IN THIS CHAPTER

Identifying the names and purposes of each file required to boot up a Windows 7 or newer computer

Identifying the locations of Windows 7 or newer boot files

Starting a computer has long been referred to as booting. Before you can use your computer, you need to be able to boot it to a point where the operating system (OS) is functional. Otherwise, your computer is like a safe without a known combination. This chapter will help you get that “safe” open by examining the boot process, which encompasses a series of steps, from powering-on to loading the OS shell. This chapter reviews the hardware POST (power-on self-test) process and will concentrate on the OS portion of the overall process. This chapter also introduces you to the standard Windows boot process and the files that are required, and also how to correct or deal with boot problems related to the boot files. A solid understanding of the Windows boot files will prepare you for the A+ exams, and a general knowledge of the other files will prepare you for working with these systems in the field.

If, as an A+ Certified Professional, you are faced with troubleshooting the boot process on a computer for a user, it is required that you understand the boot sequence. If you do not know what the normal boot process is, you will be at a deficit attempting to troubleshoot issues with it. As a CompTIA A+ Certified Professional, you will often have to bring your knowledge of the core operating system files to bear on your user’s computer conundrums.

If you are unfamiliar with boot processes in general, focus on the entire chapter. The A+ exams, though, focus on the Windows boot process.

The Power-On Self-Test (POST) Process

The power-on self-test (POST) process starts when power is applied to the system. Electrical current makes its way from the power lead on the motherboard to the ROM-BIOS chips; when the current is received by the BIOS chips, they immediately begin executing their programs. One of the first checks is the memory (both a count and integrity test). After the memory check, the POST process moves on to find out what ports or I/O devices exist on the system. If the system is equipped with a PnP (Plug and Play), as almost all systems are, the BIOS-level PnP configuration takes place. The next thing that happens is a search for bootable devices. The order of this search is defined by the settings stored in CMOS memory, but is often c: (first partition on the first bootable hard drive), then the optical drive, followed by removable media, such as flash drives, and finally a bootable network card.

For each device in the list of potential bootable devices, the partition table is checked for the active partition. Floppy disks and the CD-ROM check only the first partition. For this partition, the first sector is read and checked for a boot loader. For modern Windows, the first sector is checked for the bootmgr file. When this file is located, it is executed. If it was not found on the first potential bootable device, the second and third devices are checked before reporting a boot failure.

Standard Boot Process for Windows

Like with so many areas of the OS, each new version of Windows comes with changes to the core boot process. The major change implemented in Windows Vista is the introduction of the boot loader application; the configuration data is also stored in a different location. For Windows 7 and newer OSes, the boot loader is bootmgr. This process is used by current Windows OSes that have been released after Windows 7, so it is the same process that is used by Windows Server 2012 and newer server OSes.

Managing Memory and Virtual Memory

With the adoption of Windows NT–based OSes like Windows 7 and newer versions, you no longer need to worry about boot-time memory management because after the OS kernel loads, the memory structure switches to a flat memory model and implements a virtual memory structure.

As improvements were made in the field of RAM, and as computers with more and more memory continued to ship, software developers created applications that used the new memory. To make the entire process of managing memory easier, Microsoft decided to implement virtual memory for the Windows OSes. Virtual memory allows Windows to present a 32-bit virtual machine (VM) that contains 4GB of memory to applications running in the 32-bit Windows environment. When working with 64-bit Windows, 32-bit processes are still limited to 4GB of virtual memory, while 64-bit processes have a much higher limit. On 64-bit Windows 8.1 and newer versions, this limit is 128TB. The OS then used a Virtual Memory Manager (VMM) to control or manage the mapping of data between the virtual addresses used by the application and where the data was stored in physical memory. The VMM was also able to move data that was not being actively used in RAM to a file on the disk. The swapping of memory data pages to and from the disk file led to the file being named “swap file” in older versions of Windows and “paging file” in versions of Windows like Windows 7 and newer versions. The drawback in the system of swapping data shows up when an application wants to use data that is in the swap file because it then has to wait for the data to be retrieved back into RAM before it can be accessed.

Access speeds of hard disks are measured in milliseconds (10^-3), and memory access is measured in nanoseconds (10^-9). It should not be hard to guess that this means that when data has to be retrieved from the swap file on a hard drive, the process is extremely slow relative to retrieving it directly from RAM.

The VMM manages virtual memory addresses up to the virtual memory limit, such as 4GB or 128TB, and the mapping of those addresses to a physical location, either in RAM or on a hard drive. You should rely on using the paging file only when applications need a small amount of additional memory. Most OSes implement virtual memory and allow it to use swap space on a hard drive to allow applications with high memory requirements to function, but greater performance will be achieved by adding more physical RAM to the system.

When an application needs to store information to memory, it passes the request to the VMM. VMM stores the information in RAM but might move the information to the swap file on the drive later. The process for retrieving application data is illustrated in Figure 6-1; the process looks like this:

1. When the application requests information, the VMM checks whether the information is in RAM.
2. If the information is in RAM, the information is simply returned to the application, and the process is complete.
3. If the information isn't in RAM, VMM checks whether there is enough space in RAM to retrieve the information from the swap file.
4. If there is enough space to retrieve the information, the information is retrieved from the drive, stored into RAM, and passed on to the application; and the process is complete.
5. If there isn’t enough space to retrieve the information, VMM checks for memory locations that have not been accessed recently and passes them from RAM down to the swap file.
6. When enough information is moved to the swap file to make room for the requested information, that information is moved into RAM and then returned to the application.

A clean memory location in RAM is a location that has not been accessed since the last time the VMM marked it clean. If the memory location has been accessed with a read or write request, this location is marked as dirty. When looking for memory data to move to the swap file, each location is checked; if it is clean, it is moved to the hard drive, and if it is dirty, it is marked as dirty and left. If the first scan did not free enough RAM, an immediate second search for movable memory data is required, at which time any memory data that is now dirty is data that was accessed since the first scan, mere milliseconds ago. This algorithm is the Least Recently Used (LRU) algorithm, and it ensures that data that is actively used in RAM will stay in RAM.

The 32-bit versions of Windows allow a 32-bit memory space to be used. Rather than being able to use all 4GB (2³²) of address space, only 2GB is configured by default for use with User Mode processes. User Mode processes are applications or processes that run on the computer. This includes server processes such as Microsoft Exchange and Microsoft SQL. The 64-bit version of Windows allows a 64-bit address space to be used by the VMM, which makes the limit 16EB (2⁶⁴), but User Mode processes are limited to 8TB of space for running processes. The remainder of the space is used by operating system processes.

When running Windows 8.1 or newer OS on a 64-bit platform, the User Mode memory limit is increase to 128TB. This is the virtual memory limit, which defines the address locations that can be used, and which is different from the physical memory limit. The physical limit of 64-bit Windows 8 Enterprise is 512GB while 64-bit Windows 10 Enterprise is 6TB.

Getting an A+

This chapter examines the process undertaken by the software on your computer during the boot process. The basic boot process for Windows computers is discussed, as well as the differences between them.

Key points that you should remember about this chapter are

• Virtual memory is managed by the Virtual Memory Manager, which presents a 4GB address space to 32-bit applications on the system. 64-bit applications on 64-bit OSes have a higher limit.
• Virtual memory is made up of physical RAM and hard drive space in the form of a swap file or paging file.
• The Windows boot process uses the bootmgr, BCD, and winload.exe files.

Prep Test

2. As part of troubleshooting the boot process on a Windows 10 computer, you are asked to identify the order in which files are processed. List the files from the left column in the right column in the order in which they are executed as part of the boot process. Not all files will be used.

Answers

1. D. Automatic commands can be found in any of the listed locations (win.ini, Startup group, or the Registry). Review “Standard Boot Process for Windows.”
2. The correct order of files used in the boot process is bootmgr, winload.exe, and ntoskrnl.exe. Check out “Standard Boot Process for Windows.”

   

3. D. CMOS memory contains the boot device order. Take a look at “The Power-On Self-Test (POST) Process.”
4. D. With Windows Vista and newer OSes, you will find the information that was formerly found in the boot.ini file in the Boot Configuration Database (BCD). bcdedit.exe and bootrec.exe are tools for accessing the information in the BCD. himem.sys is an old memory management driver for MS DOS. Peek at “Boot Configuration Database.”
5. D. The registry is where all service information is stored in the key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices<service>. Examine “The service load process.”
6. D. The memory address that is present in each application or VM is 4GB in size. Examine “Managing Memory and Virtual Memory.”
7. B. When running the 64-bit version of Windows lower than Windows 8.1, the User Mode memory limit is 8TB. It goes up to 128TB with Windows 8.1. Refer to “Managing Memory and Virtual Memory.”
8. D. Windows 7 refers to the file used by virtual memory as a paging file or the page file. Look over “Managing Memory and Virtual Memory.”