The Birth of Modern Windows, an actual Operating System
If Windows 98 was still leaning heavily on DOS, Windows XP was the moment Windows finally moved out of the family home and learned to stand on its own feet.
Built on the Windows NT architecture, Windows XP represented a major shift in Microsoft’s operating system design. Unlike Windows 98, which required DOS to start before Windows could load, Windows XP was fully independent. For the first time, the operating system controlled its own boot process from start to finish.
The boot sequence looked something like this:
The journey begins, just like previous Windows versions, with the Power-On Self-Test (POST). During this phase, the system firmware checks the processor, memory, storage devices, input devices, and other critical hardware components. If everything looks healthy, the BIOS takes over and starts searching for a bootable device.
Once a bootable disk is found, the BIOS loads the Master Boot Record (MBR) from the first sector of the disk. The MBR contains boot code and partition information. After executing the MBR, ownership of the startup process is transferred from the BIOS to the operating system’s boot code. The BIOS has completed its mission and quietly exits the stage.
The MBR locates the active partition and launches the partition’s Boot Sector. This boot sector has one very important job: finding and loading NTLDR.
This is where Windows XP truly distinguishes itself from Windows 98.
NTLDR (NT Loader) is the first major component of the Windows NT startup sequence. It acts as the conductor of the entire boot process. Unlike DOS-based Windows versions, XP no longer relies on external components to initialize the operating system. NTLDR takes complete control and begins preparing Windows for launch.
Before loading Windows itself, NTLDR reads a small configuration file called BOOT.INI. This file contains information about available operating systems and startup options. If multiple operating systems are installed, BOOT.INI determines which entries appear in the boot menu.
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Microsoft Windows XP Professional” /fastdetect
Breaking it down
The first section controls the boot menu itself, this tells NTLDR to wait 30 seconds before automatically starting the default operating system.
After default tells NTLDR where physically Windows is installed.
The second section contains the available operating systems, in case of a dual boot scenario. This boot.ini only shows 1 Operating System available.
Which can be interpreted as:
| Component | Meaning |
|---|---|
| multi(0) | First disk controller |
| disk(0) | Usually 0 for IDE/SATA |
| rdisk(0) | First physical hard disk |
| partition(1) | First partition |
| \WINDOWS | Windows installation folder |
| “Microsoft Windows XP Professional” | Text shown in the boot menu |
| /fastdetect | Disables slow legacy serial and parallel port detection |
Dual boot scenarios were one of the reasons BOOT.INI became famous among administrators:
Easy to read, edit and … of course … break
One missing bracket, typo, or wrong partition number and Windows XP would suddenly decide today was not a good day to boot.
As many administrators learned:
“BOOT.INI is just a text file. What could possibly go wrong?”
And then everything went wrong. 😄
Once the boot configuration has been selected, NTLDR launches NTDETECT.COM. This utility performs hardware detection and gathers information about devices installed in the system. The collected information is later passed to the Windows kernel so it knows exactly what hardware it will be managing.
At this point, Windows isn’t running yet. The kernel (NTOSKRNL.EXE) hasn’t been loaded, and Windows knows very little about the hardware installed in the machine. Before the kernel can take control, it needs information about the environment it is about to manage.
That’s where NTDETECT.COM comes in.
Think of NTDETECT.COM as a scout sent ahead to survey the battlefield before the king arrives.
Its primary job is to collect hardware information and report it back to NTLDR. This includes details about:
- Installed processors
- System buses
- Keyboard and mouse devices
- Storage controllers
- Serial and parallel ports
- BIOS information
- Hardware resources such as IRQs and DMA channels
Once the hardware inventory is complete, NTDETECT.COM passes the collected information back to NTLDR.
NTLDR then loads NTOSKRNL.EXE and HAL.DLL, providing them with the hardware information gathered by NTDETECT.COM. This allows the Windows kernel to understand what hardware exists and how it should communicate with it.
Without NTDETECT.COM, the kernel would essentially be walking into a room blindfolded.
The Feminine Nerd Summary 💜
NTLDR = The conductor
BOOT.INI = The roadmap
NTDETECT.COM = The hardware scout
NTOSKRNL.EXE = The king
Or, in true XP fashion:
“Before the king arrives, somebody has to walk around the castle and figure out what’s actually there.”
That somebody was NTDETECT.COM. 💜🤓
Next comes one of the most important files in the entire operating system: NTOSKRNL.EXE.
The name stands for NT Operating System Kernel, and it is the heart of Windows XP. This component is responsible for process scheduling, memory management, hardware communication, security enforcement, and countless other core operating system functions. If Windows were a kingdom, NTOSKRNL.EXE would undoubtedly wear the crown.
Working alongside the kernel is HAL.DLL, the Hardware Abstraction Layer. HAL acts as a translator between Windows and the underlying hardware. Instead of every component needing to understand every motherboard, processor, or chipset, HAL provides a consistent interface that simplifies hardware communication.
Once the kernel and HAL are initialized, Windows starts SMSS.EXE, the Session Manager Subsystem. SMSS creates the system session, initializes environment variables, and launches several core subsystems required by the operating system.
After the system session has been established, WINLOGON.EXE takes over. This component is responsible for handling user authentication, logon screens, and security-related interactions. If you’ve ever pressed Ctrl + Alt + Delete to log on to a Windows XP machine, WINLOGON was waiting for you on the other side.
Finally, the desktop environment loads, the familiar Windows XP interface appears, and users are greeted by the iconic Bliss wallpaper and startup sound that defined an entire generation of computing.
What makes Windows XP so significant is that DOS is completely absent from this process. There is no IO.SYS. No MSDOS.SYS. No COMMAND.COM acting as the foundation underneath Windows.
Instead, the startup process belongs entirely to Windows itself.
The operating system is finally self-sufficient.
Windows 98: “I need DOS to start.”
Windows XP: “I am the operating system.”
Yours truly,
Lady Itris | The Feminine Nerd 💜