Windows 7 / Getting Started

---

Tracking and Configuring Power On and Resume

Knowing the sequence of events for a cold start of a computer from power on through log on can help you understand exactly how your computer works. When you press the power button to turn on your computer, many events happen in the background:

1. The firmware interface performs a Power On Self Test (POST) to preliminarily configure the computer and then performs setup to initialize the computer.
   NOTE A cold start is the initial power on of a computer. The sequence of events varies if the computer is resuming from sleep, standby, or hibernation, as well as if you are starting an operating system other than Windows or a Windows operating system other than Windows Vista, Windows 7, or Windows Server 2008.
2. The firmware interface passes control to the operating system loader, which in this case is the boot manager. The boot manager starts the boot loader. The boot loader uses the firmware interface's boot services to complete operating system boot and then load the operating system.
3. The operating system loads, which involves the following:
   • Loading (but not running) the operating system kernel, Ntoskrnl.exe
   • Loading (but not running) the hardware abstraction layer (HAL), Hal.dll
   • Loading the HKEY_LOCAL_MACHINE\SYSTEM registry hive into memory (from %SystemRoot%\System32\Config\System)
   • Scanning the HKEY_LOCAL_MACHINE\SYSTEM\Services key for device drivers and then loading (but not initializing) the drivers that are configured for the boot class into memory
     NOTE In this context, drivers are also services. This means that both device drivers and system services are prepared.
   • Enabling memory paging
4. The boot loader passes control to the operating system kernel. The kernel and the HAL initialize the Windows executive, which in turn processes the configuration information stored in the HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet hive and then starts device drivers and system services.
5. The kernel starts the Session Manager (Smss.exe). The session manager:
   • Initializes the system environment by creating system environment variables.
   • Starts the Win32 subsystem (Csrss.exe). Here, Windows switches the display output from text mode to graphics mode.
   • Starts the Windows Logon Manager (Winlogon.exe), which in turn starts the Services Control Manager (Services.exe) and the Local Security Authority (Lsass.exe) and waits for a user to log on.
   • Creates any additional paging files that are required.
   • As necessary, performs delayed renaming of in-use files that were updated in the previous session.
6. The Windows Logon Manager waits for a user to log on. The logon user interface and the default credential provider collect the user name and password and pass this information to the Local Security Authority for authentication.
7. The Windows Logon Manager runs Userinit.exe and the Windows Explorer shell. Userinit.exe initializes the user environment by creating user environment variables, running startup programs, and performing other essential tasks.

Knowing this event sequence can help you identify the source of startup problems. Keep the following in mind:

• If your computer fails during the Power On Self Test's preliminary configuration, the likely cause of the problem is hardware failure or a missing device.
• If your computer fails during the setup initialization, the likely cause of the problem is the firmware configuration, the disk subsystem, or the file system.
• If your computer fails during the boot loader process, BCD data, improper OS selection for loading, or an invalid boot loader are the likely cause of the problem.
• If your computer fails during kernel and HAL initialization, driver or service configuration or service dependencies are the likely cause of the problem.
• If your computer fails before logon and during Session Manager setup, the graphics display mode, system environment, or component configuration are the likely cause of the problem.

Understanding how your computer resumes is equally important. During a resume from sleep, standby, or hibernation, your computer's advanced power settings determine how the computer turns itself back on. A computer's motherboard chipset, firmware, and operating system must support Advanced Configuration and Power Interface (ACPI) for the related advanced power state features to work. ACPI-aware components track the power state of the computer. An ACPI-aware operating system can generate a request that the system be switched to a different power state, and the firmware interface responds by enabling the requested power state.

The six different power states range from S0 (completely powered on and fully operational) to S5 (completely powered off). Everything in between is a sleep state. S1, S2, and S3 are low-power consumption states in which some or all contexts are maintained in memory. S4 is the no-power hibernate state in which context data is written to disk.

Motherboard chipsets support specific power states. One motherboard might support the S0, S1, S4, and S5 states, whereas another might support the S0, S1, S3, S4, and S5 states. As a computer user, you don't need to know the exact specifics of each state. Just remember this:

• S0 means the computer is on.
• S1, S2, and S3 mean the computer is in a sleep state but still using some power.
• S4 means the computer is hibernating and not using power.
• S5 means the computer is off.

Your computer's firmware interface has related power management settings. You can use After Power Failure, AC Recovery, or a similar setting to specify what the computer does after a power failure. If you want the computer to remain off after power is restored, set the computer to stay off. If you want the computer to go back to the state it was in before power failed, set the computer to use the last state. If you want the computer to turn itself on after a power failure, set the computer to power on.

Another power option you may see is Wake On LAN From S5 or Auto Power On. This type of option determines the action taken when the system power is off and a power management wake event occurs. If you configure this option, you'll be able to specify whether the computer stays off or powers on.

You may also have control over whether S1 or S3 suspend mode is used. From a user perspective, it really doesn't matter whether S1 or S3 is used. However, from a computer perspective it matters a lot, and you'll only want to switch modes if you are trying to correct a resume problem. For example, if your computer is having problems resuming from a sleep state, a troubleshooting option may involve changing the suspend mode.

If you encounter startup problems just prior to or after logon, the issue is probably related to a misconfigured service or startup application. To temporarily resolve this so you can log on, you can disable services and startup applications, as discussed later in this tutorial.