Windows 8 : Managing the BCD Store

Computers can have system and nonsystem BCD stores. The system BCD store contains the operating system boot entries and related boot settings. Whenever you work with the BCD Editor, you work with the system BCD store.

On a computer with only one operating system, the BCD entries for your computer will look similar to those in Example 1. As the listing shows, the BCD store for this computer has two entries: one for the Windows Boot Manager, and one for the Windows Boot Loader. Here, the Windows Boot Manager calls the boot loader, and the boot loader uses Winload.exe to boot Windows 8.

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume1
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
integrityservices       Enable
default                 {current}
resumeobject            {16b857b4-9e02-11e0-9c17-b7d085eb0682}
displayorder            {current}
                        {16b857ad-9e02-11e0-9c17-b7d085eb0682}
toolsdisplayorder       {memdiag}
timeout                 30
custom:26000025         Yes

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 8
locale                  en-US
inherit                 {bootloadersettings}
recoverysequence        {16b857b6-9e02-11e0-9c17-b7d085eb0682}
integrityservices       Enable
recoveryenabled         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \Windows
resumeobject            {16b857b4-9e02-11e0-9c17-b7d085eb0682}
nx                      OptIn
bootmenupolicy          Standard

BCD entries for Windows Boot Manager and Windows Boot Loader have similar properties. These properties include those summarized in Table 1.

When you are working with the BCD store and the BCD Editor, you’ll see references to well-known identifiers, summarized in Table 2, as well as GUIDs. When a GUID is used, it has the following format, where each N represents a hexadecimal value:

{NNNNNNNN-NNNN-NNNN-NNNN-NNNNNNNNNNNN}

such as:

{16b857ad-9e02-11e0-9c17-b7d085eb0682}

The dashes that separate the parts of the GUID must be entered in the positions shown. Both well-known identifiers and GUIDs are enclosed in braces.

When a computer has additional instances of Windows Vista or later installed, the BCD store has additional entries for each additional operating system. For example, the BCD store might have one entry for the Windows Boot Manager and one Windows Boot Loader entry for each operating system.

When a computer has a legacy operating system installed, such as Windows XP, the BCD store has three entries: one for the Windows Boot Manager, one for the Windows Legacy OS Loader, and one for the Windows Boot Loader. Generally, the entry for the Windows Legacy OS Loader will look similar to Example 2.

Windows Legacy OS Loader
------------------------
identifier:             {ntldr}
device:                 partition=C:
path:                   \ntldr
description:            Earlier version of Windows

Although the Windows Boot Manager, Windows Legacy OS Loader, and Windows Boot Loader are the primary types of entries that control startup, the BCD store also includes information about boot settings and boot utilities. The Windows Boot Loader entry can have parameters that track the status of boot settings, such as whether No Execute (NX) policy is set to Opt In or Opt Out. The Windows Boot Loader entry also can provide information about available boot utilities, such as the Windows Memory Diagnostic utility.

To view the actual value of the GUIDs needed to manipulate entries in the BCD store, type bcdedit /v at an elevated command prompt.

Using the BCD Editor, you can create a nonsystem BCD store by using the following command:

bcdedit /createstore StorePath

where StorePath is the folder path to the location where you want to create the nonsystem store, such as:

bcdedit /createstore c:\non-sys\bcd

On an EFI system, you can temporarily set the system store device by using the /sysstore command. Use the following syntax:

bcdedit /sysstore StoreDevice

where StoreDevice is the actual system store device identifier, such as:

bcdedit /sysstore c:

The device must be a system partition. Note that this setting does not persist across reboots and is used only in cases where the system store device is ambiguous.

The BCD Editor provides separate commands for importing and exporting the BCD store. You can use the /export command to export a copy of the system BCD store’s contents to a specified folder. Use the following command syntax:

bcdedit /export StorePath

where StorePath is the actual folder path to which you want to export a copy of the system store, such as:

bcdedit /export c:\backup\bcd

To restore an exported copy of the system store, you can use the /import command. Use the following command syntax:

bcdedit /import ImportPath

where ImportPath is the actual folder path from which you want to import a copy of the system store, such as:

bcdedit /import c:\backup\bcd

On an EFI system, you can add /clean to the /import command to specify that all existing firmware boot entries should be deleted. Here is an example:

bcdedit /import c:\backup\bcd /clean

The BCD Editor provides separate commands for creating, copying, and deleting entries in the BCD store. You can use the /create command to create identifier, application, and inherit entries in the BCD store.

As shown previously in Table 2, the BCD Editor recognizes many well-known identifiers, including {dbgsettings}, which is used to create a debugger settings entry; {ntldr}, used to create a Windows Legacy OS entry; and {ramdiskoptions}, used to create a RAM disk additional options entry. To create identifier entries, you use the following syntax:

bcdedit /create Identifier /d "Description"

where Identifier is a well-known identifier for the entry you want to create, such as:

bcdedit /create {ntldr} /d "Earlier Windows OS Loader"

You can create entries for specific boot loader applications as well, including:

Use the following command syntax:

bcdedit /create /application AppType /d "Description"

where AppType is one of the previously listed application types, such as:

bcdedit /create /application osloader /d "Windows 8"

You can delete entries in the system store by using the /delete command and the following syntax:

bcdedit /delete Identifier

If you are trying to delete a well-known identifier, you must use the /f command to force deletion, such as:

bcdedit /delete {ntldr} /f

By default, when using the /delete command, the /cleanup option is implied, which means that the BCD Editor cleans up any other references to the entry being deleted. This ensures that the data store doesn’t have invalid references to the identifier you removed. Because entries are removed from the display order as well, this could result in a different default operating system being set. If you want to delete the entry and clean up all other references except the display order entry, you can use the /nocleanup command.

After you create an entry, you need to set additional entry option values as necessary. The basic syntax for setting values is:

bcdedit /set Identifier Option Value

where Identifier is the identifier of the entry to be modified, Option is the option you want to set, and Value is the option value, such as:

bcdedit /set {current} device partition=d:

To delete options and their values, use the /deletevalue command with the following syntax:

bcdedit /deletevalue Identifier Option

where Identifier is the identifier of the entry to be modified, and Option is the option you want to delete, such as:

bcdedit /deletevalue {current} badmemorylist

When you are working with options, Boolean values can be entered in several different ways. For True, you can use 1, On, Yes, or True. For False, you can use 0, Off, No, or False.

To view the BCD entries for all boot utilities and the values for settings, type bcdedit /enum all /v at an elevated command prompt. This command enumerates all BCD entries regardless of their current state and lists them in verbose mode. Each additional entry has a specific purpose and lists values that you can set, including the following:

Table 3 summarizes key options that apply to entries for boot applications (Bootapp). Because Windows Boot Manager, Windows Memory Diagnostic, Windows OS Loader, and Windows Resume Loader are boot applications, these options apply to them as well.

Table 4 summarizes key options that apply to entries for Windows OS Loader (Osloader) applications.

Data Execution Prevention (DEP) is a memory-protection technology. When DEP is enabled, the computer’s processor marks all memory locations in an application as nonexecutable unless the location explicitly contains executable code. If code is executed from a memory page marked as nonexecutable, the processor can raise an exception and prevent the code from executing. This behavior prevents malicious application code, such as virus code, from inserting itself into most areas of memory.

For computers with processors that support the non-execute (NX) page-protection feature, you can configure the operating system to opt in to NX protection by setting the nx parameter to OptIn, or opt out of NX protection by setting the nx parameter to OptOut. Here is an example:

bcdedit /set {current} nx optout

When you configure NX protection to OptIn, DEP is turned on only for essential Windows programs and services. This is the default. When you configure NX protection to OptOut, all programs and services—not just standard Windows programs and services—use DEP. You can also configure NX protection to be always on or always off by using AlwaysOn or AlwaysOff, such as:

bcdedit /set {current} nx alwayson

Processors that support and opt in to NX protection must be running in PAE mode. You can configure PAE by setting the PAE parameter to Default, ForceEnable, or ForceDisable. When you set the PAE state to Default, the operating system uses its default configuration for PAE. When you set the PAE state to ForceEnable, the operating system uses PAE. When you set the PAE state to ForceDisable, the operating system will not use PAE. Here is an example:

bcdedit /set {current} pae default

You can change the display order of boot managers associated with a particular installation of Windows Vista, Windows 7, or Windows 8 by using the /displayorder command. The syntax is:

bcdedit /displayorder id1 id2 ... idn

where id1 is the operating system identifier of the first operating system in the display order, id2 is the identifier of the second, and so on. You could change the display order of the operating systems identified in these BCD entries:

Windows Boot Loader
-------------------
identifier              {16b857b4-9e02-11e0-9c17-b7d085eb0682}

Windows Boot Loader
-------------------
identifier              {14504de-e96b-11cd-a51b-89ace9305d5e}

Windows Boot Loader
-------------------
identifier              {8b78e48f-02d0-11dd-af92-a72494804a8a}

by using the following command:

bcdedit /displayorder {8b78e48f-02d0-11dd-af92-a72494804a8a}
{16b857b4-9e02-11e0-9c17-b7d085eb0682}
{14504de-e96b-11cd-a51b-89ace9305d5e}

You can set a particular operating system as the first entry by using /addfirst with /displayorder, such as:

bcdedit /displayorder {16b857b4-9e02-11e0-9c17-b7d085eb0682} /addfirst

You can set a particular operating system as the last entry by using /addlast with /displayorder, such as:

bcdedit /displayorder {8b78e48f-02d0-11dd-af92-a72494804a8a} /addlast

You can change the default operating system entry by using the /default command. The syntax for this command is:

bcdedit /default id

where id is the operating system ID in the boot loader entry. You could set the operating system identified in this BCD entry as the default:

Windows Boot Loader
-------------------
identifier              {16b857b4-9e02-11e0-9c17-b7d085eb0682}

by using the following command:

bcdedit /default {16b857b4-9e02-11e0-9c17-b7d085eb0682}

If you want to use a pre–Windows 8 operating system as the default, use the identifier for the Windows Legacy OS Loader. The related BCD entry looks like this:

Windows Legacy OS Loader
------------------------
identifier              {466f5a88-0af2-4f76-9038-095b170dc21c}
device                  partition=C:
path                    \ntldr
description             Earlier Microsoft Windows Operating System

Following this, you could set Ntldr as the default by entering:

bcdedit /default {466f5a88-0af2-4f76-9038-095b170dc21c}

You can change the timeout value associated with the default operating system by using the /timeout command. Set the /timeout command to the wait time you want to use (in seconds) as follows:

bcdedit /timeout 30

To boot automatically to the default operating system, set the timeout to 0 seconds.

Occasionally, you might want to boot to a particular operating system one time and then revert to the default boot order. To do this, you can use the /bootsequence command. Follow the command with the identifier of the operating system to which you want to boot after restarting the computer, such as:

bcdedit /bootsequence {16b857b4-9e02-11e0-9c17-b7d085eb0682}

When you restart the computer, the computer will set the specified operating system as the default for that restart only. Then, when you restart the computer again, the computer will use the original default boot order.