Windows Boot Process Step by Step (and How to Fix Each Stage)
When a Windows PC will not start, the fix depends entirely on which stage of the boot process failed. A black screen before the logo is a different problem from a loop after the logo, and the repair commands are different too. This guide walks through the stages of a modern UEFI-based Windows 10 or 11 boot in order, says what each one does, what it looks like when it breaks, and which tools to use. For a deeper comparison of the firmware itself, see BIOS vs UEFI.
The boot process at a glance
| Stage | What runs | What it does | Typical failure |
|---|---|---|---|
| 1. Power-on and POST | UEFI firmware | Initialises CPU, memory and core hardware, then tests them | Beeps, no display, stuck on the manufacturer logo |
| 2. Find the boot loader | UEFI firmware | Reads boot entries from firmware storage and loads the boot manager from the EFI System Partition | “No bootable device”, firmware setup opens by itself |
| 3. Boot manager | bootmgfw.efi |
Reads the Boot Configuration Data (BCD) and shows the menu if there is more than one entry | Error 0xc000000f, “BCD missing or corrupt” |
| 4. OS loader | winload.efi |
Loads the kernel, the HAL, the SYSTEM registry hive and boot-start drivers | Error 0xc000000e, 0xc0000221, missing or corrupt driver or file |
| 5. Kernel start | ntoskrnl.exe |
Initialises memory, drivers and core services | Blue screen such as INACCESSIBLE_BOOT_DEVICE |
| 6. Session start | smss.exe, wininit.exe, winlogon.exe |
Starts services, then the logon screen | Hang at the spinning dots, black screen after login |
Stage 1: Power-on and POST
When you press the power button, the CPU starts executing firmware code stored on the motherboard. The firmware initialises the memory controller and essential hardware and performs a Power-On Self-Test (POST). If something critical is missing or broken, such as no RAM, the machine reports it with beep codes or diagnostic LEDs instead of starting Windows. Because this stage happens before any operating system, no Windows repair tool can help. Reseat the RAM, remove non-essential devices, clear the CMOS and check power. The Gigabyte and Dell guides on this site cover hardware-level cases such as a boot loop with no display.
Stage 2: The firmware finds the boot loader
On a UEFI system, the firmware keeps a list of boot entries in non-volatile memory (NVRAM), each pointing to an .efi file. The entry named Windows Boot Manager points to \EFI\Microsoft\Boot\bootmgfw.efi on the EFI System Partition (ESP), a small FAT32 partition on the disk. Firmware tries the entries in order. If no valid entry is found it falls back to a removable device or shows an error.
The ESP is normally hidden in Windows. You can see it in Disk Management as a 100 to 500 MB “EFI System Partition”, or from an administrator PowerShell:
Get-Partition | Where-Object Type -eq 'System' | Format-List DiskNumber, PartitionNumber, Size, GptTypeStage 3: Windows Boot Manager and the BCD
The boot manager reads the Boot Configuration Data (BCD), a small database that stores which Windows installations exist, where they are, and boot options such as Safe Mode or debugging. If there is one entry it starts immediately; with several you see the “Choose an operating system” menu. If the machine was hibernated or uses Fast Startup, this is also where it decides to resume from the saved hibernation state (winresume.efi) instead of starting fresh.
From a running system, an administrator command prompt shows the BCD:
bcdedit /enumLook at the path and device lines. If the BCD is damaged or points to the wrong partition, you usually see error 0xc000000f or a message saying the BCD is missing or contains errors.
Stage 4: The Windows OS loader
winload.efi prepares the operating system. It loads the kernel ntoskrnl.exe, the Hardware Abstraction Layer, the SYSTEM registry hive and every driver marked as boot-start, such as the disk and file-system drivers, and it checks driver signatures. With Secure Boot enabled, the firmware verifies the signature of the Windows Boot Manager, and the boot manager in turn verifies the OS loader and other early boot components. If a required file is missing, corrupted or unsigned you get errors such as 0xc000000e (the device is not accessible) or 0xc0000221 (damaged file).
Stage 5: The kernel starts
Control passes to ntoskrnl.exe, which initialises memory management, the scheduler and the loaded drivers, and begins starting the executive subsystems. A failure here shows as a blue screen. INACCESSIBLE_BOOT_DEVICE (stop code 0x7B) is the classic one after changing storage controller settings (for example switching SATA mode from IDE to AHCI or RAID in firmware) or after a disk driver problem. The stop code and the name shown on the blue screen are the fastest clues, so photograph the screen before restarting.
Stage 6: Session start, services and logon
The kernel launches the Session Manager (smss.exe), which sets up the environment and starts the Windows subsystem (csrss.exe) and wininit.exe. wininit.exe starts the Service Control Manager (services.exe) and the Local Security Authority (lsass.exe). Interactive logon is handled by winlogon.exe and the logon screen; after you sign in, the shell (explorer.exe) and your startup items load. Problems in this stage look like long spinning-dot screens, a black screen with a cursor, or a service or startup program that blocks the desktop. Booting to Safe Mode and reading Event Viewer, or running msconfig for a clean boot, is the standard approach.
Troubleshooting by stage
Most repairs start from the Windows Recovery Environment (WinRE). If Windows fails to start twice in a row it usually opens automatically; otherwise boot from Windows installation media, choose Repair your computer, then Troubleshoot > Advanced options.
- Try Startup Repair first. It automatically fixes many BCD and boot-file problems and takes a minute or two.
- Check the disk and file system from the WinRE command prompt:
chkdsk C: /f. The drive letters in WinRE can differ from normal Windows, so confirm withdir C:\Windowsand try other letters if needed. - Rebuild the boot files on a UEFI system with
bcdboot. First assign a letter to the ESP withdiskpart(list disk,select disk Nfor the disk that holds Windows (check withlist diskand sizes),list partand confirm the partition of type System (the EFI System Partition, usually 100 to 500 MB),select part M, thenassign letter=Sandexit). Then run:bcdboot C:\Windows /s S: /f UEFIThis copies fresh boot files to the ESP and recreates the BCD store. When you give
/s, BCDBoot does not create the firmware (NVRAM) boot entry; if the firmware still lists no Windows Boot Manager, choose it manually in firmware setup, or runbcdboot C:\Windowswithout/sfrom a running system or WinRE once the ESP is found automatically. - Use
bootrecwhere appropriate.bootrec /rebuildbcdscans for installations and offers to add them.bootrec /fixmbrandbootrec /fixbootare aimed at BIOS/MBR systems; on UEFI,bootrec /fixbootcommonly fails with “Access is denied”, andbcdbootis the right tool instead. - Repair system files offline:
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows, followed if needed byDISM /Image:C:\ /Cleanup-Image /RestoreHealth(which needs a source when offline). - Undo the last change. Use Uninstall Updates or System Restore from the same Advanced options menu, or start in Safe Mode and remove the recent driver or program.
- Reinstall only as a last resort, and copy your data off first from WinRE or a live USB.
If the disk is encrypted with BitLocker, expect to be asked for the recovery key when you change boot settings. Keep it safe, and see how to regenerate a lost BitLocker recovery key while you still have access to the system.
Common questions
What is the difference between the boot manager and the OS loader?
The boot manager (bootmgfw.efi on UEFI) chooses which operating system to start, using the BCD. The OS loader (winload.efi) then loads the chosen Windows installation’s kernel and drivers.
Does Fast Startup change the boot process?
Yes. With Fast Startup, shutting down logs users off but saves the kernel session to hiberfil.sys, so the next start resumes that saved state instead of loading the kernel from scratch. A restart always does a full boot, which is why restarting fixes problems that shutting down does not.
How long should Windows take to boot?
On an SSD-based PC, from pressing the power button to the desktop is typically well under a minute. Event Viewer records boot performance under Applications and Services Logs > Microsoft > Windows > Diagnostics-Performance > Operational (event ID 100), showing the boot duration and which items were slow.
