How Windows PE Works
Published: October 22, 2009
Updated: October 22, 2009
Applies To: Windows 7
|This content applies to Windows 7. For Windows 8 content, see Windows Deployment with the Windows ADK.|
The following diagram illustrates Windows® PE version 3.0. Windows PE is a minimal Win32® installation environment with limited services, based on the Windows® 7 kernel running in protected mode.
Windows PE Optimal Environment
An optimal environment for running Windows PE has the following characteristics:
Sufficient RAM for a RAM disk boot.
If you choose to use a USB Flash Drive (UFD) device, it must meet all the requirements for booting Windows PE.
The appropriate network adapter and mass storage drivers available, either on the Windows PE CD or available to place on a customized Windows PE image.
Physical access to the computer.
If using Emergency Management Services (EMS) to use Windows PE in the configuration of a remotely administered server, verify that the computer properly supports EMS.
If you choose to use Windows Deployment Services, the server must run Windows Server® 2003 Remote Installation Services (RIS) server, and the destination computers must have a network adapter that enables Preboot Execution Environment (PXE) or one that is supported by the Windows Deployment Services start disk.
Order of Operations in Windows PE
The boot process of Windows PE is as follows.
The boot sector on the particular media is loaded. Control is passed to Bootmgr. Bootmgr extracts basic boot information from the Boot Configuration Data (BCD) and passes control to the Winload.exe file contained in Boot.wim. Winload.exe then loads the appropriate Hardware Abstraction Layer (HAL), and loads the System registry hive and necessary boot drivers. After it finishes loading, it prepares the environment to execute the kernel, Ntoskrnl.exe.
Note If you start Windows PE from read-only media such as a CD, Windows PE stores the registry hives in memory so that applications can write to the registry. Any changes made to the registry by the applications do not persist across different Windows PE sessions.
Ntoskrnl.exe is executed and finishes the environment Setup. Control is passed to the Session Manager (SMSS).
SMSS loads the rest of the registry, configures the environment to run the Win32 subsystem (Win32k.sys) and its various processes. SMSS loads the Winlogon process to create the user session, and then starts the services and the rest of the non-essential device drivers and the security subsystem (LSASS).
Winlogon.exe runs Setup based on the registry value HKLM\SYSTEM\Setup\CmdLine. Winpeshl.exe will launch %SYSTEMDRIVE%\sources\setup.exe if it exists, otherwise it looks for an application specified in %SYSTEMROOT%\system32\winpeshl.ini. If no application is specified, Winpeshl.exe will execute cmd /k %SYSTEMROOT%\system32\startnet.cmd. By default, Windows PE contains a Startnet.cmd file that will launch Wpeinit.exe. Wpeinit.exe loads network resources and coordinates with networking components like DHCP.
When Wpeinit.exe completes, the Command Prompt window is displayed. At that point, the boot process of Windows PE is complete.