Part 3 · Operating System

Chapter 8 · Windows Architecture

2 min read

Status: ✅ COMPLETE

Scope: How Windows (10 and 11) is built: the NT design, kernel mode and user mode, the Executive managers, system processes, the Object Manager, the registry, and the path from an app to the hardware
Time to complete: 90–120 minutes of reading + lab
Prerequisites: Chapters 1 to 4 (hardware), Chapter 7 (What an Operating System Really Does)
What you'll know after: What each layer of Windows does, which parts run in ring 0 and ring 3, how the system processes start each other, and how a program's request travels to the hardware

INTRODUCTION

Windows looks like a desktop with windows and icons. But under the desktop is a carefully layered machine. Every click you make moves through those layers: apps, libraries, the kernel, drivers and finally hardware.

This chapter is the map of that machine. It uses plain words and clear diagrams. Every technical term is explained the first time it appears. Some real photos of hardware show what the lower layers hide from you.

This chapter explains:

  • What the NT architecture is and how Windows grew from 1993 to Windows 11
  • What the kernel, the Executive, the HAL and drivers do in kernel mode (ring 0)
  • The managers inside the Executive: Process, Memory, I/O, Security, Configuration, PnP and Power
  • What lives in user mode (ring 3): subsystem DLLs, services, sessions and apps
  • The system processes (System, smss, csrss, wininit, services, lsass, winlogon, explorer) and who starts whom
  • How the Object Manager gives every resource a name and a handle
  • How the registry is stored in hives and managed by the Configuration Manager
  • How Win32, the Native API and system calls connect apps to the kernel
  • One complete architecture diagram and a lab to see it on your own PC

CHAPTER OUTLINE

Chapter Status: Complete
Estimated reading time: 100 minutes
Practical time: 35 minutes
Knowledge check time: 30 minutes