windows - Windows启动的顺序是什么？

Question

我很想知道在用户登录期间 Windows 启动的顺序。有人知道吗？基本上，我的应用程序是由 GPO 调用的登录脚本调用的。调用第 3 方 EXE 时，它无法启动。

然后，通过反复试验，我发现 HKCU...\RunOnce 键在登录脚本之后执行。同样的结果，正在调用 EXE，但无法启动。

有效的方法:更新了登录脚本，在用户的“启动”文件夹中创建了一个快捷方式。现在 EXE 按预期启动。

我知道AutoRuns可以告诉我所有可以放置启动项的位置，有谁知道整体的执行顺序吗？我能够发现 Run 和 RunOnce 键被异步调用。我可以继续测试 AutoRuns 声明的每个启动项，但这可能需要几天时间。

我最感兴趣的是 Windows 2003 Server 登录启动流程，但我怀疑它与当今使用的其他 Windows 版本非常相似。

Answer 1

来源:Understanding the Startup Process - Windows 7 Tutorial

The normal startup sequence for Windows 7 is:

1. Power-on self test (POST) phase
2. Initial startup phase
3. Windows Boot Manager phase
4. Windows Boot Loader phase
5. Kernel loading phase
6. Logon phase

Kernel Loading Phase The Windows Boot Loader is responsible for loading the Windows kernel (Ntoskrnl.exe) and the HAL into memory. Together, the kernel and the HAL initialize a group of software features that are called the Windows executive. The Windows executive processes the configuration information stored in the registry in HKLM\SYSTEM\CurrentControlSet and starts services and drivers. The following sections provide more detail about the kernel loading phase.

Logon Phase

The Windows subsystem starts Winlogon.exe, a system service that enables you to log on and log off. Winlogon.exe then does the following:

• Starts the Services subsystem (Services.exe), also known as the SCM. The SCM initializes services that the registry entry Start designates as Autoload in the registry subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Servicename.
• Starts the Local Security Authority (LSA) process (Lsass.exe).
• Parses the Ctrl+Alt+Delete key combination at the Begin Logon prompt (if the computer is part of an AD DS domain).

The logon user interface (LogonUI) feature and the credential provider (which can be the standard credential provider or a third-party credential provider) collect the user name and password (or other credentials) and pass this information securely to the LSA for authentication. If the user supplied valid credentials, access is granted by using either the default Kerberos V 5 authentication protocol or Windows NT LAN Manager (NTLM).

Winlogon initializes security and authentication features while PnP initializes auto-load services and drivers. After the user logs on, the control set referenced by the registry entry LastKnownGood (located in HKLM\SYSTEM\Select) is updated with the contents in the CurrentControlSet subkey. By default, Winlogon then starts Userinit.exe and the Windows Explorer shell. Userinit may then start other processes, including:

• Group Policy settings take effect Group Policy settings that apply to the user and computer take effect.

• Startup programs run When not overridden by Group Policy settings, Windows starts logon scripts, startup programs, and services referenced in the following registry subkeys and file system folders:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
  SystemDrive\Documents and Settings\All Users\Start Menu\Programs\Startup
  SystemDrive\Documents and Settings\username\Start Menu\Programs\Startup
  

Several applications might be configured to start by default after you install Windows, including Windows Defender. Computer manufacturers or IT departments might configure other startup applications.

Windows startup is not complete until a user successfully logs on to the computer. If startup fails during the logon phase, you have a problem with a service or application configured to start automatically.

如果您想了解更多信息，请查看源链接。