NTLDR

Last updated

NTLDR (abbreviation of NTloader) is the boot loader for all releases of Windows NT operating system from 1993 with the release of Windows NT 3.1 up until Windows XP and Windows Server 2003. From Windows Vista onwards it was replaced by the BOOTMGR bootloader. NTLDR is typically run from the primary storage device, but it can also run from portable storage devices such as a CD-ROM, USB flash drive, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file.

Contents

NTLDR requires, at the minimum, the following two files to be on the system volume:

An additional important file is boot.ini, which contains boot configuration (if missing, NTLDR will default to \Windows on the first partition of the first hard drive).

NTLDR is launched by the volume boot record of system partition, which is typically written to the disk by the Windows FORMAT or SYS command.

History

Windows NT was originally designed for ARC-compatible platforms, relying on its boot manager support and providing only osloader.exe, a loading program accepting ordinary command-line arguments specifying Windows directory partition, location or boot parameters, which is launched by ARC-compatible boot manager when a user chooses to start specific Windows NT operating system. However, because the x86 lacked any of the ARC support, the additional layer was added specifically for that platform: custom boot manager code presenting text menu allowing the user to choose from one or more operating system and its options configured in boot.ini configuration file, prepended by special StartUp module which is responsible for some preparations such as switching the CPU to the protected mode. When a user chooses an operating system from the boot menu, the following command-line arguments are then passed to the part of the osloader.exe common to all processor architectures:

'''load''' '''osloader'''=''<Windows Path>''\System32\NTLDR '''systempartition'''=''<Windows Partition>'' '''osloadpartition'''=''<Windows Partition>'' '''osloadoptions'''=''<Windows Boot Parameters>'' '''consolein'''=multi(0)key(0)keyboard(0) '''consoleout'''=multi(0)video(0)monitor(0) '''x86systempartition'''=''<NTLDR partition>''

In Windows releases starting from Windows Vista and Windows Server 2008, NTLDR has been split off back to its boot manager and system loader parts: the Windows Boot Manager and winload.exe . The boot manager part has been completely rewritten; it no longer uses boot.ini as a configuration file, although the bootcfg utility for modifying boot.ini is still present for the case of multi-boot configurations with Windows versions up to Windows XP and Windows Server 2003.

Command-line interface

bootsect
Developer(s) Microsoft
Operating system Microsoft Windows
Type Command
License Proprietary commercial software
Website Bootsect Command-Line Options

The bootsect.exe utility program in the Windows PE tools has options /nt52 (NTLDR) and /nt60 (Vista and up) to store a NTLDR or Vista boot record in the first sector of a specified partition. [1] The command can be used for FAT and NTFS based file systems. It replaces the FixFAT and FixNTFS tools. [2]

Example

The following example applies the NTLDR compatible master boot code to the D: volume: [2]

C:\>bootsect /nt52 D: 

Startup process

When a PC is powered on its BIOS follows the configured boot order to find a bootable device. This can be a harddisk, floppy, CD/DVD, network connection, USB-device, etc. depending on the BIOS. In the case of a floppy the BIOS interprets its boot sector (first sector) as code, for NTLDR this could be a NTLDR boot sector looking for the ntldr file on the floppy. For a harddisk the code in the Master Boot Record (first sector) determines the active partition. The code in the boot sector of the active partition could then be again a NTLDR boot sector looking for ntldr in the root directory of this active partition. In a more convoluted scenario the active partition can contain a Vista boot sector for the newer Vista boot manager with an {ntldr} entry pointing to another partition with a NTLDR boot sector. [3]

When booting, the loader portion of NTLDR does the following in order:

  1. Accesses the file system on the boot drive (either FAT or New Technology File System, NTFS).
  2. If Windows was put in the hibernation state, the contents of hiberfil.sys are loaded into memory and the system resumes where it left off.
  3. Otherwise, reads boot.ini and prompts the user with the boot menu accordingly.
  4. If a non NT-based OS is selected, NTLDR loads the associated file listed in boot.ini (bootsect.dos if no file is specified or if the user is booting into a DOS based OS) and gives it control.
  5. If an NT-based OS is selected, NTLDR runs ntdetect.com , which gathers information about the computer's hardware. (If ntdetect.com hangs during hardware detection, there is a debug version called ntdetect.chk that can be found on Microsoft support. [4] )
  6. Starts Ntoskrnl.exe , passing to it the information returned by ntdetect.com. [5]

boot.ini

NTLDR's first action is to read the boot.ini file. [6] NTLDR allows the user to choose which operating system to boot from at the menu. For NT and NT-based operating systems, it also allows the user to pass preconfigured options to the kernel. The menu options are stored in boot.ini, which itself is located in the root of the same disk as NTLDR. Though NTLDR can boot DOS and non-NT versions of Windows, boot.ini cannot configure their boot options.

For NT-based OSs, the location of the operating system is written as an Advanced RISC Computing (ARC) path.

boot.ini is protected from user configuration by having the following file attributes: system, hidden, read-only. To manually edit it, the user would first have to remove these attributes. A more secure fashion to edit the file is to use the bootcfg command from a console. bootcfg will also relock the file (setting the file back to system, hidden, and read-only). Additionally, the file can be edited within Windows using a text editor if the folder view option "Show hidden files and folders" is selected, the folder view option "Hide protected operating system files" is unchecked, and the "Read-only" option is unchecked under the file's properties.

bootsect.dos is the boot sector loaded by NTLDR to load DOS, or if there is no file specified when loading a non NT-based OS.

Example

An example of a boot.ini file:

[boot loader]timeout=40default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

If the boot loader timeout option in boot.ini is set to 0, the NTLDR boot menu does not appear. Extreme caution should be taken when modifying the boot loader, as erroneous information can result in an OS that fails to boot.

NT kernel switches

NTLDR Bootloader's Advanced Option Menu Windows Advanced Options menu.png
NTLDR Bootloader's Advanced Option Menu

See also

Related Research Articles

<span class="mw-page-title-main">Windows 9x</span> Series of Microsoft Windows computer operating systems

Windows 9x is a generic term referring to a series of Microsoft Windows computer operating systems produced from 1995 to 2000, which were based on the Windows 95 kernel and its underlying foundation of MS-DOS, both of which were updated in subsequent versions. The first version in the 9x series was Windows 95, which was succeeded by Windows 98 and then Windows Me, which was the third and last version of Windows on the 9x line, until the series was superseded by Windows XP.

<span class="mw-page-title-main">Multi-booting</span> Act of installing multiple operating systems on a single computer

Multi-booting is the act of installing multiple operating systems on a single computer, and being able to choose which one to boot. The term dual-booting refers to the common configuration of specifically two operating systems. Multi-booting may require a custom boot loader.

The Installable File System (IFS) is a filesystem API in MS-DOS/PC DOS 4.x, IBM OS/2 and Microsoft Windows that enables the operating system to recognize and load drivers for file systems.

<span class="mw-page-title-main">Windows Registry</span> Database for Microsoft Windows

The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. The kernel, device drivers, services, Security Accounts Manager, and user interfaces can all use the registry. The registry also allows access to counters for profiling system performance.

<span class="mw-page-title-main">Architecture of Windows NT</span> Overview of the architecture of the Microsoft Windows NT line of operating systems

The architecture of Windows NT, a line of operating systems produced and sold by Microsoft, is a layered design that consists of two main components, user mode and kernel mode. It is a preemptive, reentrant multitasking operating system, which has been designed to work with uniprocessor and symmetrical multiprocessor (SMP)-based computers. To process input/output (I/O) requests, it uses packet-driven I/O, which utilizes I/O request packets (IRPs) and asynchronous I/O. Starting with Windows XP, Microsoft began making 64-bit versions of Windows available; before this, there were only 32-bit versions of these operating systems.

As the next version of Windows NT after Windows 2000, as well as the successor to Windows Me, Windows XP introduced many new features but it also removed some others.

ntdetect.com is a component of Microsoft Windows NT-based operating systems that operate on the x86 architecture. It is used during the Windows NT startup process, and is responsible for detecting basic hardware that will be required to start the operating system.

In computing, bootcfg is a command on Microsoft Windows NT-based operating systems which acts as a wrapper for editing the boot.ini file.

ntoskrnl.exe, also known as the kernel image, contains the kernel and executive layers of the Microsoft Windows NT kernel, and is responsible for hardware abstraction, process handling, and memory management. In addition to the kernel and executive layers, it contains the cache manager, security reference monitor, memory manager, scheduler (Dispatcher), and blue screen of death.

<span class="mw-page-title-main">Task Manager (Windows)</span> Task manager application included with the Windows NT family of operating systems

Task Manager, previously known as Windows Task Manager, is a task manager, system monitor, and startup manager included with Microsoft Windows systems. It provides information about computer performance and running software, including name of running processes, CPU and GPU load, commit charge, I/O details, logged-in users, and Windows services. Task Manager can also be used to set process priorities, processor affinity, start and stop services, and forcibly terminate processes.

<span class="mw-page-title-main">Recovery Console</span> Microsoft Windows feature

The Recovery Console is a feature of the Windows 2000, Windows XP and Windows Server 2003 operating systems. It provides the means for administrators to perform a limited range of tasks using a command-line interface.

The Session Manager Subsystem, or smss.exe, is a component of the Microsoft Windows NT family of operating systems, starting in Windows NT 3.1. It is executed during the startup process of those operating systems.

<span class="mw-page-title-main">Windows Boot Manager</span> Boot process used in modern Windows NT-based products

The Windows Boot Manager (BOOTMGR) is the bootloader provided by Microsoft for Windows NT versions starting with Windows Vista and its server counterpart. It is the first program launched by the BIOS or UEFI of the computer and is responsible for loading the rest of Windows. It replaced the NTLDR present in older versions of Windows.

There are a number of security and safety features new to Windows Vista, most of which are not available in any prior Microsoft Windows operating system release.

The booting process of Microsoft Windows varies between different releases.

Windows Vista has many significant new features compared with previous Microsoft Windows versions, covering most aspects of the operating system.

<span class="mw-page-title-main">EasyBCD</span> Software for Microsoft Windows

EasyBCD is a program developed by NeoSmart Technologies to configure and tweak the Boot Configuration Data (BCD), a boot database first introduced in Windows Vista and used in all subsequent Windows releases. EasyBCD can be used to set up multi-boot environments for computers on which some versions of Windows, Linux, BSD and Mac OS X can be simultaneously installed; EasyBCD can also be used for adding entries to bootable tools and utilities, as well as modifying and controlling the behavior of the Windows boot menu. EasyBCD 2.3 introduced additional support for creating and managing entries for UEFI-based Windows entries in the boot menu. As of June 20, 2011 with the release of EasyBCD 2.1, it is no longer free for use in commercial environments which require the purchase of a paid license, however it remains free for home and non-profit use without limitations.

A System Deployment Image is a file format used primarily with Microsoft products to contain an arbitrary disk image, including boot sector information.

<span class="mw-page-title-main">Windows Setup</span> Installer that prepares a hard disk drive for a Microsoft Windows operating system installation

Windows Setup is an installer that prepares a computer for a Microsoft Windows installation by allowing the user to pick installation settings and copying the files to the drive.

Windows NT is a proprietary graphical operating system produced by Microsoft as part of its Windows product line, the first version of which was released on July 27, 1993, and it lives on today since the latest version of Windows, 11, includes its technology.

References

  1. "Bootsect Command-Line Options". Windows Vista: Technical Reference. Microsoft Technet. 2009. Retrieved 2011-07-03.
  2. 1 2 "MS-DOS and Windows command line bootsect command".
  3. "Boot Configuration Data Editor Frequently Asked Questions". Windows Server. Microsoft Learn. 2007. Retrieved 2024-01-04.
  4. "Ntdetect.com (Installd.cmd)". Microsoft . Archived from the original on 2006-02-06.
  5. Microsoft (2000). Windows 2000 Professional Resource Kit (1st ed.). Redmond, WA: Microsoft Press. ISBN   1-57231-808-2.
  6. Rick Maybury (2009). "Startup and Shutdown Problems, part 1". Bootcamp. Archived from the original on 2012-07-11. Retrieved 25 April 2012.{{cite web}}: CS1 maint: unfit URL (link)
  7. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 Microsoft (November 28, 2007). "Available switch options for the Windows XP and the Windows Server 2003 Boot.ini files" . Retrieved January 4, 2024.
  8. 1 2 3 4 5 6 7 8 9 10 11 12 Russinovich, Mark (November 1, 2006). "Boot INI Options Reference". Microsoft Learn. Microsoft. Retrieved January 4, 2023.
  9. "Loss of DirectDraw Overlay and VMR9 after upgrade/update". VideoHelp Forum. July 2008.
  10. "/burnmemory (Windows Drivers". Boot.ini Boot Parameter Reference. Microsoft. Archived from the original on 2013-01-10.
  11. 1 2 3 4 5 "A description of the Safe Mode Boot options in Windows XP". Microsoft Support. Archived from the original on 2015-02-19.
  12. "Programs that use the QueryPerformanceCounter function may perform poorly". Microsoft Support. 23 February 2023.