Windows Boot Manager

Last updated
Windows Boot Manager
Other namesBOOTMGR
Developer(s) Microsoft
Operating system Windows
Predecessor NTLDR
Type Bootloader
License Proprietary

The Windows Boot Manager (BOOTMGR) is the bootloader provided by Microsoft for Windows NT versions starting with Windows Vista and Windows Server 2008. It is the first program launched by the BIOS or UEFI of the computer and is responsible for loading the rest of Windows. [1] It replaced the NTLDR present in older versions of Windows.

Contents

The boot sector or UEFI loads the Windows Boot Manager (a file named BOOTMGR on either the system or the boot partition), accesses the Boot Configuration Data store and uses the information to load the operating system through winload.exe or winresume.exe. [2]

Launching

On system with BIOS firmware, the BIOS invokes MBR boot code from a hard disk drive at startup. The MBR boot code and the VBR boot code are OS-specific. In Microsoft Windows, the MBR boot code tries to find an active partition (the MBR is only 512 bytes), then executes the VBR boot code of an active partition. The VBR boot code tries to find and execute the bootmgr file from an active partition. [3]

On systems with UEFI firmware, UEFI invokes bootmgfw.efi from an EFI system partition at startup, starting the Windows Boot Manager.

Operation

Once launched the Windows Boot Manager reads the Boot Configuration Data to determine what operating systems are present and if it should present the user with a menu allowing them to select which operating system to boot. Before Windows Vista, this data was contained in boot.ini.

These menu entries can include:

Operating system loading

The operating system is loaded by individual boot loaders for each install of Windows, called the Windows Boot Loader.

winload.exe

The Windows Boot Manager invokes winload.exe—the operating system boot loader—to load the operating system kernel executive (ntoskrnl.exe) and core device drivers. In that respect, winload.exe is functionally equivalent to the operating system loader function of NTLDR in prior versions of Windows NT. In UEFI systems, the file is called winload.efi and the file is always located at \windows\system32 or \windows\system32\boot.

winresume.exe

If the computer has recently hibernated, then bootmgr will instead invoke winresume.exe. In UEFI systems, the file is called winresume.efi and is always located at \windows\system32 or \windows\system32\boot. [4]

Boot Configuration Data

Boot Configuration Data (BCD) is a firmware-independent database for boot-time configuration data. [5] It is used by Microsoft's Windows Boot Manager and replaces the boot.ini that was used by NTLDR.

Boot Configuration Data is stored in a data file that has the same format as Windows Registry hives and is eventually mounted at registry key HKEY_LOCAL_MACHINE\BCD00000 [6] (with restricted permissions [7] ). For UEFI boot, the file is located at /EFI/Microsoft/Boot/BCD on the EFI System Partition. For traditional BIOS boot, the file is at /boot/BCD on the active partition. [8]

bcdedit

bcdedit
Developer(s) Microsoft
Operating system Microsoft Windows
Type Command
License Proprietary commercial software
Website docs.microsoft.com/en-us/windows-server/administration/windows-commands/bcdedit

Boot Configuration Data may be altered using a command-line tool (bcdedit.exe), using the Registry Editor [6] (regedit.exe), using Windows Management Instrumentation, or with third-party tools such as EasyBCD, BOOTICE, [9] or Visual BCD Editor. [10]

Boot Configuration Data allows for third-party integration, so anyone can implement tools like diagnostics or recovery options

See also

Related Research Articles

<span class="mw-page-title-main">Booting</span> Process of starting a computer

In computing, booting is the process of starting a computer as initiated via hardware such as a button on the computer or by a software command. After it is switched on, a computer's central processing unit (CPU) has no software in its main memory, so some process must load software into memory before it can be executed. This may be done by hardware or firmware in the CPU, or by a separate processor in the computer system.

<span class="mw-page-title-main">Disk partitioning</span> Creation of separate accessible storage areas on a secondary computer storage device

Disk partitioning or disk slicing is the creation of one or more regions on secondary storage, so that each region can be managed separately. These regions are called partitions. It is typically the first step of preparing a newly installed disk, before any file system is created. The disk stores the information about the partitions' locations and sizes in an area known as the partition table that the operating system reads before any other part of the disk. Each partition then appears to the operating system as a distinct "logical" disk that uses part of the actual disk. System administrators use a program called a partition editor to create, resize, delete, and manipulate the partitions. Partitioning allows the use of different filesystems to be installed for different kinds of files. Separating user data from system data can prevent the system partition from becoming full and rendering the system unusable. Partitioning can also make backing up easier. A disadvantage is that it can be difficult to properly size partitions, resulting in having one partition with too much free space and another nearly totally allocated.

<span class="mw-page-title-main">Boot sector</span> Sector of a persistent data storage device

A boot sector is the sector of a persistent data storage device which contains machine code to be loaded into random-access memory (RAM) and then executed by a computer system's built-in firmware.

<span class="mw-page-title-main">GNU GRUB</span> Boot loader package

GNU GRUB is a boot loader package from the GNU Project. GRUB is the reference implementation of the Free Software Foundation's Multiboot Specification, which provides a user the choice to boot one of multiple operating systems installed on a computer or select a specific kernel configuration available on a particular operating system's partitions.

NTLDR is the boot loader for all releases of Windows NT operating system from 1993 with the release of Windows NT 3.1 up until Windows XP and Windows Server 2003. From Windows Vista onwards it was replaced by the BOOTMGR bootloader. NTLDR is typically run from the primary storage device, but it can also run from portable storage devices such as a CD-ROM, USB flash drive, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file.

<span class="mw-page-title-main">Multi-booting</span> Act of installing multiple operating systems on a single computer

Multi-booting is the act of installing multiple operating systems on a single computer, and being able to choose which one to boot. The term dual-booting refers to the common configuration of specifically two operating systems. Multi-booting may require a custom boot loader.

<span class="mw-page-title-main">Bootloader</span> Software responsible for starting the Computer and Load other software to the CPU memory

A bootloader, also spelled as boot loader or called bootstrap loader, is a computer program that is responsible for booting a computer. If it also provides an interactive menu with multiple boot choices then it's often called a boot manager.

<span class="mw-page-title-main">UEFI</span> Operating system and firmware specification

Unified Extensible Firmware Interface is a specification that defines the architecture of the platform firmware used for booting the computer hardware and its interface for interaction with the operating system. Examples of firmware that implement the specification are AMI Aptio, Phoenix SecureCore, TianoCore EDK II, InsydeH2O. UEFI replaces the BIOS which was present in the boot ROM of all personal computers that are IBM PC compatible, although it can provide backwards compatibility with the BIOS using CSM booting. Intel developed the original Extensible Firmware Interface (EFI) specification. Some of the EFI's practices and data formats mirror those of Microsoft Windows. In 2005, UEFI deprecated EFI 1.10.

<span class="mw-page-title-main">Windows Registry</span> Database for Microsoft Windows

The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. The kernel, device drivers, services, Security Accounts Manager, and user interfaces can all use the registry. The registry also allows access to counters for profiling system performance.

<span class="mw-page-title-main">GUID Partition Table</span> Computer disk partitioning standard

The GUID Partition Table (GPT) is a standard for the layout of partition tables of a physical computer storage device, such as a hard disk drive or solid-state drive, using universally unique identifiers (UUIDs), which are also known as globally unique identifiers (GUIDs). Forming a part of the Unified Extensible Firmware Interface (UEFI) standard, it is nevertheless also used for some BIOSs, because of the limitations of master boot record (MBR) partition tables, which use 32 bits for logical block addressing (LBA) of traditional 512-byte disk sectors.

ntdetect.com is a component of Microsoft Windows NT-based operating systems that operate on the x86 architecture. It is used during the Windows NT startup process, and is responsible for detecting basic hardware that will be required to start the operating system.

The Logical Disk Manager (LDM) is an implementation of a logical volume manager for Microsoft Windows NT, developed by Microsoft and Veritas Software. It was introduced with the Windows 2000 operating system, and is supported in Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows 8, Windows 10 and Windows 11. The MMC-based Disk Management snap-in hosts the Logical Disk Manager. On Windows 8 and Windows Server 2012, Microsoft deprecated LDM in favor of Storage Spaces.

A volume boot record (VBR) is a type of boot sector introduced by the IBM Personal Computer. It may be found on a partitioned data storage device, such as a hard disk, or an unpartitioned device, such as a floppy disk, and contains machine code for bootstrapping programs stored in other parts of the device. On non-partitioned storage devices, it is the first sector of the device. On partitioned devices, it is the first sector of an individual partition on the device, with the first sector of the entire device being a Master Boot Record (MBR) containing the partition table.

<span class="mw-page-title-main">EFI system partition</span> Partition used by Unified Extensible Firmware Interface

The EFIsystem partition or ESP is a partition on a data storage device that is used by computers that have the Unified Extensible Firmware Interface (UEFI). When a computer is booted, UEFI firmware loads files stored on the ESP to start operating systems and various utilities.

The booting process of Microsoft Windows varies between different releases.

The Linux booting process involves multiple stages and is in many ways similar to the BSD and other Unix-style boot processes, from which it derives. Although the Linux booting process depends very much on the computer architecture, those architectures share similar stages and software components, including system startup, bootloader execution, loading and startup of a Linux kernel image, and execution of various startup scripts and daemons. Those are grouped into 4 steps: system startup, bootloader stage, kernel stage, and init process. When a Linux system is powered up or reset, its processor will execute a specific firmware/program for system initialization, such as Power-on self-test, invoking the reset vector to start a program at a known address in flash/ROM, then load the bootloader into RAM for later execution. In personal computer (PC), not only limited to Linux-distro PC, this firmware/program is called BIOS, which is stored in the mainboard. In embedded Linux system, this firmware/program is called boot ROM. After being loaded into RAM, bootloader will execute to load the second-stage bootloader. The second-stage bootloader will load the kernel image into memory, decompress and initialize it then pass control to this kernel image. Second-stage bootloader also performs several operation on the system such as system hardware check, mounting the root device, loading the necessary kernel modules, etc. Finally, the very first user-space process starts, and other high-level system initializations are performed.

The BIOS boot partition is a partition on a data storage device that GNU GRUB uses on legacy BIOS-based personal computers in order to boot an operating system, when the actual boot device contains a GUID Partition Table (GPT). Such a layout is sometimes referred to as BIOS/GPT boot.

<span class="mw-page-title-main">EasyBCD</span> Software for Microsoft Windows

EasyBCD is a program developed by NeoSmart Technologies to configure and tweak the Boot Configuration Data (BCD), a boot database first introduced in Windows Vista and used in all subsequent Windows releases. EasyBCD can be used to set up multi-boot environments for computers on which some versions of Windows, Linux, BSD and Mac OS X can be simultaneously installed; EasyBCD can also be used for adding entries to bootable tools and utilities, as well as modifying and controlling the behavior of the Windows boot menu. EasyBCD 2.3 introduced additional support for creating and managing entries for UEFI-based Windows entries in the boot menu. As of June 20, 2011 with the release of EasyBCD 2.1, it is no longer free for use in commercial environments which require the purchase of a paid license, however it remains free for home and non-profit use without limitations.

A master boot record (MBR) is a special type of boot sector at the very beginning of partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept of MBRs was publicly introduced in 1983 with PC DOS 2.0.

In Linux, and other Unix-like operating systems, the /boot/ directory holds files used in booting the operating system. The usage is standardized in the Filesystem Hierarchy Standard.

References

  1. barrygolden. "Boot and UEFI - Windows drivers". learn.microsoft.com. Retrieved 2023-03-20.
  2. de Boyne Pollard, Jonathan. "The Windows NT 6 boot process". Frequently Given Answers. Archived from the original on August 26, 2016.
  3. "Boot Sequence of Windows Multi-Boot - Multibooters.com". www.multibooters.com. Retrieved 2020-11-19.
  4. Hudek, Ted; Marshall, Don; Graf, Eliot (23 April 2019). "Overview of Boot Options in Windows". Microsoft Docs Hardware Dev Center. Microsoft. Archived from the original on 21 April 2020. Retrieved 21 April 2020.
  5. Marshall, Don. "Overview of Boot Options in Windows - Windows drivers". learn.microsoft.com. Retrieved 2023-03-20.
  6. 1 2 Russinovich, Mark (8 November 2011). "Fixing Disk Signature Collisions". Mark's Blog. Microsoft Corporation. Microsoft TechNet. Retrieved 5 February 2021.
  7. "Why can't I edit the system BCD store via regedit?".
  8. Microsoft. "Knowledge Base Article ID: 2004518". Archived from the original on 16 January 2010.
  9. Pauly. "BOOTICE board index". Archived from the original on 2013-12-28. Retrieved 2013-12-27.
  10. Bo Yans. "Visual BCD Editor".

Further reading