NTLDR

This article is about startup process in Windows XP and prior versions. For later versions, see Windows Boot Manager.

NTLDR (abbreviation of NT loader) is the boot loader for all releases of Windows NT from 1993 with the release of Windows NT 3.1 up until Windows XP and Windows Server 2003. From Windows Vista onwards it is replaced by Windows Boot Manager (BOOTMGR).

NTLDR is typically run from the primary storage device, but it can also run from portable storage devices such as a CD-ROM, USB flash drive, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file.

NTLDR requires, at a minimum, the following two files to be on the system volume:

• ntldr, the main boot loader itself
• NTDETECT.COM, required for booting an NT-based OS, detects basic hardware information needed for successful boot

An additional important file is boot.ini, which contains boot configuration (if missing, NTLDR will default to \Windows on the first partition of the first hard drive). On non-English versions of NTLDR, it may also load bootfont.bin; this is not the case for BOOTMGR.

NTLDR is launched by the volume boot record of system partition, which is typically written to the disk by the Windows FORMAT or SYS command.

History

Windows NT was originally designed for ARC (Advanced RISC Computing)-compatible platforms, relying on its boot manager support and providing only osloader.exe, a loading program accepting ordinary command-line arguments specifying Windows directory partition, location or boot parameters, which is launched by an ARC-compatible boot manager when a user chooses to start a specific Windows NT operating system. However, because IBM PC compatible machines lacked any kind of ARC support (as they predate the creation of the ARC specification), an additional layer was added specifically for that platform: a custom boot manager code presenting a text-based menu allowing the user to choose from one or more operating systems and its options configured in a boot.ini configuration file, prepended by a special StartUp module which is responsible for some preparations such as switching the CPU to protected mode.

When a user chooses an operating system from the boot menu, the following command-line arguments are then passed to the part of the osloader.exe common to all processor architectures:

load osloader=<Windows Path>\System32\NTLDR
systempartition=<Windows Partition>
osloadpartition=<Windows Partition>
osloadoptions=<Windows Boot Parameters>
consolein=multi(0)key(0)keyboard(0)
consoleout=multi(0)video(0)monitor(0)
x86systempartition=<NTLDR partition>

Versions of NTLDR aside from the x86 IA-32 architecture were also used; an IA-64 version of NTLDR was used in all versions of Windows XP 64-Bit Edition while an x86-64 version of NTLDR was used in Windows XP Professional x64 Edition (although beta builds retained the x86-only NTLDR).

In Windows releases starting from Windows Vista and Windows Server 2008, NTLDR was split off into two parts: Windows Boot Manager for the boot manager and winload.exe for the system loader. The boot manager part has been completely rewritten; it no longer uses boot.ini as a configuration file, although the bootcfg utility for modifying boot.ini is still present in the case of multi-boot configurations with Windows versions up to Windows XP and Windows Server 2003.

Command-line interface

bootsect
Developer	Microsoft
Operating system	Microsoft Windows
Type	Command
License	Proprietary commercial software
Website	Bootsect Command-Line Options

The bootsect.exe utility program in the Windows PE tools has options (/nt52 (NTLDR) and /nt60 (Vista and up)) to store a NTLDR or Vista boot record in the first sector of a specified partition. The command can be used for FAT and NTFS based file systems. It replaces the FixFAT and FixNTFS tools.

Example

The following example applies the NTLDR compatible master boot code to the D: volume:

C:\>bootsect /nt52 D:

Startup process

See also: Booting process of Windows § Windows NT

When a PC is powered on its BIOS follows the configured boot order to find a bootable device. This can be a harddisk, floppy, CD/DVD, network connection, USB-device, etc. depending on the BIOS. In the case of a floppy the BIOS interprets its boot sector (first sector) as code, for NTLDR this could be a NTLDR boot sector looking for the ntldr file on the floppy. For a harddisk the code in the Master Boot Record (first sector) determines the active partition. The code in the boot sector of the active partition could then be again a NTLDR boot sector looking for ntldr in the root directory of this active partition. In a more convoluted scenario the active partition can contain a Vista boot sector for the newer Vista boot manager with an {ntldr} entry pointing to another partition with a NTLDR boot sector.

When booting, the loader portion of NTLDR does the following in order:

1. Accesses the file system on the boot drive (either FAT or New Technology File System, NTFS).
2. If Windows was put in the hibernation state, the contents of hiberfil.sys are loaded into memory and the system resumes where it left off.
3. Otherwise, reads boot.ini and prompts the user with the boot menu accordingly.
4. If a non NT-based OS is selected, NTLDR loads the associated file listed in boot.ini (bootsect.dos if no file is specified or if the user is booting into a DOS based OS) and gives it control.
5. If an NT-based OS is selected, NTLDR runs ntdetect.com, which gathers information about the computer's hardware. (If ntdetect.com hangs during hardware detection, there is a debug version called ntdetect.chk that can be found on Microsoft support.)
6. Starts ntoskrnl.exe, passing to it the information returned by ntdetect.com.

boot.ini

NTLDR's first action is to read the boot.ini file. It allows the user to choose which operating system to boot from at the menu. For NT and NT-based operating systems, it also allows the user to pass preconfigured options to the kernel. The menu options are stored in boot.ini, which itself is located in the root of the same disk as NTLDR. Though NTLDR can boot DOS and non-NT versions of Windows, boot.ini cannot configure their boot options.

For NT-based OSs, the location of the operating system is written as an ARC path. bootsect.dos is the boot sector loaded by NTLDR to load DOS, or if there is no file specified when loading a non NT-based OS.

boot.ini is protected from user configuration by having the following file attributes: system, hidden, read-only. To manually edit it, the user would first have to remove these attributes. A more secure fashion to edit the file is to use the bootcfg command from a console. bootcfg will also relock the file (setting the file back to system, hidden, and read-only). Additionally, the file can be edited within Windows using a text editor if the folder view option "Show hidden files and folders" is selected, the folder view option "Hide protected operating system files" is unchecked, and the "Read-only" option is unchecked under the file's properties. Extreme caution should be taken when modifying boot.ini, as erroneous information can result in an OS that fails to boot.

Example

An example of a boot.ini file, extracted from a working Windows XP Professional installation:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

Note: If the boot loader timeout option in boot.ini is set to 0, the NTLDR boot menu does not appear. This happens especially on multi-booted systems; the boot menu also does not appear when only one operating system is installed, like the example above, even if the timeout option is set into any other value other than 0.

NT kernel switches

Advanced Option Menu in NTLDR on Windows XP

Note: Unless otherwise stated, the following kernel switches apply to both Windows XP and Windows Server 2003 as well as prior versions of Windows NT.

• /3GB – Option used only on 32-bit x86-based systems that allocates 3 GB for the user-mode address space and 1 GB for the system-mode (or kernel-mode) address space (more than that of the 2 GB allocation used for both user-mode and system/kernel-mode address spaces). It is intended for programs that can take advantage of the additional memory address space, such as certain Windows Server 2003 and Microsoft Exchange Server 2003 configurations. Activating this option however may break VMR-9 video; it may also cause audio problems with certain Sound Blaster X-Fi sound cards (X-Fi Gamer / X-Fi Titanium @ WINXP 32-bit 3/2012) due to the way that Creative's drivers handle memory over 2 GB.
• /BASEVIDEO – Starts Windows in "VGA mode", where a VGA-compatible display driver is used with a 16-color, 640 × 480 resolution. This can be used to recover from configuration problems with certain display drivers; using the /SOS switch in conjunction with the /BASEVIDEO switch can help with diagnosing display driver failures on startup (this is the case for Windows NT 4.0 for the "VGA mode" option in the boot menu, which has both /BASEVIDEO and /SOS switches enabled).
• /BAUDRATE=nnn – Specifies the baud rate for the debug port used by the kernel debugger, overriding the default value (9600–19200 Kbps with a modem and 115200 Kbps with a null modem). Enabling this option under boot.ini automatically enables kernel debugging with the /DEBUG switch.
• /BOOTLOG – Writes a log of the boot process to the file %SystemRoot%\Ntbtlog.txt for diagnostic purposes.
• /BOOTLOGO – Displays a custom bitmap instead of the default graphical boot screen on startup. This must be a 640 × 480 16-color bitmap named boot.bmp, which should be placed in the Windows directory. The /NOGUIBOOT switch must be used in conjunction with the /BOOTLOGO switch, otherwise the custom bitmap will not display properly.

• /BREAK – Causes the hardware abstraction layer (HAL) to stop at a breakpoint at HAL initialization. The HAL will wait indefinitely at the breakpoint until a kernel-debugger connection is made. If the switch is used without the /DEBUG switch, the system will Blue Screen with an error code of 0x00000078 (PHASE0_EXCEPTION).
• /BURNMEMORY=nnn – Specifies the amount of memory, in megabytes, that Windows cannot use. Use this parameter to confirm a performance problem or other problems that are related to RAM depletion. For example, using /BURNMEMORY=128 reduces the physical memory that is available to Windows by 128 MB.
• /CHANNEL=nn – Use with the /DEBUG switch and the /DEBUGPORT=1394 switch to selects the IEEE 1394 interface channel (numbered 0 to 62) through which kernel debugging communications will flow.
• /CLKLVL – Causes the standard x86 multiprocessor HAL (Halmps.dll) to configure itself for a level-sensitive system clock rather then an edge-triggered clock. Level-sensitive and edge-triggered are terms used to describe hardware interrupt types.
• /CMDCONS – Passed when booting into the Recovery Console.
• /CRASHDEBUG – Causes the kernel debugger to be loaded when the system boots, but to remain inactive unless a crash occurs. This allows the serial port that the kernel debugger would use to be available for use by the system until the system crashes (unlike /DEBUG, which causes the kernel debugger to use the serial port for the life of the system session).
• /DEBUG – Enables kernel-mode debugging. It can be activated at any time by a host debugger that is connected to the computer, to perform live remote debugging of a Windows system through the COM ports. This switch uses the serial port regardless of whether or not debugging is used, and can be used to debug problems that are regularly reproducible.
• /DEBUGPORT=comx – Enables kernel-mode debugging, and specifies an override for the default serial (usually COM2 on systems with at least two serial ports) to which a remote kernel-debugger host is connected. Windows XP and Windows Server 2003 also support debugging through accept IEEE 1394 (FireWire) ports. Examples: /DEBUGPORT=COM2, /DEBUGPORT=1394. Use of this switch automatically enables the /DEBUG switch.
• /EXECUTE – This option disables no-execute protection; see "/NOEXECUTE" below.
• /FASTDETECT[:comx[,comy]] – Default boot option for Windows from Windows 2000 onwards. Turns off serial and bus mouse detection for the specified port(s), or for all ports if none are specified. Use this switch when there is a component other than a mouse attached to a serial port during the startup process. Ports may be separated with commas to turn off more than one port. (Note: In earlier versions of Windows, including Windows NT 4.0, this switch was named /NOSERIALMICE; see "/NOSERIALMICE[=comx]" below.) The reason that this switch exists is so that NTDETECT.COM can support booting Windows NT 4.0 and earlier.
• /HAL=filename – Enables the user to override NTLDR's default filename for the HAL (hal.dll). This can be useful for manually selecting a different HAL. It can also be used to switch between starting in multiprocessor and single processor modes, which can be used in conjunction with the /KERNEL switch. (Note: filename must be in System32 directory. This can be a simple file, hard link, but not a symbolic link or a junction point.)
• /INTAFFINITY – Directs the standard x86 multiprocessor HAL (Halmps.dll) to set interrupt affinities such that only the highest numbered processor will receive interrupts. Without the switch, the HAL defaults to its normal behavior of letting all processors receive interrupts.
• /KERNEL=filename – Enables the user to override NTLDR's default filename for the kernel image (ntoskrnl.exe). This can be useful for alternating between a checked kernel environment and a free (retail) kernel environment. Same limitations apply for filename location and type as with the /HAL switch.
• /MAXMEM=nnn – Specifies the maximum amount of RAM, in megabytes, that Windows can use. For example, using /MAXMEM=64 would make Windows use less than 64 MB of memory. However, the /MAXMEM switch does not account for memory holes. Therefore, it is recommended to use the /BURNMEMORY switch instead, which does account for memory holes. For example, if /MAXMEM=64 is used, and the system requires 64 MB of memory to load, there may not actually be 64-MB available to the system because of a memory hole. In this scenario, Windows would not start.
• /MININT – This option is used by Windows Preinstallation Environment (WinPE) and loads the Registry SYSTEM hive as a volatile hive such that changes made to it in memory are not saved back to the hive image.
• /NODEBUG – Prevents kernel-mode debugging from being initialized. Overrides the specification of any of the three debug-related switches: /DEBUG, /DEBUGPORT, and /BAUDRATE. This can cause a Stop Error if a program has a debug hardcoded breakpoint in its software (see "/BREAK" above).
• /NOEXECUTE={OPTIN|OPTOUT|ALWAYSON|ALWAYSOFF} – This option is only available on 32-bit versions of Windows when running on processors supporting Data Execution Prevention (DEP). It enables DEP, which results in the memory manager marking pages containing data as no-execute so that they cannot be executed as code. This can be useful for preventing malicious code from exploiting buffer overflow bugs with unexpected program input in order to execute arbitrary code. No-execute protection is always enabled on 64-bit versions of Windows on processors that support no-execute protection. There are several options the user can specify with this switch:
  • /NOEXECUTE=OPTIN – Enables DEP for core system images and those specified in the DEP configuration dialog.
  • /NOEXECUTE=OPTOUT – Enables DEP for all images except those specified in the DEP configuration dialog.
  • /NOEXECUTE=ALWAYSON – Enables DEP on all images.
  • /NOEXECUTE=ALWAYSOFF – Disables DEP.
• /NOGUIBOOT – Displays the device driver names while they are being loaded. Use with the /BASEVIDEO switch to determine the driver that is triggering a failure.
• /NOPAE – Forces NTLDR to load the non-Physical Address Extension (PAE) version of the Windows kernel, even if the system is detected as supporting x86 PAEs and has more than 4 GB of physical memory.
• /NOSERIALMICE[=comx] – (Obsolete on all versions post-Windows NT 4.0; replaced by the absence of the /FASTDETECT switch (see "/FASTDETECT" above)). Disables serial mouse detection on the specified COM ports. Using /NOSERIALMICE without specifying a COM port disables serial mouse detection on all COM ports.
• /NUMPROC=nnn – Specifies the number of CPUs (or processors) that can be used on a multiprocessor system. Example: /NUMPROC=2 on a four-way system will prevent Windows from using two of the four processors. Useful for when troubleshooting performance problems and defective CPUs.
• /ONECPU – Equivalent to using /NUMPROC=1. Causes Windows to use only one CPU (or processor) on a multiprocessor system.
• /PAE – Enables Physical Address Extension support. In Safe Mode, the computer starts by using normal kernels, even if the /PAE switch is specified.
• /PCILOCK – For x86-based systems, this stops the operating system from dynamically assigning hardware input, hardware output, and interrupt request resources to PCI devices. Instead, the BIOS configures the devices.
• /RDPATH – Specifies the path to a System Disk Image (SDI) file, which can be on the network, that the system will use to boot from. Often used in conjunction with the /RDIMAGEOFFSET flag to indicate to NTLDR where in the file the system image starts.
• /REDIRECT – Introduced with Windows XP. Used to cause Windows to enable Emergency Management Services (EMS) that reports boot information and accepts system management commands through a serial port. Specify serial port and baudrate used in conjunction with EMS with redirect= and redirectbaudrate= lines in the [boot loader] section of the Boot.ini file.
• /SAFEBOOT:{MINIMAL|NETWORK|DSREPAIR}[(ALTERNATESHELL)] – Starts Windows in Safe Mode. Options must start with a colon ":" before the other parameters as shown above. An additional option the user can append is (ALTERNATESHELL), which tells Windows to use the program specified by the HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\AlternateShell value as the graphical shell rather than to use the default, which is Windows Explorer. The user can also combine other boot.ini parameters with /SAFEBOOT:type. The following examples illustrate the parameters that are in effect when you select a Safe Mode option from the startup recovery menu. (Note: The /SOS, /BOOTLOG, and /NOGUIBOOT switches are not required with any one of these settings, but the switches can help with troubleshooting.)
  • Safe Mode (/SAFEBOOT:MINIMAL /SOS /BOOTLOG /NOGUIBOOT) – Default: Uses a minimal set of device drivers and services to start Windows.
  • Safe Mode with Networking (/SAFEBOOT:NETWORK /SOS /BOOTLOG /NOGUIBOOT) – Default mode together with the drivers necessary to load networking.
  • Safe Mode with Command Prompt (/SAFEBOOT:MINIMAL(ALTERNATESHELL) /SOS /BOOTLOG /NOGUIBOOT) – Default mode, except that Cmd.exe starts instead of Windows Explorer.
  • Windows in Directory Services Restore Mode (/SAFEBOOT:DSREPAIR /SOS) – (This mode is valid only for Windows-based domain controllers.) Performs a directory service repair.
• /SDIBOOT – Used in Windows XP Embedded systems to have Windows boot from a RAM disk image stored in the specified System Disk Image (SDI) file.
• /SOS – Causes Windows to list the device drivers marked to load at boot time. By default, the boot loader only echoes progress dots or bars. From Windows 2000 onwards, it also changes the boot screen design to the one seen when CHKDSK is run on boot (aka "Autochk"), displaying the system version number (including the build number), amount of physical memory, and number of processors similar to that of the boot sequence from Windows NT 4.0. Use with the /BASEVIDEO switch to determine if the driver is triggering a failure. (This option is set by default in Windows NT 4.0 for the "VGA mode" option in the boot menu, used in conjunction with the /BASEVIDEO switch.)
• /TIMERES – Sets the resolution of the system timer on the standard x86 multiprocessor HAL (Halmps.dll). The argument is a number interpreted in hundreds of nanoseconds, but the rate is set to the closest resolution the HAL supports that isn't larger than the one requested. The HAL supports the following resolutions: Hundreds of nanoseconds Milliseconds (ms) 9766 0.98 19532 2.00 39063 3.90 78125 7.80 The default resolution is 7.8 ms. The system timer resolution affects the resolution of waitable timers. Example: /TIMERES=21000 would set the timer to a resolution of 2.0 ms.

{{

• /USEPMTIMER – Specifies that Windows uses the Power Management Timer (PM_TIMER) timer settings instead of the Time Stamp Counter (TSC) timer settings if the processor supports the PM_TIMER settings. By default, Windows Server 2003 Service Pack 2 (SP2) uses the PM timer for all multiprocessor APIC or ACPI HALs. If not running Windows Server 2003 SP2, /USEPMTIMER must be enabled.
• /USERVA=nnn – Supported on Windows XP and Windows Server 2003 only. Customizes the amount of memory, in megabytes, that is allocated to processes when using the /3GB switch. This switch permits more page table entry kernel memory but still maintains almost 3 GB of process memory space.
• /WIN95 – Directs NTLDR to boot the Windows boot sector stored in bootsect.w40.
• /WIN95DOS – Directs NTLDR to boot the MS-DOS boot sector stored in bootsect.dos.
• /YEAR=yyyy – Instructs the Windows core time function to ignore the year that the computer's real-time clock reports and instead use the one indicated. Example: /YEAR=2001. (This switch was created to assist in Y2K testing.)

See also

• Booting process of Windows
• ntoskrnl.exe
• ntdetect.com
• Emergency Management Services
• Comparison of boot loaders
• Windows Boot Manager

External links

• How to edit the Boot.ini file in Windows XP at the Wayback Machine (archived 2006-12-16)
• BOOT.INI and ARC Path Naming Conventions and Usage at the Wayback Machine (archived 2006-08-30)
• MS Knowledge Base help on "NTLDR Is Missing" error message in Windows 2000 and Windows XP (also [1] Archived 2007-06-13 at the Wayback Machine, [2] Archived 2007-07-09 at the Wayback Machine, [3] Archived 2007-07-16 at the Wayback Machine, [4] Archived 2009-02-28 at the Wayback Machine)
• How to fix "NTLDR Is Missing" error at the Wayback Machine (archived 2013-12-16)
• Explanation of BOOT.INI by Daniel B. Sedory