Windows startup process

The Windows startup process is the process by which the Microsoft Windows series of operating systems initializes.
DOS-based Windows.
Windows 1.x/2.x.
In Windows versions 1.01 to Windows 2.11, the system was loaded when codice_1 was executed. It then loaded codice_2 or codice_3 and codice_4 or codice_5, along with the configuration settings file codice_6. The default shell is the MS-DOS Executive.
The modules codice_7, codice_8 and codice_9, fonts, and the various device drivers (such as codice_10, codice_11, codice_12) are incorporated in codice_2/codice_3 and codice_4/codice_5.
Windows 3.x/9x.
In Windows 3.x and 95/98/ME, the boot loader phase is handled by MS-DOS. During the boot phase, codice_17 and codice_18 are executed, along with the configuration settings files codice_6 and codice_20. Virtual device drivers are also loaded in the startup process: they are most commonly loaded from the registry (codice_21) or from the codice_20 file.
When all system configuration files and device drivers have been loaded, the 16-bit modules, codice_23, codice_7, and codice_9, are loaded, then the 32-bit DLLs (codice_26, codice_27, and codice_28) are loaded. The 32-bit VxD message server (MSGSRV32) starts codice_29, which is responsible for loading the network logon client (such as Client for Microsoft Networks, Microsoft Family Logon or Windows Logon).
When a user is logging on to Windows, the startup sound is played, the shell (usually codice_30) is loaded from the [boot] section of the codice_20 file, and startup items are loaded.
In all versions of Windows 9x except ME, it is also possible to load Windows by booting to a DOS prompt and typing "win". There are some command line switches that can be used with the WIN command: with the codice_32 switch, Windows boots to safe mode, and with the codice_33 switch, Windows boots to safe mode with networking. The latter switch only works properly with Windows 95. In Windows 3.1, additional options are available, such as codice_34, which starts Windows in 386 enhanced mode, and codice_35, which starts Windows in standard mode
A startup sound was added in Windows 3.1.
Windows NT.
In Windows NT, the boot loader is called NTLDR. It is responsible for accessing the file system on the boot drive, for starting ntoskrnl.exe and for loading boot-time device drivers into memory. Once all the Boot and System drivers have been loaded, the kernel (system thread) starts the Session Manager Subsystem (smss.exe), which in turn starts winlogon, which loads the graphical identification and authentication library.
After a user has successfully logged into the machine, winlogon does the following:
In Windows 95/98/ME, it was also possible to run a program before the user logs on by using RunServicesOnce or RunServices keys. In Windows NT, this has been replaced by the services.exe program, which is able to load a set of system services before a user logs on.
Additionally, in English-language versions of Windows, the startup folder was called "StartUp" instead of "Startup" in Win9x.
Due to the minimally restricted environment of these operating systems, any program can add itself to the Startup registry key or system folder. This method is frequently used by malware.
Windows NT 6.
The sequence of booting Windows Vista and later versions is different from any previous version of Windows that uses the NT kernel. The operating system boot loader in Vista is called winload.exe, and is invoked by Windows Boot Manager. Additionally, the GINA that has been in use with all versions of Windows NT since 3.1 has been entirely replaced by "Credential Providers".