WinPE Startup Flow

We've taken a look at two steps of the WinPE Startup flow, but there are a few more steps in this process

1

Registry: SYSTEM\Setup\CmdLine

Winlogon reads the value of CmdLine, which is winpeshl.exe

2

Windows PE Shell (winpeshl.exe)

Initializes PNP and WallpaperHost.exe

Executes commands from winpeshl.ini but this is skipped as this file doesn't exist. MDT would utilize this method for WinPE startup.

Tries to execute [SystemDrive]\$Windows.~BT\sources\setup.exe (does not exist)

Tries to execute [SystemDrive]\setup.exe (does not exist)

Executes [SystemDrive]\windows\system32\cmd.exe /k startnet.cmd

3

Startnet.cmd

Executes wpeinit.exe and remains as the shell application. This is the Command Prompt window that is left open. When the Command Prompt window is closed, WinPE will restart

4

Wpeinit.exe

Completes the WinPE initialization and Unattend.xml

Additional Reading

How Windows PE WorksMicrosoftLearn

Windows PE startup, revisitedOut of Office Hours

Build your own Windows PE imageOut of Office Hours

How Windows PE WorksMicrosoftLearn

Windows PE startup sequence explainedSlightly Overcomplicated