winload.efi C:\Windows\System32\winload.efi

Windows OS loader in UEFI mode (winload.exe on legacy BIOS): loads the kernel, HAL, SYSTEM hive and boot drivers.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

winload.efi is the operating system loader. The boot manager starts it from the entry in the BCD store. It then loads the kernel (ntoskrnl.exe), the HAL, the SYSTEM hive and the drivers flagged as boot-start, before handing control to the kernel. On a legacy BIOS computer, the equivalent is winload.exe.

What it contains

An EFI binary signed by Microsoft in C:\Windows\System32, referenced in the BCD by the path \Windows\system32\winload.efi.
Next to it, winresume.efi resumes the system after hibernation.
It takes part in the Secure Boot chain and in code integrity checks.

Risks and best practices

If it is missing or corrupted, startup stops on a recovery screen that reports winload.efi as faulty. Do not delete or replace it.
To repair, boot WinRE and run startup repair, or recreate the boot files and BCD with bcdboot C:\Windows as administrator.
Do not disable signature checks to work around the error: it weakens Secure Boot.

Useful commands

# Show the file version
(Get-Item "$env:windir\System32\winload.efi").VersionInfo | Select-Object FileName, FileVersion, ProductName

# Check the file's digital signature
Get-AuthenticodeSignature "$env:windir\System32\winload.efi" | Select-Object Status, @{n="Signer";e={$_.SignerCertificate.Subject}}

# See the current boot entry and the loader path (\Windows\system32\winload.efi)
bcdedit /enum {current}

# Detect the firmware mode (UEFI or legacy BIOS)
(Get-ComputerInfo -Property BiosFirmwareType).BiosFirmwareType

Report a mistake