following errors:MBR corruptInvalid partition tableError loading operating systemMissing operating system To fix the problem, boot the system from the installation disc and repair the system. Boot from the installation DVD (or the recovery USB). At the Welcome screen, select Repair your computer. Select Troubleshoot. Select Command Prompt. When the Command Prompt loads, type the following command:bootrec /FixMbr (The /FixMbr option causes the bootrec command to rewrite the master boot record without overwriting the existing partition table on the disk.)

Blue Screen or System Hangs After Windows Splash Screen is Displayed

The most common cause of the errors at this stage are bad drivers or corrupt registry settings. To correct the problem, try the following (in this order): If the error includes any error codes or messages, check the Microsoft website for troubleshooting information. Boot the system into Safe Mode. In Safe Mode, rollback drivers, remove drivers, or restore to a restore point. To identify which driver is causing the problem, enable boot logging, then read the Ntbtlog.txt file to identify the last driver that the system tried to load. If you cannot boot into Safe Mode, boot into the Recovery Environment and use System Restore to restore to a restore point that was created when the system was working correctly.

Booting

The process of starting up a computer and loading an operating system.

Device Fails to Start

This message indicates that a hardware device could not be started. Begin by checking Device Manager for information about the device. If necessary, update the driver or disable the device.

Enable Boot Logging

This option creates a log file named Ntbtlog.txt in C:\Windows during startup. This file contains an entry for each driver loaded during the boot process. If the system does not complete a regular boot, you can look at this file to see the last driver to load before the failure occurred.

Enable Low-Resolution Video

This option loads Windows using your current video driver, but configures it to use low resolution settings and a slow refresh rate. This option is useful when the wrong video configuration settings have been used, causing the screen to be unreadable. Selecting this option gives you the ability to restore the correct video settings.

Enable Debugging

This option starts Windows in an advanced troubleshooting mode. This option is typically used by programmers, not system administrators.

Disable Early Launch Anti-Malware Protection

This prevents the early launch anti-malware driver from loading when the system is booted. This could increase the system's exposure to rootkit malware packages.

Launch Recovery Environment

Use this option to access system recovery tools, such as: System Restore System Image Recovery Startup Repair Command Prompt Go Back to the Previous Build

Enable Safe Mode

When a computer boots in Safe Mode, only essential drivers and services are loaded (e.g., generic mouse, monitor, base storage device, keyboard, video drivers, and the Event Log service). This allows you to troubleshoot misbehaving applications, services, and drivers.