Modern. Secure. Fast.
At first glance, the Windows 10 boot process may look very similar to that of Windows 7. The familiar names are still there: BOOTMGR, BCD, WINLOAD, NTOSKRNL, and WINLOGON all remain part of the startup sequence. However, Windows 10 arrives in an era where modern firmware, security, and trust validation have become first-class citizens of the boot process.
As illustrated in the diagram, Windows 10 supports both traditional BIOS systems and modern UEFI systems. While both paths ultimately lead to the same destination, the journey is quite different.
The startup process begins with the Power-On Self-Test (POST), during which the firmware verifies that critical hardware components such as the processor, memory, storage devices, and graphics hardware are functioning correctly. Once POST completes successfully, the system starts looking for a way to load Windows.
On legacy systems, the BIOS follows the traditional route. It locates the Master Boot Record (MBR), executes the boot code it contains, and transfers ownership of the startup process to Windows. From that point on, BIOS effectively disappears from the story. The operating system boot code takes control, loads BOOTMGR, reads the BCD Store, starts WINLOAD.EXE, and eventually loads the Windows kernel.
UEFI systems take a more modern approach. Rather than searching for boot code within an MBR, UEFI reads boot entries stored in firmware and launches Microsoft’s boot files directly from the EFI System Partition (ESP). Because UEFI maintains awareness of boot entries and firmware variables throughout the startup sequence, it remains involved in the overall trust chain rather than simply handing over control and walking away.
This distinction becomes especially important when discussing modern security features. UEFI enables technologies such as Secure Boot, allowing the firmware to validate digital signatures before trusted components are loaded. Combined with TPM hardware and later security innovations, Windows 10 moves the operating system closer to the hardware-rooted trust model that would become a defining characteristic of Windows 11.
Regardless of which path is taken, both boot journeys eventually converge. BOOTMGR reads the Boot Configuration Data (BCD) store, launches the appropriate version of WINLOAD, and prepares the operating system for execution. WINLOAD loads the kernel, the Hardware Abstraction Layer, and boot-critical drivers before handing control to NTOSKRNL.EXE, the heart of Windows.
Once the kernel is active, SMSS.EXE initializes system sessions, followed by WINLOGON.EXE, which prepares user authentication and session management. Finally, Explorer launches the desktop and presents the familiar Windows experience to the user.
Although the startup process appears deceptively familiar, Windows 10 is already laying the groundwork for a more secure future. The boot chain is no longer simply about getting Windows started; it is increasingly about proving that every component involved in that startup process can be trusted.
Windows 7 modernized the boot process.
Windows 10 began turning it into a security boundary.
Windows 10 Architecture
The Multiverse Operating System
If Windows XP was a kingdom and Windows 7 was a modern city, Windows 10 is best described as a multiverse.
Unlike its predecessors, Windows 10 is no longer focused solely on running traditional desktop applications. Over time it evolved into a platform capable of running multiple application models, virtualization technologies, cloud-connected workloads, containers, and even Linux environments, all while maintaining compatibility with software originally designed decades earlier.
At the top of the architecture, we find the various application worlds that coexist within Windows 10. Traditional Win32 applications continue to play a major role, but they are joined by Universal Windows Platform (UWP) applications, .NET workloads, web-based experiences, and eventually the Windows Subsystem for Linux (WSL). These environments may look different, but they all ultimately rely on the same operating system foundation.
Regardless of whether a request originates from a classic desktop application, a modern Microsoft Store app, or a Linux process running through WSL, it eventually travels through the system call interface and into the Windows kernel.
At the heart of the system remains NTOSKRNL.EXE. Despite decades of architectural evolution, the Windows NT kernel continues to manage process scheduling, memory management, security enforcement, device communication, and resource allocation. It remains the core component that keeps the operating system functioning.
Supporting the kernel is the Hardware Abstraction Layer (HAL), which shields Windows from hardware-specific implementation details. This allows Windows to operate across a vast range of hardware platforms without requiring the kernel to understand every motherboard, chipset, or processor architecture directly.
Below the kernel sits the driver layer. Storage drivers, graphics drivers, network drivers, USB drivers, and countless others serve as translators between the operating system and physical hardware. Together, they form the bridge between software and the real world.
One of the most significant additions to Windows 10 is the introduction of technologies such as Hyper-V, WSL, and containerization. These features allow Windows to host isolated environments and alternate workloads while still relying on the same NT foundation underneath. In many ways, Windows 10 stops being simply an operating system and becomes a platform capable of supporting multiple worlds simultaneously.
This evolution is reflected perfectly in the diagram. Whether you’re running classic desktop applications, containerized workloads, virtual machines, .NET applications, or Linux tools through WSL, everything ultimately converges on the same kernel.
Windows 10 doesn’t replace the Windows NT architecture.
It expands it.
One operating system.
Multiple worlds.
While the architecture shown above explains how Windows 10 is structured and how applications ultimately interact with the Windows kernel, it doesn’t tell the full story. As Windows evolved, Microsoft introduced an extensive security framework designed to protect identities, credentials, applications, and the operating system itself.
Technologies such as Windows Hello for Business, Device Guard, Credential Guard, Virtualization-Based Security (VBS), Secure Kernel, Hyper-V isolation, and modern endpoint protection transformed Windows 10 from a traditional operating system into a platform built around Zero Trust principles.
We’ll explore that security architecture in the Windows 10 Enterprise Security Architecture
Yours truly,
Lady Itris | The Feminine Nerd 💜