How Windows PE Works

  • Article

Windows PE version 2.0 is a minimal Win32 subsystem with limited services, based on the Windows Vista kernel running in protected mode.

Windows PE Optimal Environment

An optimal environment for running Windows PE has the following characteristics:

  • Sufficient RAM for RAM disk boot.
  • If you choose to use a USB Flash Drive (UFD) device, it must meet all the requirements for booting Windows PE.
  • The appropriate network adapter and mass storage drivers available, either on the Windows PE CD or available to place on a customized Windows PE image.
  • Physical access to the computer, or, if using Emergency Management Services (EMS) to use Windows PE in the configuration of a remotely administered server, the computer properly supports EMS.
  • If you choose to use Windows DS, the server must run Windows Server 2003 RIS server, and the destination computers must have a network adapter that enables PXE or one that is supported by the Windows DS start disk.

Order of Operations in Windows PE

The boot process of Windows PE is as follows.

  1. The boot sector on the particular media is loaded. Control is passed to Bootmgr. Bootmgr extracts basic boot information from the Boot Configuration Data (BCD) and passes control to winload.exe that is contained in Boot.wim. Winload.exe then loads the appropriate Hardware Abstraction Layer (HAL), and loads the System registry hive and necessary boot drivers. After it finishes loading, it prepares the environment to execute the kernel, Ntoskrnl.exe.

Note

If you start Windows PE from read-only media such as a CD, Windows PE stores the registry hives in memory so that applications can write to the registry. Any changes made to the registry by the applications do not persist across different Windows PE sessions.

  1. Ntoskrnl.exe is executed and finishes the environment setup. Control is passed to the Session Manager (SMSS).
  2. SMSS loads the rest of the registry, configures the environment to run the Win32 subsystem (Win32k.sys) and its various processes. SMSS loads the Winlogon process to create the user session, and then starts the services and the rest of the non-essential device drivers and the security subsystem (LSASS).
  3. Winlogon.exe runs setup based on the registry value HKLM\SYSTEM\Setup\CmdLine. Winpeshl.exe will launch %SYSTEMDRIVE%\sources\setup.exe if it exists, otherwise it looks for an application specified in %SYSTEMROOT%\system32\winpeshl.ini. If no application is specified, Winpeshl.exe will execute cmd /k %SYSTEMROOT%\system32\startnet.cmd. By default, Windows PE contains a Startnet.cmd file which will launch Wpeinit.exe. Wpeinit.exe loads network resources and coordinates with networking components like DHCP.
  4. When Wpeinit.exe completes, the Command Prompt window is displayed. The boot process of Windows PE is complete.

See Also

Concepts

What is Windows PE?
Windows PE Tools and Settings