Written by Claus Witjes and Arne Stremlau

This article about the Windows boot process is part of a continuing series on OS boot and user logon delays on Windows computers joined to Active Directory domains. Related articles describing known issues and tools to troubleshoot slow boots and user logons can be found in the following links:

http://social.technet.microsoft.com/wiki/contents/articles/10130.root-causes-for-slow-boots-and-logons.aspx
http://social.technet.microsoft.com/wiki/contents/articles/10128.tools-for-troubleshooting-slow-boots-and-slow-logons.aspx
http://social.technet.microsoft.com/wiki/contents/articles/10123.troubleshooting-slow-operating-system-boot-times-and-slow-user-logons.aspx
A question that Premier Field Engineers often get asked onsite is “Why do our users wait so long for Windows to boot that they sometimes have time to get a cup of coffee?”
The reality is that there are a myriad of reasons including hardware performance, network performance, the amount of the workloads added by administrators as well as inefficiencies in Microsoft and ISV applications and OS components. 
The goal of this article is to give readers an overview of the Windows boot process so that you can better troubleshoot a slow OS start or slow user logon that is caused by delays in the OS boot process. Related problems about resuming from sleep, wake from hibernate, or OS shutdown processes are not covered in this article.

Boot Process Overview

Fast OS startup performance is critical for a good user experience. The time required to boot the operating system on a given computer to the point where the user can start working is one of the most important benchmarks for Windows client performance. The Windows boot process consists of several phases which are explained in more detail by the picture and supporting text below.

The Windows Performance Toolkit (included in the Windows 7.1 SDK) allows you to investigate most of the boot phases (except for BIOS Initialization and OS Loader).

BIOS Initialization

During the BIOS Initialization phase, the platform firmware identifies and initializes hardware devices, and then runs a power-on self-test (POST). The POST process ends when the BIOS detects a valid system disk, reads the master boot record (MBR), and starts Bootmgr.exe. Bootmgr.exe finds and starts Winload.exe on the Windows boot partition, which begins the OSLoader phase [1].
The BIOS version, the BIOS configuration and the firmware of the computer hardware components can have an impact on the overall boot performance. There is no way to trace this phase using the Windows Performance Toolkit. You need to manually measure the time. In order to optimize or troubleshoot this early phase in the overall computer startup process, make sure to update the BIOS version and firmware of all hardware components to the latest versions. In addition check the BIOS configuration (device boot order, PXE boot-enabled, Quick/Fast boot (POST check) enabled, AHCI settings, and so on).
Be careful changing the BIOS configuration or updating the firmware/UEFI/BIOS versions. Read the hardware vendor manuals carefully because misconfigurations and failed updates can cause complete system outages. Create a backup of your system and data beforehand.

OS Loader

During the OSLoader phase, the Windows loader binary (Winload.exe) loads essential system drivers that are required to read minimal data from the disk and initializes the system to the point where the Windows kernel can begin execution. When the kernel starts to run, the OSloader loads the system registry hive and additional drivers that are marked as BOOT_START into memory. [1]
This phase is mainly impacted by boot start drivers. While a delay caused by a dual boot menu would be easy to fix, make sure that all boot start drivers are signed and up-to-date.
To identify boot start drivers which are not signed:

1. Create a boot trace using the Windows Performance Toolkit. For more information about how to create a trace, see slow boot and logon analysis articles for analysis.
2. Run xperf –i <boottrace.etl> -o bootevents.txt –a dumper
3. Findstr /C:”I-DCStart” bootevents.txt > bootevents.csv
4. Open the bootevents.csv using Excel and run signtool verify /v <driver>
   Signtool.exe is part of the Windows SDK.
5. If you find a driver which is not signed, look for driver updates.

OS Initialization

During the OS Initialization phase, most of the operating system work occurs. This phase involves kernel initialization, Plug and Play activity, service start, logon, and Explorer (desktop) initialization. The OS Initialization can be divided into four subphases. Each subphase has unique characteristics and performance vulnerabilities. [1]
After you have taken a boot trace the different subphases are shown as follows in XPERFVIEW.EXE:

The PostBoot phase

The ReadyBootPrefetcher

While ReadyBoot is usually turned on for classic harddisks, it is off for fast SSDs, of if WinSAT disk score is > 6.0.
One way to analyze the prefetcher activities is to run xperf.exe from the Windows Performance Toolkit.
Xperf –i  <boottrace.etl> - o prefetcher.txt –a bootprefetch – summary

To “train” a system, you can run the xbootmgr.exe with the –prepsystem command option.
The above should give you some insight into where to start looking for issues during the Windows boot phase, as it will help you identify the correction section to start troubleshooting.
A recommendation is to check the hardware platform thoroughly by updating the BIOS and checking hard drive performance with benchmarking tools prior to searching for the problem on the OS layer.

Additional references

[1] Windows On/Off Transition Performance Analysis, http://msdn.microsoft.com/en-us/windows/hardware/gg463386.aspx

[2] Windows On/Off Transitions Solutions Guide, http://msdn.microsoft.com/en-us/windows/hardware/gg463230.aspx