Working with BCD in Windows 10

What admins need to know about BCD data, structures, and organization in Windows 10.

microsoft windows 10 logo
Reuters/Robert Galbraith

In the world of the Windows OS, BCD stands for Boot Configuration Data. This critical information in the Windows runtime environment tells the Windows boot loader where to look for boot information. It also establishes boot priority and timing when, as is typically the case, a PC can access two or more bootable partitions as it’s starting up. For example, a default Windows OS clean install actually writes two bootable partitions to the drive that’s designated as the install target. The primary and most frequently used of these partitions is the operating system partition. But a secondary, recovery partition also gets written and may be accessed at boot time to support repair and recovery. This produces a disk layout like the one shown in Figure 1.

btdskmap Ed Tittel

Figure 1: The default Windows 10 boot disk layout from a clean install.

In this disk layout, the partitions may be described as follows, from left to right (1-4):

1.     450 MB: The default Windows Recovery (WinRE) partition, which includes a basic Windows runtime and various repair and recovery tools (see How to create a repair/recovery partition in Windows 10).

2.     100 MB: This is the EFI (Extensible Firmware Interface) partition where Windows stores a copy of the boot loader, BCD and related logs, and other files for boot configuration and boot-up use.

3.     NVMe500: This is the actual OS partition, as shown by the Boot and Primary Partition labels. This is where the full version of the Windows 10 OS that normally runs the PC resides.

4.     47.69 GB: This is unallocated space set up for over-provisioning this particular SSD. Should sectors become unusable or inaccessible as the drive ages, the NVMe drive controller can grab new ones here to maintain a constant storage pool.

Understanding the modern Windows boot process

Use of boot configuration data, or BCD, and the Windows bootloader was introduced with Windows Vista. Windows OS load behavior was substantially reworked in 2004, when Vista was still code-named “Longhorn” to support EFI and to overhaul the earlier NTLDR (“NT Loader”) architecture used in preceding versions of Windows NT.

In fact, BCD is best understood as a firmware-independent database for boot-time configuration data. The BCD information resides in a data file named bootmgfw.efi in the EFI partition in the \EFI\Microsoft\Boot folder. You will also find a copy of this file in the Windows Side-by-Side (WinSxS) directory hierarchy. When a PC begins booting, a firmware-based bootstrap loader starts the boot process and then hands the process over to the Windows Boot Loader (you’ll see this latter program referenced as a line item in your BIOS or UEFI boot information, usually as the default OS boot entry). That boot loader accesses the EFI partition on the default or designated boot drive, and uses the BCD information to start booting the OS so it can take over control of the PC.

There are two major variations on the Windows boot theme. Some (mostly older) PCs use a Master Boot Record (MBR) disk layout and work with BIOS to perform what’s now called a “legacy boot.” Other (mostly newer) PCs use a GUID Partition Table (GPT) disk layout and work with UEFI to perform what’s called a “UEFI boot” or “EFI boot.” Some of the details involved in managing boot vary according to the type of boot (legacy vs. EFI) that’s performed, so it’s important to know what you’re working with on any given PC. If you run the DiskPart utility at the Windows command line (Administrator), then use the “list disk” command, it shows which disks are GPT with an asterisk in that column (drives with no asterisk use MBR), as shown in Figure 2.

diskpartgpt Ed Tittel

Figure 2: An asterisk indicates GPT format, no asterisk indicates MBR

The OS disk on this system is Disk 4. As evidenced by the EFI partition shown in Figure 1, it must be GPT-formatted. This is confirmed by the asterisk at the far right in the Disk 4 entry in Figure 2.

Working with BCD in Windows 10

As is so often the case in Windows, one can choose how to work with boot configuration data in Windows 10. At the command line, Windows supports a number of instructions that manipulate the BCD, either directly or indirectly. Alas, Microsoft’s documentation for these commands is far from complete or comprehensive, and there’s some potential hazard involved in digging deeply into their capabilities. That’s why I also recommend a couple of third-party tools that automate working with the BCD, not only because it simplifies matters, but because it makes it (somewhat) more difficult to do a system harm through incorrect or ill-advised BCD changes or additions.

WARNING! Anybody who’s worked with the Registry knows that mistakes or errors can cause horrible problems, including total system failure. Working with BCD is the only aspect of Windows administration that is even more dangerous than working with the Registry. That’s because errors inevitably cause boot failures. Don’t use any of these tools without making a complete image backup of all drives with BCD partitions on them, along with building a rescue disk from which to boot should the boot drive quit working. That way, worst case, you can always boot to the rescue disk and use it to restore the image backup (with the old, presumably working BCD partition(s)) and restore the system to operational status.

Table 1 lists the key Windows commands that support boot and BCD related manipulation and repair, along with reference links and other admonitions. Figure 3 shows basic BCDedit output that displays BCD contents for a simple single-boot Windows 10 installation.

bcdedit Ed Tittel

Figure 3: BCDedit shows basic BCD contents if you enter the command with no arguments.

What you see in Figure 3 is a BCD store with two entries. The first entry is for the Windows Boot Manager which picks up the handoff from PC firmware and guides the process to the point where the OS takes over. It shows the boot manager identifier ({bootmgr}) and its path (the EFI file), along with a pointer to the recovery partition GUID {61ab08de-3cc9-11e7-ad81-d05099880e4b}. The second entry is for the OS partition whose {current} indicates it’s the default boot choice. It shows an association with Drive C: and a path to the winload.efi file that loads the Windows OS, with the same recovery partition GUID as for the EFI partition. Everything looks copacetic!

Third-party BCD alternatives

As with many other Windows professionals, I prefer working with GUI tools instead of using BCDEdit at the command line (though Bootrec.exe is perfectly OK with me, and often a real godsend at the command line). My alternative tools of choice are:

  • NeoSmart Technologies EasyBCD: Available in both freeware and professional/commercial versions, this tool lets you do most of what BCDEdit does through a fairly simple and straightforward GUI interface. It’s my go-to tool of choice for messing with BCD and boot stuff for Windows, and has been since Windows 7.
  • Bo Yans Visual BCD Editor: A donationware product, this tool provides complete access to all aspects and capabilities of the BCD store. Where EasyBCD falls short, this tool totally rocks. That said, learning how to use it requires considerable trial and error, where errors usually require image restores to return affected drives or partitions to bootable condition.

When is BCD work required?

The most obvious and occasionally depressing answer to the above question is: “When troubleshooting boot problems.” Updates, upgrades and software installs can occasionally interfere with proper boot behavior, as can operating on disk partitions and layouts. For me, and most Windows admins, fixing what’s broken is the most typical provocation for venturing into BCD territory. Dual- or multiple-boot set-ups are another common reason to work on BCD stores as well. Whatever your impetus, you can use the information, tools and resources here to help you see your way clear of problems or issues and get boot working again.

Related:

Copyright © 2017 IDG Communications, Inc.

7 secrets of successful remote IT teams