17-12-12

le:///datos /Ins tituto/Curs o 2012-201...-windows -7-boot-proces s -s bs l.as px.html

#1

Traducir esta pgina

The Windows 7 Boot Process (sbsl)

Wri en by Claus Witjes and Arne Stremlau

This
link
This ar cle about the Windows boot process is part of a con nuing series on OS boot and user logon delays on Windows computers joined to Ac ve Directory
domains. Related ar cles describing known issues and tools to troubleshoot slow boots and user logons can be found in the following links:
This
link
This
http://social.technet.microsoft.com/wiki/contents/articles/10128.tools-for-troubleshooting-slow-boots-and-slow-logons.aspx
link
http://social.technet.microsoft.com/wiki/contents/articles/10123.troubleshooting-slow-operating-system-boot-times-and-slow-user-logons.aspx
This
Alink
ques on that Premier Field Engineers o en get asked onsite is Why do our users wait so long for Windows to boot that they some mes have me to get a
http://social.technet.microsoft.com/wiki/contents/articles/10130.root-causes-for-slow-boots-and-logons.aspx

cup of coee?
The reality is that there are a myriad of reasons including hardware performance, network performance, the amount of the workloads added by administrators
as well as ineciencies in Microso and ISV applica ons and OS components.
The goal of this ar cle is to give readers an overview of the Windows boot process so that you can be er troubleshoot a slow OS start or slow user logon that is
caused by delays in the OS boot process. Related problems about resuming from sleep, wake from hibernate, or OS shutdown processes are not covered in this
ar cle.

Table of Contents
Boot Process Overview
BIOS Initialization
OS Loader
OS Initialization
The PostBoot phase
The ReadyBootPrefetcher
Additional references

Boot Process Overview

Fast OS startup performance is cri cal for a good user experience. The me required to boot the opera ng system on a given computer to the point where the

user can start working is one of the most important benchmarks for Windows client performance. The Windows boot process consists of several phases which

17-12-12

le:///datos /Ins tituto/Curs o 2012-201...-windows -7-boot-proces s -s bs l.as px.html

#2

user can start working is one of the most important benchmarks for Windows client performance. The Windows boot process consists of several phases which
are explained in more detail by the picture and suppor ng text below.

The Windows Performance Toolkit (included in the Windows 7.1 SDK

and OS Loader).

This
link
This
) allows you to inves gate most of the boot phases (except for BIOS Ini aliza on
link

BIOS Initialization
During the BIOS Ini aliza on phase, the pla orm rmware iden es and ini alizes hardware devices, and then runs a power-on self-test (POST). The POST
process ends when the BIOS detects a valid system disk, reads the master boot record (MBR), and starts Bootmgr.exe. Bootmgr.exe nds and starts
Winload.exe on the Windows boot par on, which begins the OSLoader phase [1].
The BIOS version, the BIOS congura on and the rmware of the computer hardware components can have an impact on the overall boot performance. There
is no way to trace this phase using the Windows Performance Toolkit. You need to manually measure the me. In order to op mize or troubleshoot this early
phase in the overall computer startup process, make sure to update the BIOS version and rmware of all hardware components to the latest versions. In
addi on check the BIOS congura on (device boot order, PXE boot-enabled, Quick/Fast boot (POST check) enabled, AHCI se ngs, and so on).
Be careful changing the BIOS congura on or upda ng the rmware/UEFI/BIOS versions. Read the hardware vendor manuals carefully because
miscongura ons and failed updates can cause complete system outages. Create a backup of your system and data beforehand.

OS Loader
During the OSLoader phase, the Windows loader binary (Winload.exe) loads essen al system drivers that are required to read minimal data from the disk and
ini alizes the system to the point where the Windows kernel can begin execu on. When the kernel starts to run, the OSloader loads the system registry hive
and addi onal drivers that are marked as BOOT_START into memory. [1]
This phase is mainly impacted by boot start drivers. While a delay caused by a dual boot menu would be easy to x, make sure that all boot start drivers are
signed and up-to-date.
To iden fy boot start drivers which are not signed:
1. Create a boot trace using the Windows Performance Toolkit. For more informa on about how to create a trace, see slow boot and logon analysis ar cles
2.
3.
4.
5.

This
for analysis.
link
Run xperf i <boo race.etl> -o bootevents.txt a dumper
Findstr /C:I-DCStart bootevents.txt > bootevents.csv
Open the bootevents.csv using Excel and run signtool verify /v <driver>
This
Signtool.exe is part of the Windows SDK
.
link
If you nd a driver which is not signed, look for driver updates.

OS Initialization
During the OS Ini aliza on phase, most of the opera ng system work occurs. This phase involves kernel ini aliza on, Plug and Play ac vity, service start,
logon, and Explorer (desktop) ini aliza on. The OS Ini aliza on can be divided into four subphases. Each subphase has unique characteris cs and

performance vulnerabili es. [1]

17-12-12

le:///datos /Ins tituto/Curs o 2012-201...-windows -7-boot-proces s -s bs l.as px.html

#3

performance vulnerabili es. [1]

A er you have taken a boot trace the dierent subphases are shown as follows in XPERFV IEW.EXE:

This
link

Sub phase 1 - PreSMSS: Kernel Ini aliza on

The PreSMSS subphase begins when the kernel is invoked. During this subphase, the kernel ini alizes data structures and components. It also starts
the PnP manager, which ini alizes the BOOT_START drivers that were loaded during the OSLoader phase. [1]
Sub phase 2 - SMSSInit : Session Ini aliza on
The SMSSInit subphase begins when the kernel passes control to the session manager process (Smss.exe). During this subphase, the system ini alizes
the registry, loads and starts the devices and drivers that are not marked BOOT_START, and starts the subsystem processes. SMSSInit ends when control
is passed to Winlogon.exe. [1]
Sub phase 3 - WinLogonInit: Winlogon Ini aliza on
The WinLogonInit subphase begins when SMSSInit completes and starts Winlogon.exe. During WinLogonInit, the user logon screen appears, the service
control manager starts services, and Group Policy scripts run. WinLogonInit ends when the Explorer process starts. [1]
Sub phase 4 ExplorerInit: Explorer Ini aliza on
The ExplorerInit subphase begins when Explorer.exe starts. During ExplorerInit, the system creates the desktop window manager (DWM) process,
which ini alizes the desktop and displays it for the rst me. [1]
A detailed analysis of each phase would go far beyond the scope of this ar cle. The analysis always starts with a boot analysis trace created with the Windows
This
Performance Toolkit, which is described in the Windows On/O Transi on Performance Analysis Whitepaper
. Common performance vulnerabili es are
link
described in the whitepaper as well.
S ll, it might require more tools (like parallel network traces and addi onal debug logs such as Gpsvc logging) to fully analyze a problem.
For now, begin your analysis on phases that consume the most me and compare traces with a fresh/clean-OS installa on on same hardware.
To give you two examples:
If the WinLogonInit phase takes a long me, you can use the Winlogon graph for further analysis.

This
link
In this example the Group Policy processing took around 160 seconds to complete, before the Windows desktop could be loaded. While the Winlogon graph
does not explain why it took 160 seconds to complete GPO processing (which could be related to network issues, policy se ngs, GPO preferences, scripts, and
so on), your can see where to inves gate further.
In another example while analyzing the ReadyingProcess/ReadyingThreadIdgraphs we found the prole service wai ng about 25 seconds on the network.

This
link

17-12-12

le:///datos /Ins tituto/Curs o 2012-201...-windows -7-boot-proces s -s bs l.as px.html

#4

The PostBoot phase

The PostBoot phase includes all background ac vity that occurs a er the desktop is ready. The user can interact with the desktop, but the system might s ll be
star ng services, tray icons, and applica on code in the background, poten ally having an impact on how the user perceives system responsiveness. [1]

The ReadyBootPrefetcher
During the Windows boot process a lot of data is read from disk and I/O pressure is one of the determining factors for boot performance. The Windows
prefetcher (or ReadyBoot) helps to read data into memory before Windows needs it. In addi on each reboot will allow the prefetcher to be er predict what
data is needed.
This
While ReadyBoot is usually turned on for classic harddisks, it is o for fast SSDs, of ifWinSAT
disk score is > 6.0.
link
One way to analyze the prefetcher ac vi es is to run xperf.exe from the Windows Performance Toolkit.
Xperf i <boo race.etl> - o prefetcher.txt a bootprefetch summary

This
link
To train a system, you can run the xbootmgr.exe with the prepsystem command op on.
The above should give you some insight into where to start looking for issues during the Windows boot phase, as it will help you iden fy the correc on sec on
to start troubleshoo ng.
A recommenda on is to check the hardware pla orm thoroughly by upda ng the BIOS and checking hard drive performance with benchmarking tools prior to
searching for the problem on the OS layer.

Additional references
[1] Windows On/O Transi on Performance Analysis, h p://msdn.microso .com/en-us/windows/hardware/gg463386.aspx
[2] Windows On/O Transi ons Solu ons Guide, h p://msdn.microso .com/en-us/windows/hardware/gg463230.aspx

This
link

This
link