Section 2: Control Panel Architecture

The Big Picture: A Window Plus Many Plug-Ins

The Control Panel is not one giant program. It is a small shell (a window that shows icons) plus many plug-ins (the applets). Each plug-in is a separate file. Windows finds them, lists them, and runs them when you click.

Think of a TV with apps: the TV (the shell) knows how to show a menu and start an app. The apps (applets) do the real work. New apps can be added without changing the TV.

This section answers three questions:

1. What is inside an applet file? (Topic 2.1)
2. Which program runs it? (Topic 2.2)
3. How does Windows know the applet exists? (Topic 2.3)

2.1 .cpl Files: Applets Are DLLs With a Special Export

What it is: A classic applet is a file ending in .cpl ("Control Panel Library"). Under the hood, a .cpl file is a DLL.

Two terms first:

• DLL (Dynamic-Link Library): a file full of ready-made code that other programs can load and use. It cannot start by itself. It is like a toolbox that a program opens.
• Export: a named function inside a DLL that outsiders are allowed to call. It is like a labelled drawer in the toolbox.

A .cpl file is simply a DLL that offers one special export named CPlApplet. The Control Panel loads the DLL and calls CPlApplet again and again with messages, a bit like a conversation.

Control Panel (the shell)                 main.cpl (the applet DLL)          
        │                                            │
        │── CPL_INIT ───────────────────────────────>│  "ready?"
        │── CPL_GETCOUNT ───────────────────────────>│  "I have 1 icon"
        │── CPL_INQUIRE ────────────────────────────>│  "Mouse, with this icon"
        │── CPL_DBLCLK  (user clicked) ─────────────>│  shows the window
        │── CPL_STOP / CPL_EXIT ────────────────────>│  closes and cleans up

Your own PC has many of them. Windows keeps its built-in applets in the System32 folder. You can list them (read-only) in PowerShell:

Get-ChildItem C:\Windows\System32\*.cpl | Select-Object Name

Typical results (the list varies by Windows version and PC):

Why DLL and not an .exe? A DLL starts fast, shares the host's memory, and can hold several icons. Also, the Control Panel can ask it questions (name, icon) without opening its window.

Windows tip: A .cpl file is just a renamed DLL, so you can double-click one to open its applet. Never download or open a .cpl from an email or an unknown website. It is real program code and can do anything a program can, which is why attackers have used .cpl files to spread malware.

2.2 The Control Panel Host Process

What it is: A host process is the running program that loads and runs a plug-in. Because a .cpl DLL cannot run by itself, some process must host it.

Who the host is depends on how you start the applet:

Two terms first:

• rundll32.exe: a small Windows program whose only job is "load this DLL and call one of its exports for me". It is a general-purpose helper, not only for the Control Panel.
• shell32.dll: the big Windows library that draws the desktop, folders and file dialogs. It also contains the Control Panel's applet loader, in an export called Control_RunDLL.

So the real picture is a chain of loaders:

 you type: control main.cpl
        │
        ▼
 control.exe  ──────────►  shell32.dll : Control_RunDLL
 (tiny launcher)             (finds and loads the applet DLL)
                                  │
                                  ▼
                            main.cpl  (DLL)
                            exports CPlApplet
                                  │
                                  ▼
                            Mouse Properties window appears

Because the applet runs inside the host's process, a badly written applet can crash its host. A crashing third-party applet is a classic cause of "Control Panel has stopped working".

32-bit and 64-bit. A 64-bit host can only load 64-bit DLLs. Old 32-bit applets (for example some very old Java or driver panels) need a 32-bit host. Windows has both versions of the helper programs for this reason, and you may see old applets listed in a special place for 32-bit programs. You do not need to manage this, only to know it exists.

Many modern applets are not DLL-based. Newer applets (such as Network and Sharing Center or Windows Firewall's main page) are built with the shell's own page technology and run inside the Explorer or another host. The "applet chain" idea in Section 3 still applies.

2.3 Applet Registration: How Windows Knows What Exists

What it is: Registration means writing an entry in the registry so Windows knows an applet exists, what it is called and where it lives.

The registry is Windows' big settings database (a later chapter covers it in depth). You can look at it with regedit (the Registry Editor). Look, but do not change.

There are two styles of applet, and each is found differently:

Another term: A COM class is a little object registered with Windows under a very long unique number called a CLSID or GUID, written like {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}. Windows can create the object from the number alone.

For a modern applet, the registration works like this:

HKEY_LOCAL_MACHINE
 └─ SOFTWARE
     └─ Microsoft
         └─ Windows
             └─ CurrentVersion
                 └─ Explorer
                     └─ ControlPanel
                         └─ NameSpace
                             ├─ {GUID-1}   → this applet appears in Control Panel
                             ├─ {GUID-2}
                             └─ {GUID-3}   (one key per applet)

Each GUID there points to a normal class entry under HKEY_CLASSES_ROOT\CLSID\{GUID}. That entry holds the details: the display name, the icon, which category the applet belongs in, and which file contains the code. Many applets also carry an internal canonical name (a short name for people and scripts), such as Microsoft.PowerOptions. That is why this command works on most builds of Windows:

control /name Microsoft.PowerOptions

Some other canonical names you can use the same way (they work on most builds; some now redirect to the Settings app):

There is also one shell path that opens the list of all applets at once. Paste it into the File Explorer address bar, or Win + R:

shell:::{21EC2020-3AEA-1069-A2DD-08002B30309D}

That long number is the CLSID of the "All Control Panel Items" folder.

Per-user entries too. The same ControlPanel\NameSpace path also exists under HKEY_CURRENT_USER. An installer can therefore add an applet for just one user.

Which category? Each applet states which category it belongs to. That is how the Category view in Figure 15.1 (Section 1) knows to put "Uninstall a program" under Programs. One applet can show up under several category headings.

2.4 Putting It Together: Categories, Applets and Files

Here is the whole family tree. Read it top to bottom: a category groups applets, and each applet is shown by code in a file.

Control Panel (control.exe + Explorer)
 │
 ├─ System and Security
 │   ├─ System ................... (sysdm.cpl for the classic properties dialog)
 │   ├─ Power Options ............ (powercfg.cpl)
 │   ├─ Windows Defender Firewall  (firewall.cpl)
 │   └─ Administrative Tools ..... (shortcuts to .msc tools)
 │
 ├─ Network and Internet
 │   ├─ Network and Sharing Center (shell item)
 │   │    └─ Change adapter settings → ncpa.cpl
 │   └─ Internet Options ......... (inetcpl.cpl)
 │
 ├─ Hardware and Sound
 │   ├─ Devices and Printers ..... (shell item)
 │   ├─ Mouse .................... (main.cpl)
 │   └─ Sound .................... (mmsys.cpl)
 │
 ├─ Programs
 │   └─ Programs and Features .... (appwiz.cpl)
 │
 ├─ User Accounts .................. (shell item, netplwiz)
 │
 └─ Clock and Region
     ├─ Date and Time ............ (timedate.cpl)
     └─ Region ................... (intl.cpl)

Notice that one category page is not a file. It is just a grouping. Only the applets below it are real code.

2.5 Seeing the Architecture on Your Own PC

Three read-only checks prove everything above:

1. List the files: Get-ChildItem C:\Windows\System32\*.cpl shows the classic applet DLLs.
2. Open one by file name: Win + R, type appwiz.cpl, press Enter.
3. Look at the registry list: open regedit, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace, and expand it. Each GUID key is one modern applet. Do not edit or delete anything there. Removing a key would simply make that applet vanish from the Control Panel.

Summary