# Where the boot minute goes

> Read the real boot timeline from Windows events, understand startup impact ratings, and stop blaming the wrong thing.

**Tested on**

- Build: 26300.9457 / 26100.33650
- Edition: Pro (26H2) / Server
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

"Boot time" is four different phases, and people measure the wrong one:

| Phase | What happens | Typical duration |
|---|---|---|
| **Firmware/POST** | memory training, device init | 3–20s, worse with Fast Boot off |
| **Boot loader → kernel** | driver init | 2–8s |
| **Session init** | services and logon | 5–30s |
| **Startup apps** | everything in Run/tasks/Startup folder | 0–180s |

**Fast Startup** (hiberboot) skips most of the first two phases, so a machine with it on can report a 12-second "boot" and still feel slow to a usable desktop — because the slow part moved to session init and startup apps.

## Read the actual numbers

Windows logs boot performance itself:

```powershell
Get-WinEvent -LogName 'Microsoft-Windows-Diagnostics-Performance/Operational' |
  Where-Object Id -in 100,101,102,103,109,110 |
  Select-Object TimeCreated,Id,LevelDisplayName,
    @{n='BootMs';e={($_.Properties[4].Value)}} |
  Select-Object -First 15
```

| Event | Meaning |
|---|---|
| **100** | boot performance monitoring started |
| **101** | *this boot was slow* — the one you want |
| **102** | application took longer than 30s to start |
| **103** | service took longer than 30s to start |
| **109** | device took longer than 30s to initialise |
| **110** | background optimisation took long |

Event 101 includes the boot duration in milliseconds. Events 102/103/109 name the **specific** app, service or device — that is the answer to "what made it slow".

```powershell
# the slow-boot detail, including the offenders list
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Diagnostics-Performance/Operational'; Id=100,101,102,103,106,109,110} -MaxEvents 30 |
  Select-Object TimeCreated,Id,Message | Format-List
```

## Startup impact ratings

Task Manager's **Startup apps** tab rates each entry Low/Medium/High. The rating comes from measured disk+CPU time during previous boots — it is real data, not a guess.

- **High** entries are worth questioning.
- Entries with **no rating** have not booted enough times to be measured.
- `StartupApproved` registry keys hold the enable/disable state and are what the UI toggles.

```powershell
Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User
```

## The three places autostart hides

| Location | Seen by Task Manager? |
|---|---|
| `HKCU/HKLM ...\Run` | yes |
| Startup folder | yes |
| **Scheduled tasks with logon triggers** | **no** |
| **Services set to Automatic** | **no** |

That is why disabling everything in Task Manager can leave a machine slow: the remaining load is services and scheduled tasks. See [scheduled tasks and wake timers](https://winbook.fyi/en/windows/perf/scheduled-tasks/) and [services](https://winbook.fyi/en/windows/perf/services/).

> **Caution: Do not disable services from a blog list**
>
> Random "optimisation" lists disable services other software depends on, and the symptom appears days later as a broken feature. Understand the dependency tree before touching a service.

## When it is not startup at all

- **Fast Startup + a slow disk**: the resume path reads a large hiberfile.
- **Profiles on a network share** (domain): logon waits for the network.
- **Antivirus full scan** scheduled at logon.
- **Windows Update** finishing an install at boot.

## A sane order of operations

1. Read events 101/102/103/109 — get names, not vibes.
2. Disable High-impact startup apps you recognise.
3. Check scheduled tasks with logon triggers.
4. Only then consider services.
5. Re-measure with the same event query, same conditions.

## Related

- [Services: what is safe to disable](https://winbook.fyi/en/windows/perf/services/)
- [Scheduled tasks and wake timers](https://winbook.fyi/en/windows/perf/scheduled-tasks/)
- [Sleep, hibernate and Fast Startup](https://winbook.fyi/en/windows/perf/sleep-hibernate-faststartup/)

## Lab boundary

E1. Event IDs and their fields are documented by Microsoft; the lab VMs boot from virtual disks, so no boot-duration figures are published here.

## Sources

- [Microsoft Learn — Windows Performance Toolkit](https://learn.microsoft.com/en-us/windows-hardware/test/wpt/)
- [Microsoft Learn — Windows Engineering Guide](https://learn.microsoft.com/en-us/windows-hardware/test/weg/)
- [Microsoft Learn — Task Scheduler](https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page)

---

Source: https://winbook.fyi/en/windows/perf/boot-time/