The NT Loader

---

Windows NT loads on an Intel x86 computer by reading a file called the NTLDR or NT Loader into memory from the boot sector of the startup or active partition on your boot drive. The NTLDR is a hidden system file set to be read-only. NTLDR is located in the root folder of your system partition, and can be viewed in the Windows NT Explorer when you set the View All File Type option.




This is likely to be on the exam because by understanding the boot sequence you can detect and correct many common configuration errors that prevent users from accessing their machine.

NTLDR does the following things:

• Turns on the 32-bit flat memory model required by the Windows NT kernel to address RAM.
• Turns on the minifile system driver to access the system and boot partitions.
• Displays the Boot Loader menu system on your monitor that provides you a selection of the operating system to use. These selections are contained in the boot.ini file in your systemroot directory.

You can install Windows NT Workstation over a previous installation of MS-DOS or Windows 95. These operating systems will appear in the menu, and call the bootsect.dos file when they are loaded and executed. bootsect.dos loads and hands off at the end of the boot process to the operating system component responsible for I/O communication. In Windows 95 that file is the io.sys file.

• After you select an operating system, a hardware detection routine is initiated. For Windows NT, the NTDETECT.COM program is responsible for this routine, and creates a hardware list passed to the NTLDR program.
• The operating system kernel is then loaded. The ntoskrnl.exe file located in the %systemroot%\System32 folder is called to load the kernel of Windows NT. The menu is replaced by the OS Loader V4.00 screen.
• A blue screen appears that loads the Hardware Abstraction Layer (HAL). To execute this the hal.dll is called with a set of routines that isolate operating system functions from I/O.
• The HKEY_LOCAL_MACHINE\System hive of the Registry is read and the system is loaded. Registry hives are stored as files in the %systemroot%\System32\Config folder.
• The boot time drivers HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Control\ServiceGroupOrder are loaded. For each driver loaded, a dot is added to the OS Loader screen.

By entering the /SOS switch in the boot.ini file Windows NT will list the driver’s name in the OS Loader screen as Windows NT Workstation starts up.

• The list of supported hardware devices is handed off from ntdetect.com to ntoskrnl.exe.
• After ntoskrnl.exe executes, the computer’s boot phase finishes and the software you have installed begins to be loaded.

A RISC computer contains the NTLDR software as part of its BIOS. Therefore, the boot phase of a RISC-based computer is both simpler and faster than the boot phase of an Intel x86 computer. A RISC computer keeps its hardware configuration in its BIOS, which obviates the need for the ntdetect.com file. Another item kept in firmware is the list of any valid operating system and how to access it. This means that a RISC computer doesn’t use a boot.ini file as well.

A RISC computer boots by loading a file called the osloader.exe file. After reading the hardware configuration from the BIOS and executing, osloader.exe hands off the boot process to the ntoskrnl.exe. Then the hal.dll is loaded, followed by the system file, which ends the RISC Windows NT boot process.

Since the boot.ini file is a text file, you can edit this file to control aspects of the boot process. Open the Windows NT Explorer and remove the read-only attribute from this file (which is located in the %systemroot% top-level folder) before you begin. There are two sections to the boot.ini: the [boot loader], and [operating systems] sections.

You will see parameters that control the time a user has to decide on an operating system (timeout) as well as the default location in an ARC (Advanced RISC) compliant path nomenclature. Although you can change the default operating system and the timeout by editing the boot.ini file, you will probably find it easier to change these parameters on the Startup/Shutdown tab of the Systems Properties dialog box.

To change system startup parameters, complete the following steps:

1.	Right-click on the My Computer icon and choose the Properties command from the Shortcut menu.
2.	Click on the Startup/Shutdown tab of the Systems Properties dialog box if necessary (see Figure 7.1).
3.	Enter the operating system desired in the Startup list box.
4.	Change the timeout parameter in the Show List for … Seconds spinner.
5.	Click on the OK button.

The advantage that making changes in the Systems Properties dialog box has to editing the boot.ini file is that any mistake entering information into the boot.ini file can cause your system to fail at boot up.

When you encounter a blue screen error, you may need to employ a memory dump of your system for diagnostic purposes. A memory dump is a copy of the data held in RAM. To save that file, you need free disk space equal to your installed RAM plus an addi-tional MB of space.

To take a memory dump, check the Write debugging information to and Overwrite any existing file check boxes in the Startup/Shutdown tab of System Control Panel. Close that Control Panel and confirm any alerts about page file size should they occur. Then reboot your computer. The memory dump file is written to the location displayed in the Startup/Shutdown tab text box.