How can I change the Windows XP or Windows 2000 boot screen?

A. First, a disclaimer: Microsoft doesn't support modifying core system files. Every time a service pack or hotfix replaces one of these files, you must perform the following procedure again. This procedure is provided as is and works as shown; please don't email me to ask for specific assistance. Please post all questions to the Windows & .NET Magazine forums.

When Windows starts, a progress bar indicating the status of the boot process appears on top of a Windows logo background. You can't use the registry or a configuration file (e.g., .ini file) to modify this background. However, you can modify the bitmap resource, which stores the background image, in the ntoskrnl.exe (the Windows kernel) file that's active during the boot process. You'll need to copy the ntoskrnl.exe file and replace the bitmap resource with the bitmap you want to use. If you want to modify an XP boot screen but you're not up to the challenge of manually modifying ntoskrnl.exe, you might want to try BootXP.

You'll need two applications to modify the ntoskrnl.exe file:

• Jasc Sofware's Paint Shop Pro to modify an XP boot screen (if you're modifying a Win2K boot screen, you can use any paint program because, unlike XP and as I explain later, Win2K doesn't rely on color palettes)
• Angus Johnson's Resource Hacker

The boot screen bitmap must consist of 16 colors. When you modify an XP boot screen, you'll need to download a 16-color Windows palette and 16-color viewable palette from the Windows 2000 FAQ Web site. Otherwise, the bitmap image that you create for your boot screen will appear as just a black image.

When Win2K displays the boot screen bitmap image, it loads the colors from the actual bitmap. When XP displays the bitmap image, it loads the colors from a standard palette, which complicates the process of replacing the bitmap image for the XP boot screen. The general steps for replacing the boot screen image in both XP and Win2K are as follows:

1. Start Resource Hacker.
2. From the file menu, select Open.
3. Navigate to the \%systemroot%\system32 folder (e.g., c:\windows\system32) and select ntoskrnl.exe.
4. From the File menu, select Save As and enter a name of ntoskrmd.exe (now you can safely edit the new file without risk of damaging the original file).
5. Expand the Bitmap folder in the left-hand pane, expand item 1, and select item 1033.
6. From the Action menu, select "Save [ Bitmap : 1 : 1033]".
7. Enter a location and name to use to save the existing bitmap, then click Save (keep Resource Hacker open and running on your system).
8. Start Paint Shop Pro and load the bitmap you just saved. (If you're modifying an XP boot screen, you'll see only a black image; if you're modifying a Win2K boot screen, skip to step 11).
9. From the Colors menu, select Load Palette.
10. Load the 16.pal file (i.e., the viewable palette file) you downloaded and ensure you've selected "Maintain indexes" under the "Apply palette using" section. After you load the viewable palette, the boot screen bitmap will appear on screen.
11. Modify the boot screen bitmap as you desire.
12. If you're modifying an XP boot screen, after you finish modifying the bitmap, select Load Palette from the Colors menu, then load the win.pal file (i.e., the Windows palette file) you downloaded. The screen will go black again. If you're modifying a Win2K boot screen, continue to the next step.
13. Save the bitmap file and close your paint program.
14. Back in Resource Hacker, ensure that you still have the 1 under Bitmap selected (from step 5).
15. From the Action menu, select Replace Bitmap.
16. Press the "Open file with new bitmap" button.
17. Select the new bitmap you created, then click Open.
18. On the Replace dialog box, ensure that bitmap 1 is selected, then click Replace.
19. From the File menu, click Save.
20. Go to Start, Run, and type

    cmd.exe

    to open a command prompt.
21. Navigate to the root of the C: drive by typing

    c:
    cd \ 

22. So that you can edit the file, modify the boot.ini file attributes by typing

    attrib boot.ini -r -s -h 

23. Edit boot.ini, copy your current Windows start line to a new entry with a modified kernel to create a modified boot option, then save. For example, you would change

      [boot loader]
      timeout=5
      default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
      [operating systems]
      multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP
      Professional" /fastdetect

    to

      [boot loader]
      timeout=5
      default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
      [operating systems]
      multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP
      Professional" /fastdetect
      multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP
      Professional Modified Start Screen" /fastdetect /kernel=ntoskrmd.exe 

24. Reset the boot.ini attributes to their default state by typing

    attrib boot.ini +r +s +h 

25. Reboot the machine and select the modified boot option you just created to view your modified boot screen. If the boot process fails, select the unmodified boot option.

After you're happy with your modified boot screen, you can change the boot.ini file to include only the modified boot entry with the /kernel option. For example,

  [boot loader]
  timeout=5
  default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
  [operating systems]
  multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP
  Professional Modified Start Screen" /fastdetect /kernel=ntoskrmd.exe

Be aware that if you apply a service pack or a hotfix and you continue to use the modified ntoskrnl.exe file, the fixes you apply won't go into effect and you might experience compatibility problems. Should this happen, you can manually replace the standard ntoskrnl.exe file with the modified version by booting into the Recovery Console or by pressing F8 during the boot process to boot into "Safe mode command prompt." If you use either method, you'll boot to a command prompt where you can overwrite the standard ntoskrnl.exe. If a service pack or hotfix replaces ntoskrnl.exe, you'll need to modify the new ntoskrnl.exe file supplied with the fix to restore your modified boot screen.

You can use Resource Hacker to explore the other bitmaps you can change. Just be sure you always have an alternative boot option and that you don't change the original ntoskrnl.exe while experimenting. For example, bitmap 8 for XP is the three progress bars that scroll across the screen during the boot process (you can change this bitmap by following the steps I outlined above and substituting bitmap 1 for bitmap 8).

A few words of warning. I've noticed that when I edit a bitmap in Paint Shop Pro and save the image under a different name, the new picture is a different size. As a result, when I insert the image into ntoskrnl.exe and attempt to boot the system, the boot process fails and displays an error message indicating that the system can't find ntoskrnl.exe. You must save the bitmap image over the existing file that you used Resource Hacker to export.