Loading the shell

After the processing of all the device drivers, the user's shell loads. The application that makes up the shell is actually defined by a shell = line in system.ini, the default being explorer.exe. If the current shell ever crashes and is removed from RAM, then explorer.exe will be loaded. Explorer checks the Registry to see what desktop components are supposed to be displayed and then checks the HKEY_LOCAL_MACHINE\Software\ Microsoft\Windows\CurrentVersion\RunServices key in the Registry to auto-start other applications. One of the services started at this point is the network service. When the network service is started up, you will be presented with a logon screen.

After loading the requested services, Explorer then executes any entries that it finds in the Registry in the HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\RunOnce key. Each entry under runonce is executed sequentially, waiting for each to finish before moving on to the next. When these are completed, Explorer then moves on to the run and load entries in win.ini to launch additional applications, followed by the run entries in the Registry, found in HKEY_LOCAL_MACHINE\Software\ Microsoft\Windows\CurrentVersion\Run, and finally the Startup group from the Start menu, Start → Programs → Startup.

This process is almost identical for all versions of Windows that are based on Windows NT. Some versions may differ slightly, whereas the Windows 9x boot process is very different. For more on the Windows 9x boot process, proceed to the "Understanding the Boot Process for MS-DOS and Windows 9x" section, covered next in this tutorial.