NTLDR is typically run from the primarystorage device, but it can also run from portable storage devices such as aCD-ROM,USB flash drive, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriateboot sector in a file.
NTLDR requires, at a minimum, the following two files to be on thesystem volume:
ntldr, the main boot loader itself
NTDETECT.COM, required for booting an NT-based OS, detects basic hardware information needed for successful boot
An additional important file isboot.ini, which contains boot configuration (if missing, NTLDR will default to\Windows on the first partition of the first hard drive). On non-English versions of NTLDR, it may also loadbootfont.bin; this is not the case for BOOTMGR.
NTLDR is launched by thevolume boot record of system partition, which is typically written to the disk by the WindowsFORMAT orSYS command.
Windows NT was originally designed forAdvanced RISC Computing (ARC) platforms, relying on its boot manager support and providing onlyosloader.exe, a loading program accepting ordinary command-line arguments specifying Windows directory partition, location or boot parameters, which is launched by an ARC-compatible boot manager when a user chooses to start a specific Windows NT operating system. However, becauseIBM PC compatible machines lacked any kind of ARC support (as they predate the creation of the ARC specification), an additional layer was added specifically for that platform: a custom boot manager code presenting a text-based menu allowing the user to choose from one or more operating systems and its options configured in aboot.ini configuration file, prepended by a special StartUp module which is responsible for some preparations such as switching theCPU to protected mode.
When a user chooses an operating system from the boot menu, the following command-line arguments are then passed to the part of theosloader.exe common to all processor architectures:
In Windows releases starting from Windows Vista andWindows Server 2008, NTLDR was split off into two parts:Windows Boot Manager for the boot manager andwinload.exe for the system loader. The boot manager part has been completely rewritten; it no longer usesboot.ini as a configuration file, although thebootcfg utility for modifyingboot.ini is still present in the case ofmulti-boot configurations with Windows versions up to Windows XP and Windows Server 2003.
Thebootsect.exe utility program in theWindows PE tools has options (/nt52 (NTLDR) and/nt60 (Vista and up)) to store a NTLDR or Vista boot record in the first sector of a specified partition.[1] Thecommand can be used forFAT andNTFS basedfile systems. It replaces the FixFAT and FixNTFS tools.[2]
When a PC is powered on itsBIOS follows the configured boot order to find a bootable device. This can be a harddisk, floppy, CD/DVD, network connection, USB-device, etc. depending on the BIOS. In the case of a floppy the BIOS interprets its boot sector (first sector) as code, for NTLDR this could be a NTLDR boot sector looking for thentldr file on the floppy. For a harddisk the code in theMaster Boot Record (first sector) determines the active partition. The code in the boot sector of the active partition could then be again a NTLDR boot sector looking forntldr in the root directory of this active partition. In a more convoluted scenario the active partition can contain a Vista boot sector for the newer Vista boot manager with an {ntldr} entry pointing to another partition with a NTLDR boot sector.[3]
When booting, the loader portion of NTLDR does the following in order:
Accesses the file system on the boot drive (eitherFAT or New Technology File System,NTFS).
If Windows was put in the hibernation state, the contents ofhiberfil.sys are loaded into memory and the system resumes where it left off.
Otherwise, readsboot.ini and prompts the user with the boot menu accordingly.
If a non NT-based OS is selected, NTLDR loads the associated file listed inboot.ini (bootsect.dos if no file is specified or if the user is booting into a DOS based OS) and gives it control.
If an NT-based OS is selected, NTLDR runsntdetect.com, which gathers information about the computer's hardware. (Ifntdetect.com hangs during hardware detection, there is a debug version calledntdetect.chk that can be found on Microsoft support.[4])
Startsntoskrnl.exe, passing to it the information returned byntdetect.com.[5]
NTLDR's first action is to read theboot.ini file.[6] It allows the user to choose which operating system to boot from at the menu. For NT and NT-based operating systems, it also allows the user to pass preconfigured options to the kernel. The menu options are stored inboot.ini, which itself is located in the root of the same disk as NTLDR. Though NTLDR can boot DOS and non-NT versions of Windows,boot.ini cannot configure their boot options.
For NT-based OSs, the location of the operating system is written as an ARC path.bootsect.dos is the boot sector loaded by NTLDR to load DOS, or if there is no file specified when loading a non NT-based OS.
boot.ini is protected from user configuration by having the followingfile attributes: system, hidden, read-only. To manually edit it, theuser would first have to remove these attributes.A more secure fashion to edit the file is to use thebootcfg command from a console.bootcfg will also relock the file (setting the file back to system, hidden, and read-only). Additionally, the file can be edited within Windows using a text editor if the folder view option "Show hidden files and folders" is selected, the folder view option "Hide protected operating system files" is unchecked, and the "Read-only" option is unchecked under the file's properties. Extreme caution should be taken when modifyingboot.ini, as erroneous information can result in an OS that fails to boot.
An example of aboot.ini file, extracted from a working Windows XP Professional installation:
[boot loader]timeout=30default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional"/fastdetect
Note: If the boot loader timeout option inboot.ini is set to 0, the NTLDR boot menu does not appear. This happens especially on multi-booted systems; the boot menu also does not appear when only one operating system is installed, like the example above, even if the timeout option is set into any other value other than 0.
Note: Unless otherwise stated, the following kernel switches apply to both Windows XP and Windows Server 2003 as well as prior versions of Windows NT.
/3GB – Option used only on 32-bitx86-based systems that allocates 3 GB for the user-mode address space and 1 GB for the system-mode (or kernel-mode) address space (more than that of the 2 GB allocation used for both user-mode and system/kernel-mode address spaces). It is intended for programs that can take advantage of the additional memory address space, such as certain Windows Server 2003 andMicrosoft Exchange Server 2003 configurations.[7][8] Activating this option however may break VMR-9 video;[9] it may also cause audio problems with certainSound Blaster X-Fi sound cards (X-Fi Gamer / X-Fi Titanium @ WINXP 32-bit 3/2012) due to the way thatCreative's drivers handle memory over 2 GB.[10][11]
/BASEVIDEO – Starts Windows in "VGA mode", where a VGA-compatibledisplay driver is used with a 16-color,640 × 480 resolution.[8] This can be used to recover from configuration problems with certain display drivers; the/SOS switch can be used in conjunction with the/BASEVIDEO switch to help diagnose display driver failures on startup (this is the case forWindows NT 4.0 for the "VGA mode" option in the boot menu, which has both/BASEVIDEO and/SOS switches enabled).[7]
/BAUDRATE=nnn – Specifies thebaud rate for the debug port used by thekernel debugger, overriding the default value (9600–19200 Kbps with amodem and 115200 Kbps with anull modem). Enabling this option underboot.ini automatically enables kernel debugging with the/DEBUG switch.[7][8]
/BOOTLOG – Writes a log of the boot process to the file%SystemRoot%\Ntbtlog.txt for diagnostic purposes.[7][8] It is set by default for certainSafe Mode options.
/BOOTLOGO – Displays a custom640 × 480 16-colorbitmap instead of the default graphical boot screen on startup. This file is located in%SystemRoot%\Windows and is namedboot.bmp. It is used in conjunction with the/NOGUIBOOT switch; the custom bitmap will not display properly without it.[8]
/BURNMEMORY=nnn – Decreases the amount of memory that Windows can use (e.g./BURNMEMORY=128 on a system using 512 MB of memory would take out 128 MB of memory from within Windows, making it only use 384 MB of memory).[7][8]
/CHANNEL=nn – Used when debugging through theIEEE 1394 port (using/DEBUGPORT=1394), to specify channels where the kernel debugger can communicate with.[7][8]
/CLKLVL – Sets the HAL to use level-sensitive clocks settings rather than edge-triggered clock settings forhardware interrupts.[8]
/CRASHDEBUG – Loads the kernel debugger on startup, to be used when the system crashes.[8]
/DEBUG – Enables debugging at the kernel level.[7][8]
/DEBUGPORT=comx – Specifies a port used for kernel-mode debugging. Supports serial and (in Windows XP and Windows Server 2003 only)IEEE 1394 ports for use with debugging.[8][7]
/FASTDETECT[:comx[,comy]] – Disables serial and bus mouse detection inNTDETECT.COM. Otherwise serial and bus mouse detections are performed if the/FASTDETECT switch is excluded. Set by default onWindows 2000 onwards.[7][8]
/HAL=filename – Sets a different HAL to use.[8][7]
/INTAFFINITY – Makes the HAL set hardware interrupts to only the highest numbered processor on multiprocessor systems.[8]
/KERNEL=filename – Sets a different kernel image to use.[8][7]
/MAXMEM=nnn – Sets the maximum amount of memory that Windows can use (e.g./MAXMEM=64 makes Windows use 64 MB of memory even if the computer has 512 MB or more memory)./MAXMEM does not account formemory leaks;/BURNMEMORY is recommended for those use cases instead.[7]
/MININT – Option used for Windows PE. Changes theHKLM\SYSTEM key in theWindows Registry to be non-persistent so that any changes made to the key are not saved when the system shuts down.[8]
/NODEBUG – Disables debugging at the kernel level.[7]
/NOEXECUTE={OPTIN|OPTOUT|ALWAYSON|ALWAYSOFF} – SetsData Execution Prevention (DEP) settings, applies to 32-bit and 64-bit CPUs with theNX bit.[8]
/NOEXECUTE=OPTIN – Enables DEP for core system images and those specified in the DEP configuration dialog.
/NOEXECUTE=OPTOUT – Enables DEP for all images except those specified in the DEP configuration dialog.
/NOEXECUTE=ALWAYSON – Enables DEP on all images.
/NOEXECUTE=ALWAYSOFF – Disables DEP.
/NOGUIBOOT – Disables the graphical boot screen on startup, only displaying device driver names as they are loaded, similar to/SOS. It can be used in conjunction with/BASEVIDEO to diagnose device driver failures on startup.[7][8] It is set by default for certainSafe Mode options.
/NOSERIALMICE[=comx] – Disables serial mouse detection inNTDETECT.COM. Otherwise serial mouse detections are performed if the/NOSERIALMICE switch is excluded. Replaced with/FASTDETECT on Windows 2000 onwards.[8]
/NUMPROC=nnn – Specifies the number of processors used in a multiprocessor system (e.g./NUMPROC=2 on a four-way system causes Windows to use only two processors instead of all four). Can be used to troubleshoot performance issues and defective CPUs.[8][7]
/ONECPU – Makes Windows use only one processor in a multiprocessor system, similar to that of/NUMPROC=1.[8]
Windows inDirectory Services Restore Mode (/SAFEBOOT:DSREPAIR /SOS) – (This mode is valid only for Windows-based domain controllers.) Performs a directory service repair.[12]
/SDIBOOT – Option used forWindows XP Embedded. Allows booting a RAM image from a System Disk Image (SDI) file.[7][8]
/SOS – Displays device driver names on startup. Also changes the graphical boot screen to the one seen whenCHKDSK is run on startup (Autochk) in Windows 2000 onwards, showing operating system information in a similar manner to Windows NT 4.0.[7][8] Can be used in conjunction with the/BASEVIDEO switch to help diagnose display driver failures on startup (this is the case for Windows NT 4.0 for the "VGA mode" option in the boot menu, which has both/BASEVIDEO and/SOS switches enabled). It is set by default for certainSafe Mode options.
/TIMERES – Sets the system timer resolution for the HAL.[8]
/USEPMTIMER – Specifies that Windows uses the Power Management Timer (PM_TIMER) timer settings instead of theTime Stamp Counter (TSC) timer settings if the processor supports the PM_TIMER settings.[7] By default, Windows Server 2003 Service Pack 2 (SP2) uses the PM timer for all multiprocessorAPIC orACPI HALs./USEPMTIMER must be enabled for Windows Server 2003 Service Pack 1 (SP1) and below.[13]
/USERVA=nnn – Option used only on 32-bit x86-based systems that allows applications to be given a larger address space specified by the user, similar to the/3GB switch. The aforementioned switch is mandatory when using the/USERVA switch.[8][12]
/WIN95 – Allows booting of non-NT versions of Windows (e.g.Windows 9x) usingBOOTSECT.W40.[8]
/WIN95DOS – Allows booting of DOS or non-NT versions of Windows (e.g. Windows 9x) usingBOOTSECT.DOS.[8]
/YEAR=yyyy – Overrides the year set by the computer's clock settings (e.g./YEAR=2000 sets the year to 2000 within Windows, even if the year is set to 1999 within the computer's clock settings). Was used for testingY2K compliance.[8]
![[icon]](/mt/?noimg=&dark=on&url=https%3a%2f%2fen.wikipedia.org%2fwiki%2fFile%3aWiki_letter_w_cropped.svg)
