Chapter 15 PC Troubleshooting 673
the drivers and devices loaded so far and through the rest of the boot operation.
This information is used for the
Last known good configuration
boot option when
troubleshooting the system or attempting to recover from a system failure. The
kernel then loads the Session Manager (smss.exe).
Session Manager phase
In this phase, the boot process switches from text mode to graphic mode. A
progress bar appears at the bottom of the screen. The session manager continues
to run in the background until the computer is shut down.
The Session Manager starts and runs an abbreviated version of Chkdsk
and determines if the system volumes and partitions are in working order. The
Session Manager is also responsible for loading the page file or virtual memory.
The page file supplements the amount of RAM installed on the computer.
Microsoft does not allow third-party venders’ software applications to
directly access hardware and certain operating system files. But when access is
needed by the third-party software applications, the Session Manager manages
the activities. If the startup process fails here, you will see a Microsoft system
blue screen error. Recall that a blue screen error is a full-screen text message
describing the error on a plain, blue background. There will be a cryptic error
code that can be used to conduct a search at the Microsoft Web site to find the
most likely cause. Microsoft has a very extensive collection of troubleshooting
information at their TechNet Web site. The last phase of the startup process is
called the logon phase.
Logon phase
In this phase, the windows logon file (winlogon.exe) is executed, and the
Windows Logon dialog box appears. A user typically enters his or her logon
name and password to proceed to the operating system desktop.
After a successful logon, the
lsass.exe
file loads and runs. This file is the Local
Security Authority (LSA). Then, the service subsystem file,
services.exe
loads
and runs. The exact services loaded and started is determined by the computer’s
configuration and the user’s credentials. Only the services the user is allowed
to access will start. If there is only one default user and the computer is not
connected to a network with a server, the user will be able to access and run all
services for the computer. If a user has a limited account, they will only be able to
run services allocated by the system administrator.
Startup programs are loaded and run at this point. Any problems such as the
computer freezing up or a very long delayed appearance of the user desktop are
associated with the startup files and services. If a computer user installs many
programs over a period of time, the appearance of the desktop after completing
logon will take more time.
After a successful logon, the boot process is considered a success. The registry
is updated and will become the registry reference for the “Last known good
configuration.” A failure of the system after logon is usually a sign of a failed
service or a software startup application.
One of the best utilities for analyzing failures after logon is the System
Configuration Utility (msconfig.exe). You can select and isolate services and
software applications that might be causing the problem.