BOOT Process Of Windows Server 2008

Here’s the brief description of Windows Server 2008 Boot process.

1. System is powered ON
2. The CMOS loads the BIOS and then runs POST
3. Looks for the MBR on the bootable device
4. Through the MBR the boot sector is located and the BOOTMGR is loaded
5. BOOTMGR looks for active partition
6. BOOTMGR reads the BCD file from the \boot directory on the active partition
7. The BCD (boot configuration database) contains various configuration parameters( this information was previously stored in the boot.ini)
8. BOOTMGR transfer control to the Windows Loader (winload.exe) or winresume.exe in case the system was hibernated.
9. Winloader loads drivers that are set to start at boot and then transfers the control to the windows kernel.

STEP 1:

 The first step is to see what hardware is available and its condition by using the power-on self

test (POST) routine. Next, BIOS executes the initial program load (IPL), which locates the

boot device and, if the device is a hard disk, the master boot record (MBR) is read from

the first sector on the disk. Otherwise, the equivalent information is obtained from the

boot device. From this information, partition information is obtained, the boot sector is

read, and the Windows Boot Manager (Bootmgr.exe) is started. On the screen, you see the

memory check, the identification of hardware, and the search for a boot device.

STEP 2:

 Windows Boot Manager reads the boot configuration data (BCD) and, if there is

more than one boot partition, asks the user to choose a partition and its OS. If a choice is

not made before the timeout, the default partition and OS is loaded. If you are booting

Windows Server 2008, the Windows Boot Loader (Winload.exe) is started. If you have

more than one hardware profile, you are given the option of pressing the spacebar to

select the hardware profile you want to use, for example, if you have a laptop that you

sometimes use with a docking station. If you press the spacebar , you can choose the

hardware profile you want; otherwise, the default profile is used.

Windows Server 2003 Booting Process

BIOS: performs Power On Self Test (POST)
BIOS: loads MBR from the boot device specified/selected by the BIOS
MBR: contains a small amount of code that reads the partition table, the first partition marked as active is determined to be the system volume
MBR: loads the boot sector from the system volume
BOOT SECTOR: reads the root directory of the system volume at loads NTLDR
NTLDR: reads BOOT.INI from the system volume to determine the boot drive (presenting a menu if more than 1 entry is defined)
NTLDR: loads and executes NTDETECT.COM from the system volume to perform BIOS hardware detection
NTLDR: loads NTOSKRNL.EXE, HAL.DLL, BOOTVID.DLL (and KDCOM.DLL for XP upwards) from the boot (Windows) volume
NTLDR: loads \WINDOWS\SYSTEM32\CONFIG\SYSTEM which becomes the system hive HKEY_LOCAL_MACHINE\System
NTLDR: loads drivers flagged as “boot” defined in the system hive, then passes control to NTOSKRNL.EXE
NTOSKRNL.EXE: brings up the loading splash screen and initializes the kernel subsystem
NTOSKRNL.EXE: starts the boot-start drivers and then loads & starts the system-start drivers
NTOSKRNL.EXE: creates the Session Manager process (SMSS.EXE)
SMSS.EXE: runs any programs specified in BootExecute (e.g. AUTOCHK, the native API version of CHKDSK)
SMSS.EXE: processes any delayed move/rename operations from hotfixes/service packs replacing in-use system files
SMSS.EXE: initializes the paging file(s) and the remaining registry hives
** before this step completes, bugchecks will not result in a memory dump as we need a working page file on the boot (Windows) volume **
SMSS.EXE: starts the kernel-mode portion of the Win32 subsystem (WIN32K.SYS)
SMSS.EXE: starts the user-mode portion of the Win32 subsystem (CSRSS.EXE)
SMSS.EXE: starts WINLOGON.EXE
WINLOGON.EXE: starts the Local Security Authority (LSASS.EXE)
WINLOGON.EXE: loads the Graphical User Identification and Authentication DLL (MSGINA.DLL by default)
WINLOGON.EXE: displays the logon window
WINLOGON.EXE: starts the services controller (SERVICES.EXE)
** at this point users can logon **
SERVICES.EXE: starts all services markes as automatic
———
NOTES:
The SYSTEM volume is the partition from which the boot process starts, containing the MBR, boot sector, NTLDR, NTDETECT.COM & BOOT.INI

The BOOT volume is the partition which contains the Windows folder – this can be a logical partition

Resizing VHDX in Windows 2012 using PowerShell

In order to be able to resize the VHD you need to follow few steps first. You can do that from the GUI, however in my experience your best rate of success is to use the PowerShell. Please note that this apply only to Hyper-V in Windows 2012 and above, there isn’t a process available yet for the previous versions of Hyper-V

Below are the steps of how to do that, just as an explanation in order to be able to resize the VHD we need to resize the partition inside the Virtual machine, as to let the vhd file know that this space is free and its safe to remove it.

The command below will provide all the steps required to resize the vhd, however it requires the server to be shut down. The steps are as follow:

1. Shut down the VM
2. Mount the VHD using mount-vhd command with command line as follow:

mount-vhd path\drive.vhdx -passthru | get-disk | get-partition | get-volume

This command will provide you with information of what drive letter the partitions inside vhdx files have been assigned as well as the size details (remember that from Windows 2008 and up the system create a 100-300MB partition on the main drive used in booting process, don’t resize it)

3. The next command is resize-partition, that is to resize the size of the partition inside the vhdx to the size you want it to be

resize-partition –driveletter D -size 40GB

-driveletter is the drive letter we get from the first command, and –size is the size to what we want to shrink the partition to.

4. Next we will dismount the vhd using dismount-vhd:

dismount-vhd path\drive.vhdx

5. The last command is actual resizing of the VHD, to do that we use: resize-vhd command:

resize-vhd path\drive.vhdx -ToMinimumSize