Major Operating System Files

Windows 9x
AUTOEXEC.BAT Plain text file. Batch file that executes command
prompt instructions. Configures command
prompt environment and loads TSRs.
COMMAND.COM Command interpreter. Provides user interface to
command prompt & processes keyboard
commands. Contains other internal commands
such as CD, COPY, VER, DIR.
CONFIG.SYS Plain text file. Activates memory areas and loads
real-mode device drivers using “DEVICE=”
(Always use full path)
EMM386.exe Simulates expanded memory for Windows.
Requires HIMEM.SYS.
HIMEM.SYS Extended memory manager (above 1 MB) that
makes extended memory available to MS-DOS
programs. Protects memory from being used by
two programs at once. Use /TESTMEM:OFF to
avoid memory test for faster boot.
IO.SYS Hidden, System file. Must be first directory entry
in the root in order to boot and first physical file
on volume boot sector. Real-mode configuration
manager. Contains information to start computer
and read file system (FAT/FAT32). Reads
MSDOS.SYS and load files and commands
specified in CONFIG.SYS and
AUTOEXEC.BAT.
MSDOS.SYS Hidden, System file. Must be second directory
entry in the root to in order to boot. Specifies
startup options (e.g., splash screen to use) and
identifies location of boot files and registry.
Provides backward application compatibility for
MS-DOS based apps.
SYSTEM.DAT (HKLM) Operating system registry file.
SYSTEM.INI Loads windows settings and drivers, provides
MS-DOS application details.
USER.DAT (HKU) User settings registry file.
VMM32.EXE Virtual memory manager. Loads 3.xx device
drivers having a DRV or 386 file extension
(virtual mode drivers). These drivers will be
located in the SYSTEM.INI file in the [ENH386]
section.
WIN.COM Starts Windows and takes control from IO.SYS
WIN.INI Windows settings such as desktop, mouse,
 screen, keyboard, installed fonts, apps that run
during startup.

Windows 2000/XP
BOOT.INI Identifies disk information used for boot
process.
NTBOOTDD.SYS Contains SCSI boot drivers
NTDETECT.COM Detects base system hardware.
NTLDR Switches from real to protected mode. Starts
minifile system drivers to read file system.
Reads BOOT.INI and then loads the operating
system. Also loads NTDETECT.COM and
NTOSKRNL.
NTOSKRNL Loaded by NTLDR to take control of system.
Switches to graphical mode.
HKLM Windows\System32\Config files: Software,
System, SAM, security, Default, UserDiff)
NTUSER.DAT User settings registry file
(HKU)