Content deleted Content added
Removing notice of move discussion |
BrandonXLF (talk | contribs) Moved history and boot options from Windows Boot Manager; please see that page for attributions. Also added more about the booting process for Vista and beyond. |
||
Line 1:
{{Use mdy dates|date=April 2012}}
{{multiple issues|{{original research|date=October 2011}}
{{more citations needed|date=October 2011}}
{{technical|date=October 2011}}}}{{short description|Process by which several Microsoft Windows operating systems initialize}}
The '''booting process of Windows NT''' is the process run to start [[Windows NT]]. The process has been changed between releases, with the biggest changes being made with [[Windows Vista]]. In versions before Vista, the booting process begins when the [[BIOS]] loads the Windows NT [[bootloader]], [[NTLDR]]. Starting with Vista, the booting process begins with either the [[BIOS]] or [[UEFI]] load the [[Windows Boot Manager]], which replaces NTLDR as the bootloader. Next, the bootloader starts the [[ntoskrnl.exe|kernel]], which starts the [[Session Manager Subsystem|session manager]], which begins the [[Winlogon|login process]]. Once the user is logged in [[File Explorer]], the [[graphical user interface]] used by [[Windows NT]], is started.
== History ==
Windows Vista introduces a complete overhaul of the Windows operating system loader architecture.<ref>{{cite web |title=Inside the Windows Vista Kernel – Startup Processes |url=https://technet.microsoft.com/en-us/magazine/2007.03.vistakernel.aspx |access-date=2010-10-01 |publisher=Microsoft}}</ref><ref name="BCD">{{cite web |author=Microsoft |author-link=Microsoft |date=February 4, 2008 |title=Boot Configuration Data in Windows Vista |url=http://download.microsoft.com/download/a/f/7/af7777e5-7dcd-4800-8a0a-b18336565f5b/BCD.docx |access-date=April 18, 2015 |format=DOCX}}</ref> The earliest known reference to this revised architecture is included within [[PowerPoint]] slides distributed by [[Microsoft]] during the [[Windows Hardware Engineering Conference]] of 2004 when the operating system was codenamed "Longhorn."<ref name="Experience Longhorn">{{cite web |title=Microsoft Longhorn |url=https://longhorn.ms/ |url-status=live |archive-url=https://archive.today/20140421032626/http://longhorn.ms/ |archive-date=21 April 2014 |website=Experience Longhorn |publisher=Experience Longhorn |language=EN |ref=20}}</ref> This documentation mentions that the Windows operating system loader would be undergoing a significant restructuring in order to support [[Extensible Firmware Interface|EFI]] and to "do some major overhaul of legacy code."<ref name="Restructuring">{{cite web |last=Ritz |first=Andrew |date=2004 |title=EFI and Windows 'Longhorn' |url=http://download.microsoft.com/download/1/8/f/18f8cee2-0b64-41f2-893d-a6f2295b40c8/TW04022_WINHEC2004.ppt |archive-url=https://web.archive.org/web/20040609090303/http://download.microsoft.com/download/1/8/f/18f8cee2-0b64-41f2-893d-a6f2295b40c8/TW04022_WINHEC2004.ppt |archive-date=June 9, 2004 |access-date=April 18, 2015 |publisher=[[Microsoft]] |format=PPT}}</ref> The new boot architecture completely replaces the [[NTLDR]] architecture used in previous versions of [[Windows NT]].<ref name="BCD" />
Most of the steps that follow the [[Windows NT startup process#Loading the Windows NT kernel|NT kernel being loaded]], including kernel initialization and user-space initialization, are kept the same as in earlier NT systems.<ref name="pollard">{{cite web |author-last=de Boyne Pollard |author-first=Jonathan |title=The Windows NT 6 boot process |url=https://jdebp.eu/FGA/windows-nt-6-boot-process.html |work=Frequently Given Answers}}</ref> Refactoring in [[Winlogon]] resulted in [[Graphical identification and authentication|GINA]] being completely replaced by Credential Providers and graphical components in Windows Vista and later.<ref name=":1">{{Cite web |title=Winlogon and GINA |url=http://msdn.microsoft.com/en-us/library/aa380543.aspx |access-date=4 December 2014 |website=[[MSDN]] |publisher=[[Microsoft]]}}</ref>
== BIOS/UEFI ==
On systems with a [[BIOS]], the BIOS invokes [[Master Boot Record|MBR]] boot code from a [[hard disk drive]] at startup. The MBR boot code and the VBR boot code are OS-specific. In Microsoft Windows, the MBR boot code tries to find an [[active partition]] (the MBR is only 512 bytes), then executes the [[Volume boot record|VBR]] boot code of an active partition. The VBR boot code tries to find and execute the [[Windows Boot Manager]] from an active partition, or [[NTLDR]] for Windows XP and earlier.<ref>{{Cite web |title=Boot Sequence of Windows Multi-Boot - Multibooters.com |url=http://www.multibooters.com/guides/boot-sequence-of-mixed-windows-multiboot.html |access-date=2020-11-19 |website=www.multibooters.com}}</ref>
On systems with a [[UEFI]], the UEFI invokes <code>bootmgfw.efi</code> from an [[EFI system partition]] at startup, starting the Windows Boot Manager.
== Boot loader phase ==
{{details|NTLDR|Windows Boot Manager}}
The Windows NT startup process starts when the computer finds a ''Windows boot loader'', a portion of the Windows operating system responsible for finding Microsoft Windows and starting it up. Prior to Windows Vista, the boot loader was [[NTLDR]]. Microsoft has also released operating systems for [[Intel Itanium]] processors which use [[IA-64]] architecture. The boot loader of these editions of Windows is [[IA64ldr.efi]] (later referred as simply IA64ldr). It is an [[Extensible Firmware Interface]] (EFI) program.<ref>{{cite web |title=In Windows Server 2003, you may not be able to start a computer from a GPT disk when the computer has an Itanium processor (Revision: 2.2) |url=http://support.microsoft.com/kb/902195
=== Operating system selection ===
[[File:Windows_Boot_Manager_with_Windows_7,Vista_and_XP.png|thumb|260x260px|Windows Boot Manager (BOOTMGR) with Windows 7 highlighted and options to load Windows Vista through BOOTMGR and XP through NTLDR.]]
The boot loader, once executed, searches for Windows operating systems. Windows Boot Manager does so by reading [[Boot Configuration Data]] (BCD), a complex firmware-independent database for boot-time configuration data. Its predecessor, <code>NTLDR</code>, does so by reading the simpler <code>[[boot.ini]]</code>. If the boot.ini file is missing, the boot loader will attempt to locate information from the standard installation directory. For Windows NT and 2000 machines, it will attempt to boot from <code>C:\WINNT</code>. For Windows XP and 2003 machines, it will boot from <code>C:\WINDOWS</code>.
Both databases may contain a list of installed Microsoft operating systems that may be loaded from the local hard disk drive or a remote computer on the [[Local Area Network|local network]]. NTLDR supports operating systems installed on disks whose file system is [[NTFS]] or [[File Allocation Table|FAT]] file systems, CDFS (ISO 9660) or [[Universal Disk Format|UDFS]].<ref>{{cite web |date=October 26, 2007 |title=Unified Extended Firmware Interface support in Windows Vista (Revision: 1.5) |url=http://support.microsoft.com/kb/930061
In Windows 2000 or in later versions of Windows in which [[
Next, the boot loader looks for a list of installed operating system entries. If [[
Otherwise, the boot process continues. For Windows Vista and after, this is done through a seperate program, <code>winload.exe</code>.
=== Loading the Windows NT kernel ===
The operating system starts when certain basic drivers flagged as "Boot" are loaded into memory. The appropriate file system driver for the partition type (NTFS, FAT, or FAT32) which the Windows installation resides in is amongst them. At this point in the boot process, the boot loader clears the screen and displays a textual progress bar (which is often not seen due to the initialization speed); Windows 2000 also displays the text "Starting Windows..." underneath.
[[File:Windows_Advanced_Options_menu.png|right|thumb|NTLDR Bootloader's Advanced Option Menu]]
If the user presses F8 during this phase, the [[#Advanced options|advanced options menu]] is displayed, containing various special boot modes including [[Safe mode]], with the Last Known Good Configuration, with debugging enabled, and (in the case of Server editions) [[Directory Services Restore Mode]]. Starting with Windows Vista, this menu was changed significantly. Once a boot mode has been selected (or if F8 was never pressed) booting continues.
Hardware information about the computer is gathered by [[Ntdetect.com|NTDETECT.COM]] in Windows XP and earlier or by <code>winload.exe</code> in later versions. This information is stored in the <code>HKLM\HARDWARE\DESCRIPTION</code> key in the [[Windows Registry]].
Next the Windows NT kernel (''[[Ntoskrnl.exe]]''), the [[Hardware Abstraction Layer]] (''[[hal.dll]]''), kdcom.dll (Kernel Debugger HW Extension DLL), bootvid.dll (the Windows logo and side-scrolling bar), and config\system (one of the registry hives) are loaded.
For Windows XP and earlier, if multiple hardware configurations are defined in the Registry, the user is prompted at this point to choose one.
With the kernel in memory, boot-time device drivers are loaded (but not yet initialized). The required information (along with information on all detected hardware and Windows Services) is stored in the <code>HKEY_LOCAL_MACHINE\SYSTEM</code> portion of the registry, in a set of registry keys collectively called a ''Control Set''. In Windows XP and earlier, multiple control sets are kept, in the event that the settings contained in the currently-used one prohibit the system from booting. <code>HKEY_LOCAL_MACHINE\SYSTEM</code> contains control sets labeled <code>ControlSet001</code>, <code>ControlSet002</code>, etc., as well as <code>CurrentControlSet</code>. During regular operation, Windows uses <code>CurrentControlSet</code> to read and write information. <code>CurrentControlSet</code> is a reference to one of the control sets stored in the registry.
Windows now picks the "real" control set being used based on the values set in the <code>HKEY_LOCAL_MACHINE\SYSTEM\Select</code> registry key:
* <code>Default</code> will be the boot loader's choice if nothing else overrides this
* If the value of the <code>Failed</code> key matches <code>Default</code>, then the boot loader displays an error message, indicating that the last boot failed, and gives the user the option to try booting anyway, or to use the "Last Known Good Configuration".
Line 44 ⟶ 55:
Which services are started and the order which each group is started in are provided by the following keys:
* <code>HKLM\SYSTEM\CurrentControlSet\Services</code>
* <code>HKLM\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder</code>
For the purposes of booting, a driver may be one of the following:
# A "Boot" driver that is loaded by the boot loader prior to starting the kernel. "Boot" drivers are almost exclusively drivers for hard-disk controllers and file systems ([[AT Attachment|ATA]], [[SCSI]], file system filter manager, etc.); in other words, they are the absolute minimum that the kernel will need to get started with loading other drivers, and the rest of the operating system.
# A "System" driver which is loaded and started by the kernel after the boot drivers. "System" drivers cover a wider range of core functionality, including the display driver, CD-ROM support, and the TCP/IP stack.
# An "Automatic" driver which is loaded much later when the GUI already has been started.
With this finished, control is then passed from the boot loader to the kernel.
Line 58 ⟶ 71:
The initialization of the kernel subsystem and the Windows Executive subsystems is done in two phases.
During the first phase, basic internal memory structures are created, and each CPU's [[interrupt controller]] is initialized. The memory manager is initialized, creating areas for the file system cache, [[Paging|paged]] and non-paged pools of memory. The [[Object Manager (Windows)|Object Manager]],<ref>{{Cite web |
The second phase involves initializing the device drivers which were identified by [[NTLDR]] as being system drivers.
Line 64 ⟶ 77:
Through the process of loading device drivers, a "progress bar" is visible at the bottom of the display on Windows 2000 systems; in Windows XP and Windows Server 2003, this was replaced by an animated bar which does not represent actual progress. Prior to Windows XP, this part of the boot process took significantly longer; this is because the drivers would be initialized one at a time. On Windows XP and Server 2003, the drivers are all initialized asynchronously.
== Session Manager ==
{{details|Session Manager Subsystem}}
Once all the Boot and System drivers have been loaded, the kernel (system thread) starts the [[Session Manager Subsystem]] (<code>smss.exe</code>).
Before any files are opened, Autochk is started by ''smss.exe''.<ref>{{Cite web |title=Resource Kit |url=http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/prkd_tro_mdca.asp
At boot time, the Session Manager Subsystem:
* Creates environment variables (<code>HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment</code>)
* Starts the kernel-mode side of the Win32 subsystem (win32k.sys). This allows Windows to switch into graphical mode as there is now enough infrastructure in place.
Line 77 ⟶ 91:
* Performs any rename operations (<code>HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations</code>) that are queued up. This allows previously in-use files (e.g. drivers) to be replaced as part of a reboot.
* Executes any programs listed in <code>HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute</code> such as autocheck and convert.
* Starts the [[
The Session Manager stores its configuration at <code>HKLM\SYSTEM\CurrentControlSet\Control\Session Manager</code>. The exact operation of most of these items is based on the configuration set in the registry.
== Authentication ==
{{details|Winlogon}}
'''Winlogon''' starts the [[Local Security Authority Subsystem Service]] (LSASS) and [[Service Control Manager]] (SCM), which in turn will start all the Windows services that are set to ''Auto-Start''.<ref name="Troubleshooting">{{cite web |date=November 3, 2005 |title=Troubleshooting the Startup Process |url=https://technet.microsoft.com/en-us/library/bb457123.aspx |access-date=October 24, 2011 |work=Windows XP Resource Kit |publisher=Microsoft Technet}}</ref> It is also responsible for responding to the [[Secure attention key|secure attention sequence]] (SAS), loading the user profile on logon, and optionally locking the computer when a [[screensaver]] is running.
The login process is as follows:<ref>{{cite book |last1=Ionescu |first1=Alex |title=Windows internals. |last2=Russinovich |first2=Mark |last3=Solomon |first3=David A. |
* The Session Manager Subsystem starts <code>winlogon.exe</code>.
* Winlogon starts the Service Control Manager (<code>services.exe</code>).
** Starts the ''auto-start'' services.
** Updates the Control Sets; the LastKnownGood control set is updated to reflect the current control set.
* (Windows XP and later) Winlogon starts UIHost (<code>logonui.exe</code>), a full-screen graphical UI.
** (Windows Vista and later) Logon UI queries and loads credential provider<ref>{{Cite web |last=alvinashcraft |title=Credential Providers in Windows 10 - Win32 apps |url=https://learn.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows |access-date=2023-03-20 |website=learn.microsoft.com |language=en-us}}</ref><ref>{{cite web |title=Create Custom Login Experiences With Credential Providers For Windows Vista |url=http://msdn.microsoft.com/en-us/magazine/cc163489.aspx |access-date=13 April 2014 |work=MSDN Magazine |publisher=Microsoft Corporation}}</ref>{{Explain|date=March 2023}}
* (Windows XP and earlier) Winlogon loads [[Graphical identification and authentication|GinaDll]] (<code>msgina.dll</code>)
** (Optional) Login prompt is displayed by GINA, and the user presses the Secure Attention Sequence (SAS) ([[Control-Alt-Delete]]).
** Winlogon checks if the system is configured to log into a specific account automatically (AutoAdminLogon).
** Login dialog is displayed by GINA
** User enters credentials (username, password, and ___domain)
** GINA passes credentials back to Winlogon
* Winlogon passes credentials to LSASS
* LSASS tries to use cached data in the LSA database (SYSTEM hive)
* If there is none, LSASS determines which account protocol is to be used by using the Security Packages listed in the key <code>HKLM/SYSTEM/CurrentControlSet/Control/Lsa</code>:
** <code>msv1_0.dll</code> implements the [[NT LAN Manager]] protocols. This package is used in stand-alone systems and ___domain-member systems for backward compatibility.
** <code>Kerberos.dll</code> provides remote login by using [[Active Directory]].
* LSASS enforces the local security policy (checking user permissions, creating audit trails, doling out security tokens, etc.).
* Control is passed back to Winlogon to prepare for passing the control to the user.
** Create Windows Stations (<code>WinSta0</code>)<ref>{{cite web |title=Window Stations |url=http://msdn.microsoft.com/en-us/library/windows/desktop/ms687096%28v=vs.85%29.aspx |access-date=19 April 2014 |work=MSDN |publisher=Microsoft Corporation}}</ref>
** Create the desktops (<code>Winlogon</code>, <code>Default</code> and <code>ScreenSaver</code>)<ref>{{cite web |title=Desktops |url=http://msdn.microsoft.com/en-us/library/windows/desktop/ms682573%28v=vs.85%29.aspx |access-date=19 April 2014 |work=MSDN |publisher=Microsoft Corporation}}</ref>
** It then starts the program specified in the Userinit value which defaults to <code>userinit.exe</code>. This value supports multiple executables.
If the user is trying to log into the local host then the <code>HKLM/SAM</code> key will be used as database. If the user is trying to log into another host then the NetLogon [[Windows service|service]] is used to carry the data.<syntaxhighlight lang="text">msv1_0.dll<->netlogon<->remote netlogon<->remote msv1_0.dll<->remote SAM</syntaxhighlight>On Windows XP, GINA is only shown if the user presses the secure attention sequence.
Winlogon has support for plugins that get loaded and notified about specific events and LSASS also supports plugins (security packages). Some rootkits bundle Winlogon plugins because they are loaded before any user logs in. Some keys allow multiple comma-separated values to be supplied that allow a malicious program to be executed at the same time as a legitimate system file. The hashing algorithms used to store credentials in the [[Security Accounts Manager|SAM]] database are weak and can be brute-forced quickly on consumer hardware.
== Shell ==
{{details|File Explorer}}
Userinit is the first program that runs with the user credentials. It is responsible to start all the other programs that compose the user shell environment.
The shell program (typically <code>Explorer.exe</code>) is started from the registry entry <code>Shell=</code> pointed to by the same registry entry in key <code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot</code>; its default value is <code>SYS:Microsoft\Windows NT\CurrentVersion\Winlogon</code>, which evaluates to <code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon</code>.<ref>{{cite web |title=Different Shells for Different Users |url=http://msdn.microsoft.com/en-us/library/ms838576.aspx |access-date=16 March 2014 |publisher=Microsoft Corporation}}</ref>
* Userinit loads the user profile. There are a few types of user profiles and it can be local or remote. This process can be very slow if the user profile is of the "roaming" type.
* User and Computer [[Group Policy]] settings are applied.
** Run user scripts
** Run machine scripts
** Run <code>proquota.exe</code>
* Runs the startup programs ''before'' the shell gets started.
* Starts the shell configured in registry, which defaults to <code>explorer.exe</code>.
* Userinit exits and the shell program continues running without a parent process.
Userinit runs startup programs from the following locations:<ref name="Troubleshooting" />
* <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce</code>
* <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</code>
* <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</code>
* <code>HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load</code>
* <code>HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run</code>
* <code>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</code>
* <code>HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce</code>
* <code>%ALLUSERSPROFILE%\Start Menu\Programs\Startup\</code> (this path is localized on non-English versions of Windows before Vista)
* <code>%USERPROFILE%\Start Menu\Programs\Startup\</code> (this path is localized on non-English versions of Windows before Vista)
== Advanced options ==
With the advent of the new boot manager in [[Windows Vista]], many components have been changed; one is the Advanced Boot Options menu that provides options for advanced boot modes (e.g., Safe Mode). Due to the implementation of [[Hibernation (computing)#Microsoft Windows|fast startup]] in [[Windows 8]] and up, access to the Advanced Boot Options menu has been disabled by default. However, access is still possible with a BCD modification. These are the possible boot modes:
* Repair Your Computer - Boots [[Windows Recovery Environment]] (WinRE or Windows RE)
* Safe Mode - Loads Safe Mode, a boot mode with minimal drivers and resources intended for malware removal or replacing faulty drivers.
* Safe Mode with Networking - Loads Safe Mode along with the network drivers.
* Safe Mode with Command Prompt - Loads Safe Mode with the [[Windows Command Prompt|Command Prompt]] as the shell instead of [[Windows Explorer]]. Windows Explorer can still be loaded by typing <code>explorer</code> at the command prompt.
* Enable Boot Logging - Enables writing of <code>ntbtlog.txt</code>, a file that will log the boot process; listing drivers that loaded and drivers that did not.
* Enable low resolution video - Disables the default graphics driver and uses the standard [[VGA]] driver. Intended in case the user changed the resolution to an unusable level (i.e. 320×200 at low refresh rates <24 Hz, 60 Hz>)
* Last Known Good Configuration - Loads configuration based on the last successful boot process. Intended for [[Windows Registry|Registry]] corruptions. This mode is removed in Windows 8 and later versions of Windows.
* [[Directory Services Restore Mode]] - Boot mode used to reboot the [[Domain Controller]] in case it is not working as intended.
* Debugging Mode - Boots while loading the kernel debugger.
* Disable automatic restart on system failure - Disables the auto-reboot function after a [[Blue Screen of Death]] is experienced.
* Disable early launch anti-malware driver - ELAM prechecks boot required drivers for signatures and tampering. Disabling ELAM is intended to allow booting on false positive driver checks but could also allow a tampered driver to load.<ref>{{Cite web |last=QuinnRadich |title=Early launch antimalware - Win32 apps |url=https://docs.microsoft.com/en-us/windows/win32/w8cookbook/secured-boot |access-date=2021-12-14 |website=docs.microsoft.com |language=en-us}}</ref>
* Disable Driver Signature Enforcement - Disables the kernel setting that prohibits unsigned drivers from loading.
* Start Windows Normally
The ABO menu is accessible by rapidly pressing or holding the <code>F8</code> key before Windows boots. Starting from Windows 8 on UEFI, it can only be accessed by clicking '''Restart''' while holding the <code>Shift</code> key.
== Remote booting and installation ==
{{details|Windows Deployment Services}}
To successfully boot, the client must support [[Preboot Execution Environment|PXE]] booting and the [[Windows Deployment Services]] (WDS) [[List of Microsoft Windows components#Windows Server components|component]] must be installed on the server. It is not installed by default. WDS is the successor of [[Remote Installation Services]] (RIS).
Line 160 ⟶ 182:
PXE booting is not a technology specific to Windows and can also be used to start a Linux system. In fact, a Linux system can act as a server to service DHCP or TFTP.
PXE can be used to start Windows Setup to install the system on the client computer or to run the operating system from RAM. The latter, called Remote Boot, was introduced by Windows XP Embedded SP1<ref>{{cite web |title=Deploying Windows XP Embedded Remote Boot |url=http://msdn.microsoft.com/en-us/library/ms838569%28v=winembedded.5%29.aspx
The general process for both methods is as follows:
* PXE boots
* [[DHCP]] request broadcast *
*
* The NBP program downloads the required files through the BINL protocol
The Boot Information Negotiation Layer (BINL) is a [[Windows 2000]] [[Windows service|service]] running on the server that communicates with the client after the NBP was already loaded by the PXE.
== See also ==
* [[Architecture of Windows NT]]
Line 182 ⟶ 205:
* [[BootVis]]
== References ==
<references />
== Further reading ==
{{Refbegin}}
#{{cite book |last1=Russinovich |first1=Mark |url=https://archive.org/details/isbn_9780735619173/page/251 |title=Microsoft Windows Internals |last2=Solomon |first2=David A. |publisher=Microsoft Press |year=2005 |isbn=0-7356-1917-4 |edition=4th |pages=[https://archive.org/details/isbn_9780735619173/page/251 251–273] |chapter=Startup and Shutdown |author-link1=Mark Russinovich}}
#{{cite book |last1=Minasi |first1=Mark |url=https://archive.org/details/windowsntmagazin00john |title=Administrator's Survival Guide: System Management and Security |last2=Enck |first2=John |date=June 1998 |publisher=Windows IT Library |isbn=1-882419-88-X |chapter=Troubleshooting NT Boot Failures |access-date=February 15, 2006}}
#{{cite web |date=February 28, 2007 |title=Description of PXE Interaction Among PXE Client, DHCP, and RIS Server (Revision 2.4) |url=http://support.microsoft.com/kb/244036/ |access-date=October 24, 2011 |work=Microsoft Support |publisher=Microsoft Corporation}}
#{{Cite web |date=January 19, 2007 |title=Definition of the RunOnce Keys in the Registry (revision 2.3) |url=http://support.microsoft.com/kb/137367 |access-date=October 24, 2011 |work=Microsoft Support |publisher=Microsoft Corporation}}
#{{Cite web |date=November 28, 2007 |title=Available switch options for the Windows XP and the Windows Server 2003 Boot.ini files (revision 6.3) |url=http://support.microsoft.com/kb/833721 |access-date=October 24, 2011 |work=Microsoft Support |publisher=Microsoft Corporation}}
{{Refend}}
== External links ==
* [https://web.archive.org/web/20080820095828/http://www.sysinfo.org/startuplist.php Startup Applications List]
*[http://www.vorck.com/windows/edit-setupapi.html How to edit SETUPAPI.DLL] {{Webarchive|url=https://web.archive.org/web/20190106121821/http://www.vorck.com/windows/edit-setupapi.html |date=January 6, 2019 }}
{{Windows Components}}{{Firmware and booting}}
| |||