0

When scandisk is scheduled to run before login, it runs in a special blue screen. What is this special mode, does it have a name?

Do other programs run in this blue screen, or is it only for scandisk?

enter image description here

Edit: In the answer of my other question (the one which sparked this actually), they mentioned WinInit and WinLogon. Is that how that mode is called?

1 Answer 1

1

There is a multistring registry key that controls the execution of system programs at boot:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute

By default this key is populated with:

autocheck autochk *

When chkdsk is called to run on the C: drive, the command is modified to include:

autocheck autochk /p \??\C:

Other applications other than chkdsk can be run, such as filesystem converters, boot time defragmenters, and rootkit cleaners.

5
  • Note the modified command is from a windows7 computer, you can tell chkdsk to run at boot by running "chkdsk C: /X Mar 31, 2015 at 8:30
  • I found this question mentioning BootExecute, in it they call it Native Mode. Is this how it's called?
    – sashoalm
    Mar 31, 2015 at 8:31
  • OK, I found also technet.microsoft.com/en-us/sysinternals/bb897447.aspx, they say applications running there are "native" and use only the NT API (ntdll.dll) and not Win32.
    – sashoalm
    Mar 31, 2015 at 8:33
  • @sashoalm I would not call that native mode, but rather "pre-boot execution", but the programs do need to be compiled in a way that relines only on the kernel API, as they are not regular "Windows" programs. Mar 31, 2015 at 8:36
  • It's not really pre-boot.
    – JdeBP
    Apr 4, 2015 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .