NTLDR (

abbreviation An abbreviation (from Latin ''brevis'', meaning ''short'') is a shortened form of a word or phrase, by any method. It may consist of a group of letters or words taken from the full version of the word or phrase; for example, the word ''abbrevia ...

of ''NT loader'') is the

boot loader A bootloader, also spelled as boot loader or called boot manager and bootstrap loader, is a computer program that is responsible for booting a computer. When a computer is turned off, its softwareincluding operating systems, application code, a ...

for all releases of

Windows NT Windows NT is a proprietary graphical operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs. Time-sharing operating systems sc ...

operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs. Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...

from 1993 with the release of

Windows NT 3.1 Windows NT 3.1 is the first major release of the Windows NT operating system developed by Microsoft, released on July 27, 1993. At the time of Windows NT's release, Microsoft's Windows 3.1 desktop environment had established brand recognition ...

up until

Windows XP Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Windows 2000 for high-end and ...

and

Windows Server 2003 Windows Server 2003 is the sixth version of Windows Server operating system produced by Microsoft. It is part of the Windows NT family of operating systems and was released to manufacturing on March 28, 2003 and generally available on April 24, 2 ...

. From

Windows Vista Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, which was released five years before, at the time being the longest time span between successive releases of ...

onwards it was replaced by the

BOOTMGR The booting process of Windows Vista and later versions differ from the startup process part of previous versions of Windows. In this article, unless otherwise specified, what is said about Windows Vista also applies to all later NT operati ...

bootloader. NTLDR is typically run from the primary storage device, but it can also run from portable storage devices such as a

CD-ROM A CD-ROM (, compact disc read-only memory) is a type of read-only memory consisting of a pre-pressed optical compact disc that contains data. Computers can read—but not write or erase—CD-ROMs. Some CDs, called enhanced CDs, hold both comput ...

USB flash drive A USB flash drive (also called a thumb drive) is a data storage device that includes flash memory with an integrated USB interface. It is typically removable, rewritable and much smaller than an optical disc. Most weigh less than . Since firs ...

, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file. NTLDR requires, at the minimum, the following two files to be on the system volume: * , the main boot loader itself * , required for booting an NT-based OS, detects basic hardware information needed for successful boot An additional important file is ''boot.ini'', which contains boot configuration (if missing, NTLDR will default to ''\Windows'' on the first partition of the first hard drive). NTLDR is launched by the volume boot record of system partition, which is typically written to the disk by the Windows or command.

History

Windows NT was originally designed for

ARC ARC may refer to: Business * Aircraft Radio Corporation, a major avionics manufacturer from the 1920s to the '50s * Airlines Reporting Corporation, an airline-owned company that provides ticket distribution, reporting, and settlement services * ...

-compatible platforms, relying on its boot manager support and providing only ''osloader.exe'', a loading program accepting ordinary command-line arguments specifying Windows directory partition, location or boot parameters, which is launched by ARC-compatible boot manager when a user chooses to start specific Windows NT operating system. However, because the

x86 x86 (also known as 80x86 or the 8086 family) is a family of complex instruction set computer (CISC) instruction set architectures initially developed by Intel based on the Intel 8086 microprocessor and its 8088 variant. The 8086 was introd ...

lacked any of the ARC support, the additional layer was added specifically for that platform: custom boot manager code presenting text menu allowing the user to choose from one or more operating system and its options configured in ''boot.ini'' configuration file, prepended by special StartUp module which is responsible for some preparations such as switching the

CPU A central processing unit (CPU), also called a central processor, main processor or just processor, is the electronic circuitry that executes instructions comprising a computer program. The CPU performs basic arithmetic, logic, controlling, and ...

to the protected mode. When a user chooses an operating system from the boot menu, the following command-line arguments are then passed to the part of the ''osloader.exe'' common to all processor architectures: In Windows releases starting from

and

Windows Server 2008 Windows Server 2008 is the fourth release of the Windows Server operating system produced by Microsoft as part of the Windows NT family of the operating systems. It was released to manufacturing on February 4, 2008, and generally to retail on Fe ...

, NTLDR has been split off back to its boot manager and system loader parts: the

Windows Boot Manager The booting process of Windows Vista and later versions differ from the startup process part of previous versions of Windows. In this article, unless otherwise specified, what is said about Windows Vista also applies to all later NT operatin ...

and ''

winload.exe The booting process of Windows Vista and later versions differ from the startup process part of previous versions of Windows. In this article, unless otherwise specified, what is said about Windows Vista also applies to all later NT operati ...

''. The boot manager part has been completely rewritten; it no longer uses ''boot.ini'' as a configuration file, although the ''

bootcfg In computing, bootcfg is a command on Microsoft Windows NT-based operating systems which acts as a wrapper for editing the boot.ini file. Overview The command is used to configure, query, or change Boot.ini file settings. A similar command exist ...

'' utility for modifying boot.ini is still present for the case of multi-boot configurations with Windows versions up to

and

Command-line interface

The bootsect.exe utility program in the

Windows PE Windows Preinstallation Environment (also known as Windows PE and WinPE) is a lightweight version of Windows used for the deployment of PCs, workstations, and servers, or troubleshooting an operating system while it is offline. It is intended t ...

tools has options /nt52 (NTLDR) and /nt60 (Vista and up) to store a NTLDR or Vista boot record in the first sector of a specified partition. The

command Command may refer to: Computing * Command (computing), a statement in a computer language * COMMAND.COM, the default operating system shell and command-line interpreter for DOS * Command key, a modifier key on Apple Macintosh computer keyboards * ...

can be used for

FAT In nutrition science, nutrition, biology, and chemistry, fat usually means any ester of fatty acids, or a mixture of such chemical compound, compounds, most commonly those that occur in living beings or in food. The term often refers spec ...

and

NTFS New Technology File System (NTFS) is a proprietary journaling file system developed by Microsoft. Starting with Windows NT 3.1, it is the default file system of the Windows NT family. It superseded File Allocation Table (FAT) as the preferred fil ...

based

file systems In computing, file system or filesystem (often abbreviated to fs) is a method and data structure that the operating system uses to control how data is stored and retrieved. Without a file system, data placed in a storage medium would be one larg ...

. It replaces the FixFAT and FixNTFS tools.

Example

The following example applies the NTLDR compatible master boot code to the D: volume: C:\>bootsect /nt52 D:

Startup process

When a PC is powered on its

BIOS In computing, BIOS (, ; Basic Input/Output System, also known as the System BIOS, ROM BIOS, BIOS ROM or PC BIOS) is firmware used to provide runtime services for operating systems and programs and to perform hardware initialization during the ...

follows the configured boot order to find a bootable device. This can be a harddisk, floppy, CD/DVD, network connection, USB-device, etc. depending on the BIOS. In the case of a floppy the BIOS interprets its boot sector (first sector) as code, for NTLDR this could be a NTLDR boot sector looking for the ntldr file on the floppy. For a harddisk the code in the

Master Boot Record A master boot record (MBR) is a special type of boot sector at the very beginning of partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept of MBR ...

(first sector) determines the active partition. The code in the boot sector of the active partition could then be again a NTLDR boot sector looking for ntldr in the root directory of this active partition. In a more convoluted scenario the active partition can contain a Vista boot sector for the newer Vista boot manager with an entry pointing to another partition with a NTLDR boot sector. When booting, the loader portion of NTLDR does the following in order: #Accesses the file system on the boot drive (either

or New Technology File System,

). #If Windows was put in the hibernation state, the contents of ''hiberfil.sys'' are loaded into memory and the system resumes where it left off. #Otherwise, reads ''boot.ini'' and prompts the user with the boot menu accordingly. #If a non NT-based OS is selected, NTLDR loads the associated file listed in ''boot.ini'' (''bootsect.dos'' if no file is specified or if the user is booting into a DOS based OS) and gives it control. #If an NT-based OS is selected, NTLDR runs '' ntdetect.com'', which gathers information about the computer's hardware. (If ''ntdetect.com'' hangs during hardware detection, there is a debug version called ''ntdetect.chk'' that can be found on Microsoft support.) #Starts ''

Ntoskrnl.exe ntoskrnl.exe (short for Windows NT operating system kernel executable), also known as the kernel image, contains the kernel and executive layers of the Microsoft Windows NT kernel, and is responsible for hardware abstraction, process handling, and ...

'', passing to it the information returned by ''ntdetect.com''.

boot.ini

NTLDR's first action is to read the Boot.ini file. NTLDR allows the user to choose which operating system to boot from at the menu. For NT and NT-based operating systems, it also allows the user to pass preconfigured options to the kernel. The menu options are stored in ''boot.ini'', which itself is located in the root of the same disk as NTLDR. Though NTLDR can boot DOS and non-NT versions of Windows, boot.ini cannot configure their boot options. For NT-based OSs, the location of the operating system is written as an

Advanced RISC Computing Advanced RISC Computing (ARC) is a specification promulgated by a defunct consortium of computer manufacturers (the Advanced Computing Environment project), setting forth a standard MIPS RISC-based computer hardware and firmware environment. ...

(ARC) path. ''boot.ini'' is protected from user configuration by having the following

file attribute File attributes are a type of meta-data that describe and may modify how files and/or directories in a filesystem behave. Typical file attributes may, for example, indicate or specify whether a file is visible, modifiable, compressed, or encrypted. ...

s: system, hidden, read-only. To manually edit it, the

user Ancient Egyptian roles * User (ancient Egyptian official), an ancient Egyptian nomarch (governor) of the Eighth Dynasty * Useramen, an ancient Egyptian vizier also called "User" Other uses * User (computing), a person (or software) using an ...

would first have to remove these attributes. A more secure fashion to edit the file is to use the ''bootcfg'' command from a console. ''bootcfg'' will also relock the file (setting the file back to system, hidden, and read-only). Additionally, the file can be edited within Windows using a text editor if the folder view option "Show hidden files and folders" is selected, the folder view option "Hide protected operating system files" is unchecked, and the "Read-only" option is unchecked under the file's properties. ''bootsect.dos'' is the boot sector loaded by NTLDR to load DOS, or if there is no file specified when loading a non NT-based OS.

Example

An example of a ''boot.ini'' file: oot loadertimeout=40 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS perating systemsmulti(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect If the boot loader timeout option in ''boot.ini'' is set to 0, the NTLDR boot menu does not appear. Extreme caution should be taken when modifying the boot loader, as erroneous information can result in an OS that fails to boot.

NT kernel switches

* — Forces

-based systems to ''increase'' the virtual address space allocated for user programs to 3 GB, and to ''decrease'' to 1 GB allocated to the

kernel Kernel may refer to: Computing * Kernel (operating system), the central component of most operating systems * Kernel (image processing), a matrix used for image convolution * Compute kernel, in GPGPU programming * Kernel method, in machine learnin ...

and to executive components. Used for some programs that require more than the standard 2 GB allocated to user programs and 2 GB allocated to the system. Some configurations of

that run

virtual memory In computing, virtual memory, or virtual storage is a memory management technique that provides an "idealized abstraction of the storage resources that are actually available on a given machine" which "creates the illusion to users of a very l ...

-intensive applications such as database servers or Microsoft Exchange Server 2003 may require this switch or may benefit from improved performance. Activating this option may break VMR-9 video. Activating this option may also cause audio problems with Creative SB X-Fi series sound cards with (X-Fi Gamer / X-Fi Titanium @ WINXP 32-bit 3/2012). These problems may be connected to the way that Creatives drivers handle memory over 2 GB. * — Forces the system into standard 640×480 16-color

VGA Video Graphics Array (VGA) is a video display controller and accompanying de facto graphics standard, first introduced with the IBM PS/2 line of computers in 1987, which became ubiquitous in the PC industry within three years. The term can no ...

mode by using a video

device driver In computing, a device driver is a computer program that operates or controls a particular type of device that is attached to a computer or automaton. A driver provides a software interface to hardware devices, enabling operating systems and ot ...

that is compatible with any

video adapter A graphics card (also called a video card, display card, graphics adapter, VGA card/VGA, video adapter, display adapter, or mistakenly GPU) is an expansion card which generates a feed of output images to a display device, such as a computer moni ...

. If the operating system fails to load due to a faulty or incorrectly configured video driver, this switch allows the system to load, so the user may then remove, update, or roll back the video driver causing the problem. Using this switch in conjunction with the switch helps to determine the driver that is triggering a failure. * — Sets the

baud rate In telecommunication and electronics, baud (; symbol: Bd) is a common unit of measurement of symbol rate, which is one of the components that determine the speed of communication over a data channel. It is the unit for symbol rate or modulati ...

of the debug port that is used for kernel debugging. Use of this switch automatically enables the switch. Specifies an override for the default baud rate (19200) at which a remote kernel debugger host will connect. Example: . * — Turns on boot logging to a file named . * — Displays an alternate 640×480 16-color custom

bitmap In computing, a bitmap is a mapping from some domain (for example, a range of integers) to bits. It is also called a bit array A bit array (also known as bitmask, bit map, bit set, bit string, or bit vector) is an array data structure that c ...

. The bitmap must be saved in the \Windows directory with the name . Use with the switch. * — Specifies the amount of memory, in megabytes, that Windows cannot use. Use this parameter to confirm a performance problem or other problems that are related to

RAM Ram, ram, or RAM may refer to: Animals * A male sheep * Ram cichlid, a freshwater tropical fish People * Ram (given name) * Ram (surname) * Ram (director) (Ramsubramaniam), an Indian Tamil film director * RAM (musician) (born 1974), Dutch * Ra ...

depletion. * — Use with the switch and the switch to selects the

IEEE 1394 IEEE 1394 is an interface standard for a serial bus for high-speed communications and isochronous real-time data transfer. It was developed in the late 1980s and early 1990s by Apple in cooperation with a number of companies, primarily Sony an ...

interface channel (numbered 0 to 62) through which kernel debugging communications will flow. * — Loads the

kernel debugger A kernel debugger is a debugger present in some operating system kernels to ease debugging and kernel development by the kernel developers. A kernel debugger might be a stub implementing low-level operations, with a full-blown debugger such as GN ...

at OS startup, but it remains inactive until a Stop error occurs. With this switch, the COM port can be used for normal operations while Windows is running. If Windows crashes, the switch converts the port to a debug port. (This action turns on remote debugging.) * — Turns on the

when Windows starts. Unlike the switch, uses the COM port whether you use debugging or not. * — Specifies the

COM port COM (communication port) is the original, yet still common, name of the serial port interface on PC-compatible computers. It can refer not only to physical ports, but also to emulated ports, such as ports created by Bluetooth or USB adapters. ...

to use for the debug port. By default, uses COM2 if it exists. Otherwise, the default is COM1. Use of this switch automatically enables the switch. * — Turns off serial and bus mouse detection for the specified port(s), or for all ports if none are specified. Use this switch when there is a component other than a mouse attached to a serial port during the startup process. Ports may be separated with commas to turn off more than one port. (Note: In earlier versions of Windows, including

Windows NT 4.0 Windows NT 4.0 is a major release of the Windows NT operating system developed by Microsoft and oriented towards businesses. It is the direct successor to Windows NT 3.51, which was released to manufacturing on July 31, 1996, and then to retail ...

, this switch was named .) * — Defines the

Hardware Abstraction Layer Hardware abstractions are sets of routines in software that provide programs with access to hardware resources through programming interfaces. The programming interface allows all devices in a particular class ''C'' of hardware devices to be acce ...

that is loaded at startup. This switch is useful to try out a different HAL before you rename the file to . This switch is also useful when you want to try to switch between starting in multiprocessor mode and starting in single processor mode. To do this, use this switch with the switch. filename must be in System32 directory. It can be a simple file, hard link, but not a symbolic link or a junction point. * — Defines the kernel that is loaded at startup. With this switch, the

can switch between a debug-enabled kernel that is full of debugging code and a regular kernel. Same limitations for filename location and type as for /HAL switch. * — Specifies the maximum amount of

, in megabytes, that Windows can use. However, the switch does not account for memory holes. Therefore, it is recommended to use the switch instead. * — This option is used by

Windows Preinstallation Environment Windows Preinstallation Environment (also known as Windows PE and WinPE) is a lightweight version of Windows used for the deployment of PCs, workstations, and servers, or troubleshooting an operating system while it is offline. It is intended t ...

(WinPE) and loads the Registry SYSTEM hive as a volatile hive such that changes made to it in memory are not saved back to the hive image. * — Turns off debugging. This scenario can cause a Stop Error if a program has a debug hardcoded breakpoint in its software. * — This option is only available on 32-bit versions of Windows when running on processors supporting

Data Execution Prevention In computer security, executable-space protection marks memory regions as non-executable, such that an attempt to execute machine code in these regions will cause an exception. It makes use of hardware features such as the NX bit (no-execute bit ...

(DEP). It enables DEP, which results in the memory manager marking pages containing data as no-execute so that they cannot be executed as code. This can be useful for preventing malicious code from exploiting buffer overflow bugs with unexpected program input in order to execute arbitrary code. No-execute protection is always enabled on 64-bit versions of Windows on processors that support no-execute protection. There are several options the

can specify with this switch: ** — Enables DEP for core system images and those specified in the DEP configuration dialog. ** — Enables DEP for all images except those specified in the DEP configuration dialog. ** — Enables DEP on all images. ** — Disables DEP. * — Displays the device driver names while they are being loaded. Use with the switch to determine the driver that is triggering a failure. * — Forces Ntldr to load the non-

Physical Address Extension In computing, Physical Address Extension (PAE), sometimes referred to as Page Address Extension, is a memory management feature for the x86 architecture. PAE was first introduced by Intel in the Pentium Pro, and later by AMD in the Athlon process ...

(PAE) version of the Windows kernel, even if the system is detected as supporting

PAEs and has more than 4 GB of physical memory. * — (Obsolete on all versions post-

) Replaced by the absence of the switch. Disables serial mouse detection on the specified COM ports. Using without specifying a COM port disables serial mouse detection on all COM ports. * — Sets the number of

processors A central processing unit (CPU), also called a central processor, main processor or just processor, is the electronic circuitry that executes instructions comprising a computer program. The CPU performs basic arithmetic, logic, controlling, and ...

that Windows will run at startup. With this switch, the

can force a multiprocessor system to use only the quantity of processors (number) that you specify. Useful for troubleshooting performance problems and defective CPUs. * — Equivalent to using . Causes Windows to use only one CPU on a multiprocessor system. * — Enables

support. In Safe Mode, the computer starts by using normal kernels, even if the switch is specified. * — For

-based systems, this stops the

from dynamically assigning hardware input, hardware output, and

interrupt request In a computer, an interrupt request (or IRQ) is a hardware signal sent to the processor that temporarily stops a running program and allows a special program, an interrupt handler, to run instead. Hardware interrupts are used to handle events s ...

resources to

PCI PCI may refer to: Business and economics * Payment card industry, businesses associated with debit, credit, and other payment cards ** Payment Card Industry Data Security Standard, a set of security requirements for credit card processors * Pro ...

devices. Instead, the

configures the devices. * — Turns on

Emergency Management Services Emergency Management Services (EMS) provides an RS-232 accessible serial console interface to the bootloader menu on modern versions of Microsoft Windows. During system installation of Windows Server 2003, EMS is enabled per default in case BIOS se ...

(EMS) on a Windows Server 2003, Enterprise Edition-based computer. To turn on EMS by editing the Boot.ini on an

-based computer, edit both the oot loadersection and the perating systemssection of the Boot.ini file. * — Causes Windows to start in Safe Mode. You must include the colon plus one of the three types listed above. An additional option the

can append is , which tells Windows to use the program specified by the value as the graphical shell rather than to use the default, which is Windows Explorer. The user can also combine other parameters with . The following examples illustrate the parameters that are in effect when you select a Safe Mode option from the startup recovery menu. (Note: The , , and switches are not required with any one of these settings, but the switches can help with troubleshooting.) ** Safe Mode () — Default: Uses a minimal set of

s and services to start Windows.A description of the Safe Mode Boot options in Windows XP
/ref> ** Safe Mode with Networking () — Default mode together with the drivers necessary to load networking. ** Safe Mode with Command Prompt () — Default mode, except that

Cmd.exe Command Prompt, also known as cmd.exe or cmd, is the default command-line interpreter for the OS/2, eComStation, ArcaOS, Microsoft Windows (Windows NT family and Windows CE family), and ReactOS operating systems. On Windows CE .NET 4.2, Wind ...

starts instead of

Windows Explorer File Explorer, previously known as Windows Explorer, is a file manager application that is included with releases of the Microsoft Windows operating system from Windows 95 onwards. It provides a graphical user interface for accessing the file ...

. ** Windows in

Directory Services Restore Mode Directory Services Restore Mode (DSRM) is a function on Active Directory Domain Controllers to take the server offline for emergency maintenance, particularly restoring backups of AD objects. It is accessed on Windows Server via the advanced startu ...

() — (This mode is valid only for Windows-based domain controllers.) Performs a directory service repair. * — Disables the graphical boot screen and uses the NT4 style text-boot, listing the Windows build number, version number, etc. In Windows 2000 and XP, the text is rendered inside the CHKDSK bitmap (and with a progress bar in 2000). * — Specifies that Windows uses the Power Management Timer (PM_TIMER) timer settings instead of the

Time Stamp Counter The Time Stamp Counter (TSC) is a 64-bit register present on all x86 processors since the Pentium. It counts the number of CPU cycles since its reset. The instruction RDTSC returns the TSC in EDX:EAX. In x86-64 mode, RDTSC also clears the upper 3 ...

(TSC) timer settings if the processor supports the PM_TIMER settings. By default, Windows Server 2003 Service Pack 2 (SP2) uses the PM timer for all multiprocessor APIC or

ACPI Advanced Configuration and Power Interface (ACPI) is an open standard that operating systems can use to discover and configure computer hardware components, to perform power management (e.g. putting unused hardware components to sleep), auto c ...

HALs. If you are not running Windows Server 2003 SP2, you must force the computer to use the PM timer by using the switch.Programs that use the QueryPerformanceCounter function may perform poorly in Windows Server 2000, in Windows Server 2003, and in Windows XP
/ref> * — Customizes the amount of memory, in megabytes, that is allocated to processes when using the switch. This switch permits more

page table A page table is the data structure used by a virtual memory system in a computer operating system to store the mapping between virtual addresses and physical addresses. Virtual addresses are used by the program executed by the accessing process, ...

entry kernel memory but still maintains almost 3 GB of process memory space. * — Directs Ntldr to boot the Windows boot sector stored in . * — Directs Ntldr to boot the MS-DOS boot sector stored in . * — Instructs the Windows core time function to ignore the year that the computer's real-time clock reports and instead use the one indicated. Example: . (This switch was created to assist in

Y2K The year 2000 problem, also known as the Y2K problem, Y2K scare, millennium bug, Y2K bug, Y2K glitch, Y2K error, or simply Y2K refers to potential computer errors related to the formatting and storage of calendar data for dates in and after ...

testing.)

References

External links

How to edit the Boot.ini file in Windows XP

BOOT.INI and ARC Path Naming Conventions and Usage
* MS Knowledge Base help on "NTLDR Is Missing" error message i
Windows 2000
an
Windows XP
(als

How to fix "NTLDR Is Missing" error

by Daniel B. Sedory {{DEFAULTSORT:Ntldr Windows components Boot loaders

History

Command-line interface

Example

Startup process

boot.ini

Example

NT kernel switches

See also

References

External links