Chapter 27: Troubleshooting Startup
Chapter 27 Troubleshooting StartupDiagnosing and correcting hardware and software problems that affect the startup process is an important troubleshooting skill. Resolving startup issues requires a clear understanding of the startup process and core operating system components.
The root cause of startup failure, including contributing factors, can stem from a variety of problems, such as user error, application faults, hardware failures, or virus activity. If the condition is serious enough, you might need to reinstall Windows XP Professional or restore files from backup media.
In x86-based systems, startup failures that occur before the operating system loader (Ntldr) starts could indicate missing or deleted files, or damage to the hard disk master boot record (MBR), partition table, or boot sector. If a problem occurs during startup, the system might have incompatible software or drivers, incompatible or improperly configured hardware, or corrupted system files.
The startup process for Itanium-based computers is similar to that of x86-based computers. For more information, see "Startup Phases for Itanium-based Systems" later in this chapter.
All computers running Windows XP Professional share the same startup sequence:
The preceding startup sequence applies to systems started or restarted after a normal shutdown, and does not apply when you bring your computer out of hibernation or standby. See "Resolving Power Management Problems on x86-based Systems" later in this chapter for more information about problems that might occur when you bring your computer out of standby or hibernation.
For Windows XP Professional to start, the system and boot partitions must contain the files listed in Table 27-1.
Table 27-1 Windows XP Professional x86-based Startup Files
In Table 27-1, the term systemroot is one of many environment variables used to associate string values, such as folder or file paths, to variables that Windows XP Professional applications and services use. For example, by using environment variables, scripts can run without modification on computers that have different configurations. To obtain a list of environment variables that you can use for troubleshooting, type set at the command line.
For more information about environment variables, see "To add or change the values of environment variables" in Windows XP Professional Help and Support Center. For more information about system files, see "System Files Reference" in this book.
Power-on Self Test
As soon as you turn on a computer, its central processing unit (CPU) begins to carry out the programming instructions contained in the basic input/output system (BIOS). The BIOS, which is a type of firmware, contains the processor dependent code that starts the computer regardless of the operating system installed. The first set of startup instructions is the power-on self test (POST). The POST is responsible for the following system and diagnostic functions:
The contents of CMOS memory remain even after you shut down the computer. Examples of hardware settings stored in CMOS memory include boot order and Plug and Play information.
After the motherboard POST completes, add-on adapters that have their own firmware (for example, video and hard drive controllers) carry out internal diagnostic tests.
To access and change system and peripheral firmware settings, consult the system documentation provided by the manufacturer.
Initial Startup Phase
After the POST, the settings that are stored in CMOS memory, such as boot order, determine the devices that the computer can use to start an operating system. For example, if the boot order specifies the floppy disk as the first startup device and the hard disk as second (some firmware displays this order as "A, C"), the following scenarios might occur at startup:
The floppy disk drive contains a floppy disk The BIOS searches the floppy disk drive for a bootable floppy disk. If one is present, the first sector (the floppy disk boot sector) loads into memory. If the floppy disk is not bootable, an error message similar to the following appears:
Non-system disk or disk error
The computer displays the preceding message until you insert a bootable floppy disk or until you remove the floppy disk and restart the computer.
The floppy disk drive does not contain a floppy disk If you restart the computer without a floppy disk, the computer reads the boot code instructions located on the master boot record (MBR). The MBR is the first sector of data on the startup hard disk and contains instructions (called boot code) and a table (called a partition table) that identify primary and extended partitions. The BIOS reads the MBR into memory and transfers control to the code in the MBR.
The computer then searches the partition table for the active partition. The first sector of the active partition contains boot code that enables the computer to do the following:
If an active partition does not exist or if boot sector information is missing or corrupt, a message similar to any of the following might appear:
Invalid partition table
If an active partition is successfully located, the code in the boot sector locates and starts Ntldr and the BIOS releases control to it.
For more information about disks and file systems, including information about the MBR, partitions, and boot sectors, see "File Systems" and "Troubleshooting Disks and File Systems" in this book.
The boot order specifies another startup device In addition to floppy disks or hard disks attached to SCSI and ATA controllers, some computer firmware can start an operating system from other devices, such as:
It is possible to specify a custom boot order, such as "CDROM, A, C". When you specify "CDROM, A, C" as a boot order, the following events occur at startup:
There are exceptions where code on bootable media transfers control to the hard disk. For example, when you start your system by using the bootable Windows XP Professional operating system CD, Setup checks the hard disk for Windows XP Professional installations. If one is found, you have the option of bypassing CDROM startup by not responding to the Press any key to boot from CD prompt that appears.
You cannot use a nonbootable CD to start your system. The presence of a nonbootable CD in the CDROM drive can add to the time the system requires to start. If you do not intend to start the system from CD, remove all CDs from the CDROM drive before restarting.
For more information about boot order options, consult your system documentation.
Boot Loader Phase
Ntldr loads startup files from the boot partition and then does the following:
Sets an x86-based processor to run in 32-bit flat memory mode An x86-based computer first starts in real mode. In real mode, the processor disables certain features in order to allow compatibility with software designed to run on 8-bit and 16-bit processors. Ntldr then switches the processor to 32-bit mode, which allows access to large amounts of memory and enables Windows XP Professional to start.
Starts the file system Ntldr contains the program code that Windows XP Professional needs to read and write to disks formatted by using the NTFS or file allocation table (FAT16 or FAT32) file systems.
Reads the Boot.ini file Ntldr parses the Boot.ini file to determine the location of the operating system boot partition. For systems that use a single-boot configuration, Ntldr initiates the hardware detection phase by starting Ntdetect.com. For multiple-boot configurations that include Windows XP Professional, Windows 2000, Windows NT 4.0, Windows 95, Windows 98, Windows Me, or MSDOS, you receive a menu of operating system choices at startup.
If you choose Windows XP Professional, Windows 2000, or Windows NT 4.0, Ntldr proceeds with the hardware detection phase. If you do not select Windows XP Professional, Windows 2000, or Windows NT 4.0, control is passed to the boot sector for the other operating system. For example, if you select Windows 95, Windows 98, Windows Me, or MSDOS, Ntldr passes control to Bootsect.dos by reading MBR code that Bootsect.dos contains. This action causes the MBR code in Bootsect.dos to execute as if the instructions were read from the disk. For more information about Boot.ini, see "Reviewing and Correcting Boot.ini Settings on x86-based Systems" later in this chapter.
Detects hardware and hardware profiles For x86-based systems, Ntldr starts Ntdetect.com, a program that performs basic device detection. Ntldr then passes Boot.ini information, as well as hardware and software data in the registry, to Ntoskrnl.exe. Ntdetect.com detects hardware profile information (for example, docked and undocked configurations for portable computers) and also checks for information stored in Advanced Configuration and Power Interface (ACPI) tables. ACPI compliant firmware enables Windows XP Professional to detect device power management features and determine device resource requirements.
For more information about ACPI, see the ACPI link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Detect and Configure Hardware Phase
After processing the Boot.ini file, Ntldr starts Ntdetect.com. For x86-based systems, Ntdetect.com collects information about installed hardware by using calls to system firmware routines. Ntdetect.com then passes this information back to Ntldr. Ntldr gathers the data received from Ntdetect.com and organizes the information into internal data structures. Ntldr then starts Ntoskrnl.exe and provides it with information obtained from Ntdetect.com.
Ntdetect.com collects the following type of hardware and device information:
Ntdetect.com plays a greater role for device enumeration in computers that are not ACPI compliant because in those computers, the firmware, not the operating system, determines the resources assigned to devices. For computers with ACPI firmware, Windows XP Professional assigns the hardware resources to use.
During this phase, Ntdetect.com searches for hardware profile information. Windows XP Professional creates a single default profile for desktop computers and creates two default profiles for portable computers. For portable computers, the operating system selects the appropriate profile based on the hardware state of the computer:
Hardware profiles are especially useful for portable computers because the hardware state of these computers is not static. Drivers for devices not listed in a particular hardware profile are not loaded during startup.
For more information about creating and using hardware profiles, see Windows XP Professional Help and Support Center. Also see article Q225810, "How to Create Hardware Profiles on Windows 2000-Based Mobile Computers," in the Microsoft Knowledge Base. To find this article, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources. Also, see "Managing Devices" and "Supporting Mobile Users" in this book.
Kernel Loading Phase
Ntldr is responsible for loading the Windows kernel (Ntoskrnl.exe) and the hardware abstraction layer (HAL) into memory. The Hal.dll file that your computer uses can vary. During installation, Windows XP Professional Setup copies one of several HAL files (see Table 27-2 for a list of these files) and renames the file Hal.dll.
To view the computer description in Device Manager
By comparing the description that Device Manager uses to the descriptions listed in Table 27-2, you can determine the HAL file that is copied to your computer from the Windows XP Professional operating system CD.
Table 27-2 Description of Different Hal.dll Files
Together, the kernel and the HAL initialize a group of software components that are called the Windows executive. The Windows executive processes the configuration information stored in registry control sets, and starts services and drivers.
For more information about Windows executive services, see "Common Stop Messages for Troubleshooting" in this book.
Control Sets Ntldr reads control set information from the HKEY_LOCAL_ MACHINE\SYSTEM registry key, which is created from information in the systemroot\System32\Config\System file, so that Ntldr can determine which device drivers need to be loaded during startup. Typically, several control sets exist, with the actual number depending on how often system configuration settings change.
Typical registry control set subkeys are:
Ntldr uses the control set identified by the Default value unless you choose the Last Known Good Configuration from the Windows Advanced Options menu.
The kernel uses the internal data structures provided by Ntldr to create the HKEY_LOCAL_MACHINE\HARDWARE key, which contains the hardware data collected at system startup. The data includes information about various hardware components and system resources allocated to each device. You can monitor the kernel load process by viewing the Starting up progress indicator that appears during startup. For more information about Last Known Good Configuration, see "Tools for Troubleshooting" in this book.
Windows XP Professional supports an extensive set of devices. New or updated drivers that are not on the Windows XP Professional operating system CD are provided by hardware manufacturers. Drivers are kernel-mode components required by devices to function within an operating system. Services are components that support operating system functions and applications. Services can run in a different context than user applications and typically do not offer many user-configurable options. Services, such as the Print Spooler, do not require a user to be logged on to run and act independently of the user who is logged on to the system. Windows XP Professional driver and service files are typically stored in the systemroot\System32 and systemroot\System32\Drivers folders and use .exe, .sys, or .dll file name extensions.
Drivers are also services. Therefore, during kernel initialization, Ntldr and Ntoskrnl.exe use the information stored in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\servicename registry subkeys to determine both the drivers and services to load. For example, Ntldr searches the Services subkey for drivers with a Start value of 0, such as hard disk controllers. After Ntldr starts Ntoskrnl.exe, an Ntoskrnl.exe component searches for and starts drivers, such as network protocols, that have a Start value of 1.
Table 27-3 lists the values (in decimal) for the Start entry. Boot drivers (those with a Start value of 0) and file system drivers are always loaded regardless of their Start value because they are required to start Windows XP Professional.
Table 27-3 Values for a <servicename> Start Entry
Table 27-4 lists some of the values (in decimal) for the Type entry.
Table 27-4 Values for a <servicename> Type Entry
Some drivers and services require that certain dependencies be met before they start. You can find dependencies listed under the DependOnGroup and DependOnService entries in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\servicename subkey for each service or driver. For more information about using dependencies to prevent or delay a driver or service from starting, see "Temporarily Disabling Services" later in this chapter. The Services subkey also contains information that affects how drivers and services are loaded, a few of which are listed in Table 27-5.
Table 27-5 Other Registry <servicename> Entries
After all entries that have Boot and Startup data types are processed, the kernel starts Session Manager. Session Manager (Smss.exe) performs important initialization functions, such as:
The Windows subsystem and the applications that run within it are user mode processes; they do not have direct access to hardware or device drivers. User-mode processes run at a lower priority than kernel-mode processes. When the operating system needs more memory, it can page to disk the memory that is used by user-mode processes. For more information about user-mode and kernel-mode components, see "Common Stop Messages for Troubleshooting" in this book.
Session Manager searches the registry for service information that is contained in the following subkeys:
The Windows subsystem starts Winlogon.exe, a system service that enables logging on and off. Winlogon.exe then does the following:
The Graphical Identification and Authentication (GINA) component collects the user name and password, and passes this information securely to the LSA for authentication. If the user supplied valid credentials, access is granted by using either the Kerberos V 5 authentication protocol or NTLM. For more information about security components, such as LSA, Kerberos V5 protocol, or NTLM, see the Distributed Systems Guide of the Microsoft® Windows® 2000 Server Resource Kit.
Winlogon initializes security and authentication components while the Service Control Manager initializes Auto-load services and drivers. After the user logs on, the following events occur:
Windows XP Professional startup is not complete until a user successfully logs on to the computer.
Plug and Play Device Detection
Plug and Play detection runs asynchronously with the logon process and relies on system firmware, hardware, device driver, and operating system features to detect and enumerate new devices. Windows XP Professional optimizes Plug and Play support for computers equipped with ACPI firmware and enables enhanced features, such as hardware resource sharing.
When Plug and Play components are well coordinated, Windows XP Professional can detect new devices, allocate system resources, and install or request drivers with minimal user intervention. ACPI features are especially useful for mobile users who use portable computers that support standby, hibernation, hot and warm docking, or undocking features.
For more information about Plug and Play device detection and system resources, see "Managing Devices" and "Supporting Mobile Users" in this book.
Power-on Self Test for Itanium-based Systems
The POST process for Itanium-based systems is similar to x86-based systems. The Extensible Firmware Interface (EFI) performs rudimentary hardware checks, similar to those performed by BIOS, and verifies that devices needed to start the system are present.
Initial Startup and Boot Manager Phase for Itanium-based Systems
After the POST finishes and before Windows XP Professional loads, the boot manager (a part of the EFI) determines the EFI drivers to use, the EFI tool set that is available to the user, and the EFI startup options to display.
The specific set of boot manager features that are available on your computer can vary from one Itanium-based system to another. Check your system documentation for information about additional tools, which might include Nvrboot.efi, Format.efi, Fdisk.efi, Diskpart.efi, and an EFI shell. These tools are either included with the EFI image or can be run from a floppy disk or other removable disks.
You might be able to use these additional tools to perform system tasks, such as restoring the boot manager startup menu, mapping disks, performing file maintenance, updating system firmware, and doing recovery operations.
To start Windows XP Professional, the boot manager performs the following tasks:
For more information about Windows XP Professional disk partitions, including a discussion about the structure of the new Itanium globally unique identifier (GUID) partition table, see Windows XP Professional Help and Support Center. Also, see in "File Systems," "Disk Management," and "Troubleshooting Disks and File Systems" this book.
Table 27-6 lists the names and locations of the startup files for Itanium-based systems. The EFI System partition is the first partition of the startup drive.
Table 27-6 Startup Files for Itanium-based Systems
Due to the differences between Itanium-based and x86-based systems, certain files required for the x86-based startup process are not required for Itanium-based computers. Table 27-7 lists x86-based files not required by Itanium-based systems.
Table 27-7 x86-based Files Not Used on Itanium-based Systems
For more information about system files, see "System Files Reference" in this book.
Kernel Loading for Itanium-based Systems
IA64ldr.efi performs a function similar to that of Ntldr for x86-based systems. IA64ldr.efi is responsible for loading the kernel (Ntoskrnl.exe) and the hardware abstraction layer (Hal.dll) into memory.
IA64ldr.efi loads control set information and uses it to initialize hardware and software components. For more information about the kernel loading phase, see "Startup Phases for x86-Based Systems" and "Kernel Loading Phase" earlier in this chapter.
Device Drivers and Services Phase for Itanium-based Systems
The processes that occur for Itanium-based systems during this phase closely resemble the processes for x86-based computers. For more information about the device drivers and services phase, see "Startup Phases for x86-based Systems" and "Kernel Loading Phase" earlier in this chapter.
Logon Phase for Itanium-based Systems
During this phase, the processes that occur for Itanium-based systems closely resemble the processes for x86-based computers. For more information about the operating system logon phase, see "Startup Phases for x86-based Systems" and "Logon Phase" earlier in this chapter.
Plug and Play Device Detection for Itanium-based Systems
The processes that occur for Itanium-based systems during this phase closely resemble the processes for x86-based computers. For more information, see "Startup Phases for x86-based Systems" and "Plug and Play Device Detection" earlier in this chapter.
Table 27-8 Summary of the Startup Process
Table 27-9 lists the files that are processed by x86-based and Itanium-based systems during the startup process. This information is useful if your organization uses Windows XP Professional on x86-based and Itanium-based computers. For example, when diagnosing a problem on an Itanium-based system, you can immediately eliminate Boot.ini and Ntdetect.com from your list of potential causes.
Table 27-9 Files Processed During Startup