Skip to content
WinBookUnofficial

Where the boot minute goes

Verified 2 min read

Read the real boot timeline from Windows events, understand startup impact ratings, and stop blaming the wrong thing.

Tested onPro (26H2) / Server · Build 26300.9457 / 26100.33650 · x64
E1
Build
26300.9457 / 26100.33650
Edition
Pro (26H2) / Server
Architecture
x64
Support
Documentation (E1)
Evidence
E1Official documentation
Verified
2026-10-29
Page type
Method

The short answer

Section titled “The short answer”

“Boot time” is four different phases, and people measure the wrong one:

Phase What happens Typical duration
Firmware/POST memory training, device init 3–20s, worse with Fast Boot off
Boot loader → kernel driver init 2–8s
Session init services and logon 5–30s
Startup apps everything in Run/tasks/Startup folder 0–180s

Fast Startup (hiberboot) skips most of the first two phases, so a machine with it on can report a 12-second “boot” and still feel slow to a usable desktop — because the slow part moved to session init and startup apps.

Read the actual numbers

Section titled “Read the actual numbers”

Windows logs boot performance itself:

Terminal window
Get-WinEvent -LogName 'Microsoft-Windows-Diagnostics-Performance/Operational' |
  Where-Object Id -in 100,101,102,103,109,110 |
  Select-Object TimeCreated,Id,LevelDisplayName,
    @{n='BootMs';e={($_.Properties[4].Value)}} |
  Select-Object -First 15
Event Meaning
100 boot performance monitoring started
101 this boot was slow — the one you want
102 application took longer than 30s to start
103 service took longer than 30s to start
109 device took longer than 30s to initialise
110 background optimisation took long

Event 101 includes the boot duration in milliseconds. Events 102/103/109 name the specific app, service or device — that is the answer to “what made it slow”.

Terminal window
# the slow-boot detail, including the offenders list
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Diagnostics-Performance/Operational'; Id=100,101,102,103,106,109,110} -MaxEvents 30 |
  Select-Object TimeCreated,Id,Message | Format-List

Startup impact ratings

Section titled “Startup impact ratings”

Task Manager’s Startup apps tab rates each entry Low/Medium/High. The rating comes from measured disk+CPU time during previous boots — it is real data, not a guess.

  • High entries are worth questioning.
  • Entries with no rating have not booted enough times to be measured.
  • StartupApproved registry keys hold the enable/disable state and are what the UI toggles.
Terminal window
Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User

The three places autostart hides

Section titled “The three places autostart hides”
Location Seen by Task Manager?
HKCU/HKLM ...\Run yes
Startup folder yes
Scheduled tasks with logon triggers no
Services set to Automatic no

That is why disabling everything in Task Manager can leave a machine slow: the remaining load is services and scheduled tasks. See scheduled tasks and wake timers and services.

When it is not startup at all

Section titled “When it is not startup at all”
  • Fast Startup + a slow disk: the resume path reads a large hiberfile.
  • Profiles on a network share (domain): logon waits for the network.
  • Antivirus full scan scheduled at logon.
  • Windows Update finishing an install at boot.

A sane order of operations

Section titled “A sane order of operations”
  1. Read events 101/102/103/109 — get names, not vibes.
  2. Disable High-impact startup apps you recognise.
  3. Check scheduled tasks with logon triggers.
  4. Only then consider services.
  5. Re-measure with the same event query, same conditions.
Section titled “Related”

Lab boundary

Section titled “Lab boundary”

E1. Event IDs and their fields are documented by Microsoft; the lab VMs boot from virtual disks, so no boot-duration figures are published here.

Sources