Startup & shutdown
How Windows goes from firmware to an interactive session, and how it tears systems down safely.
Related labs
Hands-on exercises for this area — in the browser or on a Windows machine.
Process tree explorer
Walk a sample parent/child tree from System to Explorer and a user app.
Open labOfficial Microsoft docs
Closest official references related to this topic on Microsoft Learn.
Why it matters
Startup is where almost every Windows subsystem first becomes visible: firmware, loader, drivers, sessions, services, and user logon.
Mental model
Boot is not one jump from firmware to desktop. It is a staged handoff between loaders, kernel initialization, system processes, services, and the interactive shell.
Windows building blocks
Names and paths you can look for in Task Manager, Explorer, or documentation.
- Processwinlogon.exe
Logon and session transition
- Processuserinit.exe
User init — launches shell
Go one level deeper
Extra detail for readers who want more precision before opening a child topic.
- Boot phases: firmware → boot manager → kernel init → SMSS → Winlogon → Explorer.
- Safe mode loads a minimal driver and service set via BCD options.
How it works
- 1Firmware and boot components prepare the machine and the Windows loader.
- 2The kernel initializes core managers and boot-critical drivers.
- 3System processes, services, Winlogon, and the shell bring up the interactive session.
Key terms
- Winload
- The Windows loader responsible for preparing the OS kernel and boot environment.
- SMSS
- Session Manager Subsystem; one of the earliest user-mode processes.
- Winlogon
- The process responsible for secure logon and user session bring-up.
Why a driver can break startup before the desktop appears
Some components load before most of user mode exists, so early failures can prevent later stages from ever starting.
Common misconception
The desktop is not the beginning of Windows. By the time you see it, many critical subsystems have already been initialized.
Go deeper
Boot loader to kernel handoff
The transition from firmware and boot manager into Windows kernel initialization.
Session Manager, Winlogon, and the shell
The early user-mode path from system process creation to an interactive desktop.
Secure Boot & measured boot
How firmware and boot policy establish trust before Windows starts.
You should read next
Ranked from your current topic, related links, branch depth, and any active guided path.
intermediate
Boot loader to kernel handoff
The transition from firmware and boot manager into Windows kernel initialization.
Go deeper in this branch
intermediate
Session Manager, Winlogon, and the shell
The early user-mode path from system process creation to an interactive desktop.
Go deeper in this branch
intermediate
Secure Boot & measured boot
How firmware and boot policy establish trust before Windows starts.
Go deeper in this branch