Changing the Windows boot logo

This is the answer I give to IT people when they ask if it's okay to customize the Windows boot logo.


If you hack the bitmap everything will seem fine until six months down the road when you decide to install the latest service pack. The service pack installer will not upgrade your ntoskrnl because it looks at the file and says "Hm, this isn't the standard uniprocessor ntoskrnl, it's not the standard multiprocessor ntoskrnl, it's not the standard advanced server ntoskrnl, I can't tell what this is, so I don't know which version of ntoskrnl to update it to. I'll just leave it alone."

If you are lucky you will bluescreen at boot because the old ntoskrnl is incompatible with some other critical part of the service pack.

If you are unlucky, your machine will appear to run normally when in fact it is quietly corrupting itself, and then it will keel over or generate bogus data when you least expect it.

If you planned ahead, you will have quit your job and moved to Hawaii so the disaster falls on your replacement's head to clean up while you sit on the beach sipping a pina colada.

Comments (12)
  1. Omer says:

    What ever happened to rolling back the service pack installation after failing to recognize the version of ntoskrnl?
    This isn’t really an excuse for not changing the windows boot logo. This is an excuse for changing the service pack installers.

  2. Andy Smith says:

    here’s an idea.
    store the boot images in a seperate file that makes it easy to change them. why the hell do I need to hack ntoskrnl to change an image.

  3. Raymond Chen says:

    It’s called branding. My Sony Vaio doesn’t let me change the boot image. Neither does my Toshiba DVD player or my Prius (yes, my car has a boot image). I bet your TiVo, PS2, Xbox and iMac don’t let you change the boot image either. If you license a McDonalds franchise, I’m pretty sure you aren’t allowd to tinker with the McDonalds logo on the front of your store.

  4. Jake says:

    Waikiki tends to be more of a Mai Tai sort of place, rather than Pina Coladas.

  5. Videobruce says:

    I have modifyed the ntoskrnl bitmap, but I have the orginal file from the I386 folder back in it’s place (by itself in the System32 folder) and still can’t upgrade to SP4 running 2k w/SP3!
    Any ideas??

  6. quanta says:

    I just remember to swap it back with the original come patchy time. And then wait for the hacking community to churn out a logo maker that supports the new ntoskrnl. Another trick is to use ntoskrnl.exe /kernel=customlogo_krnl_file.exe on [boot] so you never physically mess with the real ntoskrnl.exe, although you have to remember to alter that line every service pack…

  7. Dan_the_Muse says:

    I have changed the bitmap in ntoskrnl.exe and saved it with a new name. In fact I’ve done this around 40 times with such names as kernel01.exe, kernel02.exe, etc. Altering the c:boot.ini file, you can use any of these alternate ntoskrnl.exe files. In fact, I have around 40 alternate boot.ini files, each of which uses a different one of these alternate ntoskrnl.exe files. Renaming one of these alternate boot.ini files (e.g. boot01.ini) to boot.ini in effect makes the change. I have a program that does this automatically after each boot. Now, the only potential hangup I know of is if ntoskrnl.exe changes, for instance by virtue of a Windows Update or service pack. This happened a few days ago to me. Fortunately, one of the programs I wrote alerted me to the fact that the Windows Update I just ran did change ntoskrnl.exe and I immediately disabled my alternate logo system and am using the standard (newly supplied) ntoskrnl.exe until I get around to altering the new one (40+ times). If I hadn’t caught this I don’t know what would have happened.

  8. Yoshi says:

    What you can do is alter the NTOSKRNL.EXE and save it as another filename (NTOSKRN2.EXE), thus leaving the NTOSKRNL.EXE unmodified. Then modify your boot.ini to have it point to NTOSKRN2.EXE. You will still get the modified bootlogo and leave the original NTOSKRNL.EXE intact. There’s an article about this on

  9. Perhaps you could all just give away this silliness of editing the kernel and use the /bootlogo option in BOOT.INI instead. I think this may be available only with Windows XP, though.

  10. Raymond Chen says:

    Commenting on this article has been closed.

Comments are closed.