Week 5 - What Really Happens When You Power On Your Windows PC?

    Ever wonder what’s really going on when you hit that power button? The Windows boot process isn’t magic. It’s a well-orchestrated chain of events. First, the BIOS or UEFI firmware wakes up and quickly inspects your hardware (keyboard? Check. RAM? Check. Storage drive? Check.). That process is also called a Power On Self-Test or POST. Then, it checks your boot order and hands control to the bootloader, also known as the Windows Boot Manager (bootmgr), which lives on the system partition.

    Bootmgr looks at the Boot Configuration Data (BCD), a roadmap that tells it what operating systems are installed and where to find them. In most cases, it points straight to Windows. That’s when winload.exe comes into play and loads the Windows kernel (ntoskrnl.exe), drivers, and system files into memory. At this point, the system switches from real mode to protected mode.

    Then comes hardware detection round two. Windows will re-check your devices and ensure everything is configured correctly. The Session Manager starts system processes like smss.exe and csrss.exe, and the Winlogon service preps your login screen. Finally, Explorer.exe fires up, bringing you that familiar desktop. Boom, you’re in!