Windows 2000 and the Boot

System initialization in Windows 2000 (Win2K--formerly Windows NT 5.0) is not significantly different from system initialization in Windows NT 4.0. Win2K introduces two new Executive subsystems: Plug and Play Manager and Power Manager. The Plug and Play Manager is integrated with the I/O Manager and doesn't have an initialization function. However, drivers initialize in such a way in Win2K as to accommodate Plug and Play (PnP)-aware drivers. The Power Manager has an initialization function, PolnitSystem, that ExpInitializeExecutive calls for phase 0 and phase 1 initialization before calling the Process Manager's initialization function. PolnitSystem prepares the Power Manager to implement the system power management policy, notify device drivers that the system power state is changing, and call the hardware abstraction layer (HAL) to suspend the system or put it into hibernation mode.

A more visible change in Win2K's boot process is that the system boot menu includes an option to boot into safe mode. When you boot into safe mode, you boot into a stripped-down version of the Win2K installation. Instead of presenting Explorer as the desktop GUI, safe mode presents a command-prompt window. Only drivers and services marked as being safe load and initialize for the boot. The idea behind safe mode stems from the possibility that an errant driver, errant service, or corrupt driver file will prevent the system from booting. Safe mode increases the likelihood of booting successfully, because the system loads only the drivers and services that are necessary for the boot to succeed.

When you select a safe-mode boot, you can choose between minimal and network options. The Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot stores safe-mode configuration settings, and the key has Network and Minimal subkeys. The Network subkey includes drivers, services, and groups necessary for network connectivity. The Minimal subkey does not contain these drivers, services, and groups. The SafeBoot key also has one value named AlternateShell, which specifies the name of the program that serves as the GUI. The value's typical setting is cmd.exe, which specifies the command-prompt program. Screen A gives an example of the partial contents of the SafeBoot Registry key.

As the I/O Manager loads drivers and services during the various safe-boot phases, it checks to see whether a subkey is under either the Minimal or the Network subkey with a name that is identical to that of the driver or service it is loading. If the I/O Manager finds such a subkey, it allows the associated driver or service to load. If the I/O Manager does not find such a subkey, it looks for a subkey with the name of the load group that the driver or service belongs to. If the I/O Manager finds a subkey with the name of the load group, it allows the driver or service to load, because the system considers all drivers or services from a load group necessary for the safe boot. One example of a service you'll always find listed as a subkey is the Event Log service (EventLog); a load group you'll always find listed as a subkey is FileSystem.

One more visible difference between the Win2K boot and the NT 4.0 boot is that instead of presenting messages during the boot with the display in an 80 * 50 text mode, Win2K draws messages in a VGA color mode. In NT 4.0, the HAL sets the 80 * 50 mode and prints text. In Win2K, a special driver called bootvid.sys provides the boot-time display support functions.