InWindows NT, the boot loader is called NTLDR . It is responsible for accessing the file
system on the boot drive, for starting Ntoskrnl.exeand for loading boot-time devicedrivers into memory. Once all the Boot and System drivers have been loaded, the kernel(system thread) starts the Session Manager Subsystem (smss.exe), which in turn startsWinlogon, which loads thegraphical identification and authenticationlibrary.
After a user has successfully logged in to the machine, Winlogon does the following:
Startup programs are run from the following locations:1.
All Users ProfilePath
(pleasenote that this path is localized on non-English versions of Windows)8.
Current User ProfilePath
(pleasenote that this path is localized on non-English versions of Windows)In Windows 95/98/ME, it was also possible to run a program before the user logs on byusing RunServicesOnce or RunServices keys. In Windows NT, this has been replaced bythe Services.exe program, which is able to load a set of system services before a user logson.Additionally, on English versions of Windows, the startup folder was called "StartUp"instead of "Startup" in Win9x.Adware\Spyware and other unwanted software might add itself to the system registry inorder to be automatically started when a Windows NT system logs on.There are several programs that let the user control which programs automatically startwhen a Windows NT system logs on, includingStartU, OSAM: Autorun Manager and