- Joined
- Jan 4, 2003
- Messages
- 8,039
- Reaction score
- 846
Time to time a little help is needed for people to get out of those sticky problems well below may help someo of you resolve those problems
Taken from Mr Adams post on Hexus (thankyou I hope you dont mind?)
Try these at your own risk please do not blame PCREVIEW if things go up in the air!!
Windows - boot process & simple troubleshooting
This is the (simplified) boot sequence for Windows NT, 2000, XP and 2003:
BIOS: performs Power On Self Test (POST)
BIOS: loads MBR from the boot device specified/selected by the BIOS
MBR: contains a small amount of code that reads the partition table, the first partition marked as active is determined to be the system volume
MBR: loads the boot sector from the system volume
BOOT SECTOR: reads the root directory of the system volume at loads NTLDR
NTLDR: reads BOOT.INI from the system volume to determine the boot drive (presenting a menu if more than 1 entry is defined)
NTLDR: loads and executes NTDETECT.COM from the system volume to perform BIOS hardware detection
NTLDR: loads NTOSKRNL.EXE, HAL.DLL, BOOTVID.DLL (and KDCOM.DLL for XP upwards) from the boot (Windows) volume
NTLDR: loads \WINDOWS\SYSTEM32\CONFIG\SYSTEM which becomes the system hive HKEY_LOCAL_MACHINE\System
NTLDR: loads drivers flagged as "boot" defined in the system hive, then passes control to NTOSKRNL.EXE
NTOSKRNL.EXE: brings up the loading splash screen and initializes the kernel subsystem
NTOSKRNL.EXE: starts the boot-start drivers and then loads & starts the system-start drivers
NTOSKRNL.EXE: creates the Session Manager process (SMSS.EXE)
SMSS.EXE: runs any programs specified in BootExecute (e.g. AUTOCHK, the native API version of CHKDSK)
SMSS.EXE: processes any delayed move/rename operations from hotfixes/service packs replacing in-use system files
SMSS.EXE: initializes the paging file(s) and the remaining registry hives
** before this step completes, bugchecks will not result in a memory dump as we need a working page file on the boot (Windows) volume **
SMSS.EXE: starts the kernel-mode portion of the Win32 subsystem (WIN32K.SYS)
SMSS.EXE: starts the user-mode portion of the Win32 subsystem (CSRSS.EXE)
SMSS.EXE: starts WINLOGON.EXE
WINLOGON.EXE: starts the Local Security Authority (LSASS.EXE)
WINLOGON.EXE: loads the Graphical User Identification and Authentication DLL (MSGINA.DLL by default)
WINLOGON.EXE: displays the logon window
WINLOGON.EXE: starts the services controller (SERVICES.EXE)
** at this point users can logon **
SERVICES.EXE: starts all services markes as automatic
---------
NOTES:
The SYSTEM volume is the partition from which the boot process starts, containing the MBR, boot sector, NTLDR, NTDETECT.COM & BOOT.INI
The BOOT volume is the partition which contains the Windows folder - this can be a logical partition
---------
Example 1:
2 hard disks, 0 and 1
Disk 0, partition 0 is the SYSTEM volume
Windows is installed to "D:" which is disk 1, partition 0 [even if disk 0 has an extended & logical partitions] - this is the BOOT volume
- if either disk fails or is removed, Windows cannot boot
Example 2:
1 hard disk, 2 partitions
Disk 0, partition 0 is the SYSTEM volume
Disk 0, partition 1 is the BOOT volume [D:]
- add another disk to the system and create a partition on it, this becomes D: and Windows will not boot [disk 0, partition 1 now becomes E:]
---------
Boot problems and their possible causes & resolutions:
Symptoms:
Black screen
"Invalid Partition Table"
"Error loading operating system"
"Missing operating system"
Cause:
Corrupt Master Boot Record (MBR)
Resolution:
Boot into Recovery Console and run "fixmbr" to repair the MBR
--
Symptoms:
"A disk read error occurred"
"NTLDR is missing"
"NTLDR is compressed"
Cause:
Corrupt boot sector
Resolution:
Boot into Recovery Console and run "fixboot" to repair the boot sector
--
Symptoms:
"BOOT.INI is missing or corrupt"
"Boot device inaccessible"
"Windows could not start because the following file is missing or corrupt:
\system32\hal.dll"
Cause:
BOOT.INI missing, corrupt or out of date as a partition has been inserted
Resolution:
Boot into Recovery Console and run "bootcfg /rebuild" to repair the BOOT.INI
--
Symptoms:
"Windows could not start not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM"
Cause:
Corrupt/missing system hive
Resolution:
1. Boot into Recovery Console and run "chkdsk C: /f" to check the system disk for errors and fix them, then reboot.
2. If the error continues and System Restore is enabled, copy the system hive from the last restore point into \WINDOWS\SYSTEM32\CONFIG
3. If the error continues, copy the system hive from \WINDOWS\REPAIR into \WINDOWS\SYSTEM32\CONFIG
4. If the error continues, perform a repair installation by booting from the Windows installation media
--
Symptoms:
"Windows could not start because of a computer disk hardware configuration problem.
Could not read from the selected boot disk, Check boot path and disk hardware."
Cause:
Boot volume (with Windows folder) is not accessible as defined in BOOT.INI
Resolution:
Check the boot volume is accessible
--
Symptoms:
Dual-boot 32-bit Windows and 64-bit Windows system reports "NTOSKRNL.EXE is corrupt" trying to boot into 64-bit Windows
Cause:
System volume contains an older boot loader than the boot volume requires - e.g. XP SP2 installed after XP x64
Resolution:
Copy NTDETECT.COM and NTLDR from XP x64 installation media to the root of the system volume
---------
Notes:
Not all of the above applies to Windows Vista/Longhorn, there are a few differences:
- the boot loader is different, and if the machine has a TPM 1.2 chip then BitLocker might be involved right at the start to decrypt & validate the boot code
- the boot drive will become "C:" regardless of which partition it might be (so any bootable Vista volume will refer to itself as C: even in a multi-boot environment)
- WINLOGON.EXE no longer launches SERVICES.EXE, this is handled by a separate process WININIT.EXE, as session 0 is now solely the system area and not combined with the console desktop (the first interactive logon session becomes session 1)
- the recovery options are more automated via wizards by booting from the installation DVD, common faults can be checked for automatically
__________________
Taken from Mr Adams post on Hexus (thankyou I hope you dont mind?)
Try these at your own risk please do not blame PCREVIEW if things go up in the air!!
Windows - boot process & simple troubleshooting
This is the (simplified) boot sequence for Windows NT, 2000, XP and 2003:
BIOS: performs Power On Self Test (POST)
BIOS: loads MBR from the boot device specified/selected by the BIOS
MBR: contains a small amount of code that reads the partition table, the first partition marked as active is determined to be the system volume
MBR: loads the boot sector from the system volume
BOOT SECTOR: reads the root directory of the system volume at loads NTLDR
NTLDR: reads BOOT.INI from the system volume to determine the boot drive (presenting a menu if more than 1 entry is defined)
NTLDR: loads and executes NTDETECT.COM from the system volume to perform BIOS hardware detection
NTLDR: loads NTOSKRNL.EXE, HAL.DLL, BOOTVID.DLL (and KDCOM.DLL for XP upwards) from the boot (Windows) volume
NTLDR: loads \WINDOWS\SYSTEM32\CONFIG\SYSTEM which becomes the system hive HKEY_LOCAL_MACHINE\System
NTLDR: loads drivers flagged as "boot" defined in the system hive, then passes control to NTOSKRNL.EXE
NTOSKRNL.EXE: brings up the loading splash screen and initializes the kernel subsystem
NTOSKRNL.EXE: starts the boot-start drivers and then loads & starts the system-start drivers
NTOSKRNL.EXE: creates the Session Manager process (SMSS.EXE)
SMSS.EXE: runs any programs specified in BootExecute (e.g. AUTOCHK, the native API version of CHKDSK)
SMSS.EXE: processes any delayed move/rename operations from hotfixes/service packs replacing in-use system files
SMSS.EXE: initializes the paging file(s) and the remaining registry hives
** before this step completes, bugchecks will not result in a memory dump as we need a working page file on the boot (Windows) volume **
SMSS.EXE: starts the kernel-mode portion of the Win32 subsystem (WIN32K.SYS)
SMSS.EXE: starts the user-mode portion of the Win32 subsystem (CSRSS.EXE)
SMSS.EXE: starts WINLOGON.EXE
WINLOGON.EXE: starts the Local Security Authority (LSASS.EXE)
WINLOGON.EXE: loads the Graphical User Identification and Authentication DLL (MSGINA.DLL by default)
WINLOGON.EXE: displays the logon window
WINLOGON.EXE: starts the services controller (SERVICES.EXE)
** at this point users can logon **
SERVICES.EXE: starts all services markes as automatic
---------
NOTES:
The SYSTEM volume is the partition from which the boot process starts, containing the MBR, boot sector, NTLDR, NTDETECT.COM & BOOT.INI
The BOOT volume is the partition which contains the Windows folder - this can be a logical partition
---------
Example 1:
2 hard disks, 0 and 1
Disk 0, partition 0 is the SYSTEM volume
Windows is installed to "D:" which is disk 1, partition 0 [even if disk 0 has an extended & logical partitions] - this is the BOOT volume
- if either disk fails or is removed, Windows cannot boot
Example 2:
1 hard disk, 2 partitions
Disk 0, partition 0 is the SYSTEM volume
Disk 0, partition 1 is the BOOT volume [D:]
- add another disk to the system and create a partition on it, this becomes D: and Windows will not boot [disk 0, partition 1 now becomes E:]
---------
Boot problems and their possible causes & resolutions:
Symptoms:
Black screen
"Invalid Partition Table"
"Error loading operating system"
"Missing operating system"
Cause:
Corrupt Master Boot Record (MBR)
Resolution:
Boot into Recovery Console and run "fixmbr" to repair the MBR
--
Symptoms:
"A disk read error occurred"
"NTLDR is missing"
"NTLDR is compressed"
Cause:
Corrupt boot sector
Resolution:
Boot into Recovery Console and run "fixboot" to repair the boot sector
--
Symptoms:
"BOOT.INI is missing or corrupt"
"Boot device inaccessible"
"Windows could not start because the following file is missing or corrupt:
\system32\hal.dll"
Cause:
BOOT.INI missing, corrupt or out of date as a partition has been inserted
Resolution:
Boot into Recovery Console and run "bootcfg /rebuild" to repair the BOOT.INI
--
Symptoms:
"Windows could not start not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM"
Cause:
Corrupt/missing system hive
Resolution:
1. Boot into Recovery Console and run "chkdsk C: /f" to check the system disk for errors and fix them, then reboot.
2. If the error continues and System Restore is enabled, copy the system hive from the last restore point into \WINDOWS\SYSTEM32\CONFIG
3. If the error continues, copy the system hive from \WINDOWS\REPAIR into \WINDOWS\SYSTEM32\CONFIG
4. If the error continues, perform a repair installation by booting from the Windows installation media
--
Symptoms:
"Windows could not start because of a computer disk hardware configuration problem.
Could not read from the selected boot disk, Check boot path and disk hardware."
Cause:
Boot volume (with Windows folder) is not accessible as defined in BOOT.INI
Resolution:
Check the boot volume is accessible
--
Symptoms:
Dual-boot 32-bit Windows and 64-bit Windows system reports "NTOSKRNL.EXE is corrupt" trying to boot into 64-bit Windows
Cause:
System volume contains an older boot loader than the boot volume requires - e.g. XP SP2 installed after XP x64
Resolution:
Copy NTDETECT.COM and NTLDR from XP x64 installation media to the root of the system volume
---------
Notes:
Not all of the above applies to Windows Vista/Longhorn, there are a few differences:
- the boot loader is different, and if the machine has a TPM 1.2 chip then BitLocker might be involved right at the start to decrypt & validate the boot code
- the boot drive will become "C:" regardless of which partition it might be (so any bootable Vista volume will refer to itself as C: even in a multi-boot environment)
- WINLOGON.EXE no longer launches SERVICES.EXE, this is handled by a separate process WININIT.EXE, as session 0 is now solely the system area and not combined with the console desktop (the first interactive logon session becomes session 1)
- the recovery options are more automated via wizards by booting from the installation DVD, common faults can be checked for automatically
__________________