Chapter 8 · Windows Architecture

Practical Lab: Windows Components

5 min read

Objective

See the parts of Windows from this chapter running on your own PC: the System process, session 0 services, handles, the registry hives and the event logs. You only look. Nothing in this lab changes any setting.

Time: 30–40 minutes
You need: A Windows 10 or 11 PC. One free optional tool (Process Explorer) is named in Part 2.

What to Open

ToolHow to open it
Task ManagerPress Ctrl + Shift + Esc
PowerShellPress Win, type PowerShell, press Enter (normal, not admin)
Command PromptPress Win, type cmd, press Enter
Registry EditorPress Win + R, type regedit, press Enter
Event ViewerPress Win + R, type eventvwr.msc, press Enter
System InformationPress Win + R, type msinfo32, press Enter

Part 1: Which Windows Is This? (winver and PowerShell)

Press Win + R, type winver, press Enter. Then run:

Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber, OSArchitecture
  1. Edition (Caption): ________________
  2. Build number: ________________
  3. Architecture (32-bit / 64-bit): ________________

The version starts with 10.0 even on Windows 11. Why? (Section 1.3.)

Part 2: Observe Processes (Task Manager and Process Explorer)

2A. Task Manager Details tab. Open the Details tab. Right-click a column header → Select columns and tick PID, Session ID, Handles, Threads.

  1. What is the PID of System? ________________ (Section 5.1)
  2. Which Session ID do services.exe and lsass.exe use? ________________
  3. Which Session ID do explorer.exe and your browser use? ________________
  4. How many handles does explorer.exe have? ________________ (Section 6.2)

2B. Process Explorer (optional, free). Process Explorer is a Microsoft Sysinternals tool. It is not part of Windows. Download it only from Microsoft's Sysinternals pages (learn.microsoft.com/sysinternals). It needs no installation: unzip and run procexp64.exe.

  • Choose View → Show Process Tree. You will see the family tree from Section 5.
  • Find services.exe and open the branch: its children are the svchost.exe rows.
  • Select explorer.exe, then View → Lower Pane View → DLLs. Look for ntdll.dll, kernel32.dll, user32.dll (Section 4.1).
  • Change the lower pane to Handles and look for entries of type File, Key, Event (Section 6.3).
  1. Which DLL is loaded in every process? ________________
  2. Name one Key handle (registry) that explorer.exe holds: ________________

Part 3: Kernel vs User Mode

3A. In Task Manager → Performance → CPU, right-click the graph and choose Show kernel times. Now open a few web pages or copy a big file.

  1. Does the dark (kernel) line rise when you copy a file? ________________

3B. Identify each of these as kernel or user mode (write K or U):

ItemK or U?
ntoskrnl.exe____
explorer.exe____
C:\Windows\System32\drivers\ntfs.sys____
lsass.exe____
hal.dll____
kernel32.dll____

3C. Look at the System process: Get-Process -Id 4. Notice that it has no file path, because System is not a program on disk.

Part 4: Services and Their Hosts

tasklist /svc
  1. How many svchost.exe rows do you see? ________________
  2. Pick one svchost row and write down two services inside it: ________________
Get-Service | Where-Object Status -eq Running | Select-Object -First 10 Name, DisplayName, StartType
  1. Which service is Automatic (Delayed Start), if any? ________________

Part 5: Registry Overview (read only)

Open regedit. Browse only. Do not edit anything.

  1. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Write the value of ProductName: ________________
  2. Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Which programs start at your logon? ________________
  3. Expand HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and open any one entry. What is the Start value? (0 = boot, 1 = system, 2 = automatic, 3 = manual, 4 = disabled) ________________

See the hive files. In File Explorer, show hidden files and browse to C:\Windows\System32\config. You should see files named SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT. (You may get a permission prompt: just look, do not copy or open them.) Your own NTUSER.DAT is in C:\Users\<your name>\, and is locked while you are logged on.

  1. Which hive file holds the local user accounts and password hashes? ________________

From a command prompt: reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild

Part 6: Event Logs

Open Event Viewer (eventvwr.msc). In the left pane open Windows Logs. You will see Application, Security, System and others.

  • Click System. Look for events with source Service Control Manager (Section 5.3). They tell you when services start and stop.
  • Click one event and read the General tab.
Get-WinEvent -LogName System -MaxEvents 5 | Select-Object TimeCreated, ProviderName, Id, LevelDisplayName
  1. Name the source of the most recent System event: ________________
  2. Find a Kernel-Power or Kernel-General event (Section 3.7). What does it report? ________________

What Should Happen

  • Part 2 shows services in session 0 and your apps in session 1 or higher.
  • Part 3 shows kernel time rising during disk activity.
  • Part 4 shows many svchost rows, each hosting a group of services.
  • Part 5 shows registry keys that match the chapter, and the hive files behind them.
  • Part 6 shows the OS recording its own life.

Interpretation Guide

What you seeWhat it means
System has PID 4 and no pathThe home of kernel threads (Section 5.1)
Services at session 0, your apps at 1+Session 0 isolation (Section 4.4)
Many svchost.exe rowsServices grouped for stability (Section 4.3)
explorer.exe has thousands of handlesNormal; it holds many files, keys and events
Hive file SAM or SECURITY not readableProtected by the SRM (Section 3.4)
Dark kernel line high all the timeA driver or antivirus filter may be busy
Many Service Control Manager eventsThe SCM logs each service start or stop (Section 5.3)

Follow-Up Questions

  1. Why does explorer.exe run in session 1 while services.exe runs in session 0?
  2. In the Process Explorer tree, what is the parent of svchost.exe, and why?
  3. Which hive does HKEY_CURRENT_USER come from, and when is it loaded?
  4. Why is System not an .exe file on disk?
  5. Name three facts from this lab that you could not have learned just by using the desktop.