Role of NTLDR in Windows 2000 Startup

The NT Loader (NTLDR) is the primary boot loader responsible for initializing the Microsoft Windows 2000 operating system. Located in the root directory of the system partition, NTLDR bridges the gap between the system firmware—such as the Basic Input/Output System (BIOS)—and the operating system kernel. This article examines the critical responsibilities of NTLDR during the initial startup phase, including switching processor modes, reading configuration files, orchestrating hardware detection, loading core system files, and transferring control to the Windows kernel.

Transitioning Processor Execution Modes

When a computer powers on, the BIOS runs the Power-On Self-Test (POST) and loads the Master Boot Record (MBR), which locates the active partition's boot sector and initiates NTLDR. At this stage, the processor runs in 16-bit real mode.

NTLDR's first major task is to switch the processor from 16-bit real mode to 32-bit flat memory mode (protected mode). This transition allows the system to access up to 4 gigabytes of physical memory and enables memory paging, laying the groundwork required to load modern operating system components.

Reading Configuration Files and Presenting the Boot Menu

Once operating in protected mode, NTLDR enables basic file system support (typically FAT, FAT32, or NTFS) and locates the boot.ini configuration file in the system partition root.

NTLDR reads boot.ini to:

  • Determine the available operating systems installed on the computer.
  • Display the boot loader selection menu to the user if multiple operating systems are defined.
  • Apply preconfigured boot parameters and switches, such as /debug or /safeboot.
  • Determine the default system to load if the user does not make a selection within the configured timeout period.

If an operating system other than Windows 2000, Windows NT, or Windows XP is selected (such as MS-DOS or Windows 9x), NTLDR loads bootsect.dos and transfers control to it.

Invoking Hardware Detection

If Windows 2000 is selected, NTLDR clears the screen and executes NTDETECT.COM, a 16-bit real-mode program (NTLDR temporarily switches back to real mode to run it).

NTDETECT.COM queries the system firmware to build a hardware configuration profile. It scans for:

  • Bus and adapter architectures (such as PCI and ISA).
  • Communication ports (parallel and serial).
  • Storage controllers and attached drives.
  • Video adapters.
  • Input devices such as keyboards and mice.

After gathering this hardware inventory, NTDETECT.COM returns the data to NTLDR and execution shifts back to protected mode. This configuration data is later stored under the HKEY_LOCAL_MACHINE\HARDWARE registry hive.

Loading the Kernel and Core Drivers

With the hardware detected, NTLDR loads the minimal set of core operating system files into memory from the system root directory (typically C:\WINNT\System32):

  1. Hardware Abstraction Layer (HAL): Loads hal.dll, which isolates the operating system from platform-specific hardware differences.
  2. Windows 2000 Kernel: Loads ntoskrnl.exe, the core of the Windows 2000 operating system.
  3. System Registry Hive: Reads C:\WINNT\System32\Config\System to identify the drivers set to start at boot (SERVICE_BOOT_START).
  4. Boot Drivers: Loads the critical boot-time drivers into memory, such as storage controller drivers, without initializing them immediately.

Passing Execution to the Kernel

After the kernel, HAL, and boot-critical drivers reside in memory, NTLDR displays a progress indicator on the screen. Once all preliminary components are ready, NTLDR hands off full processor execution to ntoskrnl.exe. At this point, the initial boot phase concludes, NTLDR's role ends, and the Windows 2000 kernel takes full control to initialize drivers, launch system services, and present the user logon interface.