Section 1: Windows as Operating System

The Big Picture: One Family, Built in Layers

In Chapter 7 you learned what an operating system (OS) does: it shares the hardware between programs, keeps them apart, and gives them simple tools so they do not have to talk to chips directly. This chapter opens up Windows and shows how it is built.

The key idea is layers. Think of a restaurant. The customer (an app) never walks into the kitchen. The customer tells a waiter what they want. The waiter passes the order to the kitchen. The kitchen uses the stoves and fridges (the hardware). Each layer talks only to the layer next to it.

┌──────────────────────────────────────────────────┐
│  Your programs   (Chrome, Word, games)           │  USER MODE
├──────────────────────────────────────────────────┤  (ring 3)
│  Windows libraries and system programs           │
╞══════════════════════════════════════════════════╡  <- the wall
│  Windows kernel and Executive  (ntoskrnl.exe)    │  KERNEL MODE
├──────────────────────────────────────────────────┤  (ring 0)
│  Drivers  +  HAL (Hardware Abstraction Layer)    │
├──────────────────────────────────────────────────┤
│  Hardware: CPU, RAM, SSD, GPU, network card      │  PHYSICAL
└──────────────────────────────────────────────────┘

Remember rings from Chapter 2: the CPU has a "safe" level for normal programs (ring 3) and a "powerful" level for the core of the OS (ring 0). Windows uses exactly those two. The thick wall in the picture is that boundary. The rest of this chapter is a tour of each layer.

1.1 Windows as an Operating System

What it is: Windows is a general-purpose, multitasking, multi-user operating system made by Microsoft. "Multitasking" means it runs many programs at the same time. "Multi-user" means it can keep several people's files and settings apart.

What it hides from you. Below Windows sits real hardware, which is messy: every board has different chips, ports and addresses. Here are two real photos of that layer.

Figure 8.1 — The raw hardware that Windows sits on. Every board has different chips in different places. Windows must work on all of them. Photo: Arnulf zu Linden, CC BY-SA 3.0, numbers added, via Wikimedia Commons.

Figure 8.2 — The back of a PC: USB, audio, network and video sockets. A program that "plays a sound" does not know which of these chips makes the noise. Windows knows, and hides it. Photo: Hitachi-Train, public domain, via Wikimedia Commons.

The five jobs Windows does for every program:

The Windows design goals, simply put. Windows was designed to be portable (run on different CPU types), reliable (a bad app should not crash the whole PC), secure, compatible (old programs keep working) and extensible (new drivers and features can be added). Many odd things in Windows make sense once you remember "compatibility" is a goal: Microsoft keeps old behaviours for decades.

1.2 NT-Based Architecture

What it is: Every modern Windows (10 and 11 included) is built on the NT architecture. "NT" originally stood for New Technology. It is the design under the hood, not the pretty desktop on top.

Where it came from. In the late 1980s Microsoft hired Dave Cutler, a famous OS designer, who had led work on operating systems at Digital Equipment Corporation (DEC). His team built a brand-new, clean system from scratch. It was first released as Windows NT 3.1 in 1993.

What was new compared to old Windows:

Two families, one merge. For years Microsoft had two lines: the DOS-based line (Windows 95, 98, Me) for home users, and the NT line (NT, 2000) for businesses. With Windows XP (2001) the home users moved to NT too. The DOS line ended. Today all Windows is NT.

Key NT building blocks (each one gets its own section later):

Windows tip: Press Win + R, type winver, press Enter. The dialog shows your version and build number. Notice that even Windows 11 reports an internal version in the "10.0" family: the NT version number barely changed because the architecture is the same.

1.3 History: NT, 2000, XP, Vista, 7, 8, 10, 11

What it is: A short tour of the NT line. You do not need to remember dates. You need to see how the same core grew over time.

What did not change. Look at the "Internal version" column. From Vista to Windows 7 to 8 to 10 and 11 the numbers move only a little. The big layers (HAL, kernel, Executive, drivers, subsystem) stayed. Microsoft improves the NT core instead of throwing it away. That is why a program written years ago often still runs.

Server editions. The same core also powers Windows Server. Server and desktop share most code and differ in settings, features and licence.

1.4 Version Differences

What it is: The ways one Windows version can differ from another, even when the core is the same.

1. Edition (the product tier). Same version, different features.

2. Architecture (32-bit vs 64-bit). A 32-bit Windows can address only about 4 GB of memory. A 64-bit Windows can address far more. It also runs old 32-bit programs through a compatibility layer called WOW64 (Windows-on-Windows 64). Windows 11 comes only in 64-bit. Some versions also exist for ARM CPUs, not just Intel and AMD.

3. Build number and feature updates. Windows 10 and 11 receive big updates (for example "22H2", "23H2") that change the build number while the name stays the same. Smaller updates arrive monthly.

4. Hardware and security requirements. Windows 11 needs features such as TPM 2.0 (a small security chip) and Secure Boot (Chapter 5). Windows 10 is more relaxed.

Find out what you have:

Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber, OSArchitecture

Or press Win + R, type msinfo32, and read OS Name, Version and System Type.

Summary