Appendix E: Startup Sequence Files

Service Group Order Listing

By viewing the ServiceGroupOrder, you can determine to some extent the order in which device drivers should load and initialize. Individual drivers that are members of a service group will load in the order listed below.

HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Control \Service
GroupOrder:

• SCSI miniport

• Port

• Primary disk

• SCSI class

• SCSI CDROM class

• Filter

• Boot file system

• Base

• Pointer Port

• Keyboard Port

• Pointer Class

• Keyboard Class

• Video Init

• Video

• Video Save

• File system

• Event log

• Streams Drivers

• NDIS

• TDI

• NetBIOSGroup

• SpoolerGroup

• NetDDEGroup

• Parallel arbitrator

• Extended base

• RemoteValidation

• PCI Configuration

Drivers Initiated as Shown by a Kernel Debugger

Viewing a Windows NT computer as it initializes using a Kernel debugger can be useful when you need to determine whether a device driver is loading in the proper order, or is loading at all. The table below is a sample listing of drivers during a Windows NT computer initialization. This listing was created using a Kernel debugger.

Windows NT Services Automatically Started

These services were configured to start automatically on the Windows NT computer. Knowing the services that should start, and the files that are referenced by each service, can be beneficial in isolating and determining problems and resolutions.

• Alerter

• Computer Browser

• Event Log

• License Logging Service

• Messenger

• Net Logon

• NT LM Security Support Provider

• Server

• Spooler

• TCP/IP NetBIOS Helper

• Workstation (Lanman Workstation)

Windows NT Service Dependencies

The following table lists these services, the DLL each service relies upon, and any dependencies associated with the service. By knowing the dependencies and files, you can troubleshoot a problem more effectively. For example, if you stop the Workstation service, the Alerter, Messenger, and Net Logon services are also stopped, as they are dependent upon the Workstation service. If an error occurs when you try to start the Workstation service, any of these files could be missing or corrupt. This is also why, if you start one of these services, the Service Control Manager will automatically start the Workstation service if it is not already running.

DLLs Called by Services

Occasionally, when you try to start a service, it fails with a message: "System error 126 has occurred. The specified module could not be found." This message may mean that a dependent DLL was not found. By knowing what DLLs are required for the Windows NT services, you can greatly reduce troubleshooting of Windows NT files. The following table lists the DLLs used by the executable files that represent the above Windows NT services.

It is also important to realize that, often, one DLL depends on or uses another DLL. The next table lists the DLLs that are used by each of the DLLs in the previous table.

Service Dependencies

In this final section, all this information can be tied together. A sample service, Computer Browser, is used to follow the chain of files loaded, including dependencies, during the service initialization.

In order to load the Computer Browser service, the following files need to be loaded and/or accessed:

Computer Browser (SERVICES.EXE) loads BROWSER.DLL.

Browser depends on LanmanWorkstation, LanmanServer and LMHOSTS.

• LanmanWorkstation (Workstation service, SERVICES.EXE) loads WKSSVC.DLL.

  • LanmanWorkstation depends on TDI (TDI.SYS).

  • TDI.SYS is automatically loaded by the first dependent service, in this case NetBT.SYS.

  • The Workstation service is bound to the network protocol, in this case TCP/IP (TCPIP.SYS).

  • TCP/IP is dependent upon NDIS (NDIS.SYS).

  • TCP/IP is bound to the network adapter card driver, in this case 3Com® Etherlink II® (ELNKII.SYS).

  • The 3Com Etherlink II adapter driver is dependent upon the 3Com Etherlink II network adapter.

• LanmanServer (Server service, SERVICES.EXE) loads SRVSVC.DLL.

  • LanmanServer depends on TDI (TDI.SYS)

  • TDI.SYS is automatically loaded by the first dependent service, in this case NetBT.SYS.

  • The Server service is bound to the network protocol, in this case TCP/IP (TCPIP.SYS).

  • TCP/IP is dependent upon NDIS (NDIS.SYS).

  • TCP/IP is bound to the network adapter card driver, in this case 3Com Etherlink II (ELNKII.SYS).

  • The 3Com Etherlink II adapter driver is dependent upon the 3Com Etherlink II network adapter.

• LMHOSTS (TCP/IP NetBIOS Helper service, SERVICES.EXE) loads LMHSVC.DLL.

  • LMHOSTS is a member of the Network Provider group, which is dependent upon LanmanWorkstation.

If a Windows NT computer has no networking services configured to automatically start, here is the listing of Kernel mode drivers started. No additional drivers are loaded even through users log on.

• Ntoskrnl.exe

• Hal.dll

• Atdisk.sys

• Ntfs.sys

• Floppy.sys

• Scsiflop.sys

• Scsiscan.sys

• Scsicdrm.sys

• Cdaudio.sys

• Fs_Rec.sys

• Null.sys

• Beep.sys

• I8042prt.sys

• Mouclass.sys

• Kbdclass.sys

• Videoprt.sys

• Vga.sys

• Qv.sysv.SYS

• Vga.sys

• Msfs.sys

• Npfs.sys

• Fastfat.sys

• Parport.sys

• Parallel.sys

• Serial.sys

After logging on, a net start command shows no services started. If, at a command prompt, net start browser is issued, the following drivers are loaded:

Ndis.sys—The adapter card is a member of the NDIS group, so NDIS must be initialized.

Elnkii.sys—This protocol is bound to the adapter, so it must be started

Tdi.sys—This driver sits above protocols, so must be loaded.

Tcpip.sys—This is the TCP/IP protocol stack that was started.

Afd.sys—The Ancillary Function Driver is required for TCP/IP Windows Sockets application support

Netbt.sys—NetBIOS, which is over TCP/IP, is required for the Workstation and Server services

Mup.sys—The Multiple UNC Provider, part of the Network group, is required for Workstation service

Srv.sys—This is the Server service Kernel mode component.

Rdr.sys—This is the Workstation service Kernel mode component.

A net start command shows the following services started:

• Computer Browser

• DHCP Client

• Server

• TCP/IP NetBIOS Helper

• Workstation (Lanman Workstation)

If, at a command prompt, net start messenger is issued, the following driver is loaded:

netbios.sys—Part of the NetBIOS group, which the Messenger service depends upon.

Messenger is added to the list of services currently started.