The Load Process

The Load Process

After the boot portion of the operating system loads, your device drivers are loaded and the boot process is handed off to the operating system kernel. In Windows NT, this portion of the startup occurs when the screen turns a blue color and the text shrinks. At that point, the kernel is initializing. The operating system begins to read various hives in the Windows NT Registry. One of the first hives read is the CurrentControlSet, which is copied to the CloneControlSet and from which a HARDWARE key is written to RAM. The System hive is read to determine whether any other additional drivers need to be loaded into RAM and initialized. This ends the kernel initialization phase.

The Session Manager then reads the System hive in the Registry to determine which programs are required prior to Windows NT itself being loaded. Commonly the AUTOCHK.EXE program (a stripped down version of CHKDSK.EXE) runs and reads the file system. Other programs defined in the HKEY_LOCAL_MACHINE\ SYSTEM\CurrentControlSet\Control\SessionManager\BootExecute key are run, and a page file is then created in the location stored in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Control\Session Manager\Memory Management key. The Software hive is read, and the Session Manager then loads other required subsystems as defined in the HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Control\SessionManager\Subsystems\Required key. This ends the portion of the boot process where services are loaded into RAM.

The Windows NT Resource Kit contains a more detailed description of the boot process than that presented here. That kit also contains some additional tools for determining which drivers have loaded, and other diagnostic functions.

After services are loaded, the Windows WIN32 Subsystem starts to load. This is where Windows NT Workstation switches into a Graphics (GUI) mode. The WINLOGON module runs and the Welcome dialog box appears. The Windows operating system is still loading at this point, but the user can enter his user name, domain, and password to initiate the logon process. After the Service Controller (SERVICES.EXE) loads and initializes the Computer Browser, Workstation, Server, Spooler, and so on, the request for logon is passed to the domain controller for service.

The SERVICES.EXE program is a central program in the Windows NT operating system. It initializes various system DLL files. Should this file be damaged, you must reinstall Windows NT Workstation.

The following DLLs provide operating system services:

Alerter (alrsvc.dll). Provides messaging services and event alerts.
Computer Browser (browser.dll). Provides a way for locating resources on the network.
EventLog (eventlog.dll). Notes and enters events into the three log files.
Messenger (msgsvc.dll). Provides interapplication communications that enable one application to communicate with another.
Net Logon (netlogon.dll). Has the code required to request resource validation from domain servers.
NT LM Security Support Provider (ntmssos.dll). Provides security support.
Server (srvsvc.dll). Enables Windows NT Workstation to provide limited network services to other computers.
TCP/IP NetBIOS Helper (lmhsvc.dll). Handles IP address resolution.
Workstation (wkssvc.dll). Enables a Windows NT Workstation computer to access resources on the network. Workstation includes services that enable the computer to log on to a domain, to connect to shared resources such as printers and directories, and to participate in client/server applications running over the network.

A successful logon is considered the completion of the boot process. To mark the event, Windows NT Workstation updates the LastKnownGood control set key in the Registry with information about what got loaded and the current system configuration at startup.