Section 3: The Applet Chain (UI → Hardware)

The Big Picture: What Happens After You Click

An applet window is only the front desk. The real work happens behind it. Every change follows a chain, a series of hand-offs, much like ordering at a restaurant:

The full chain, in one line:

UI  →  Windows API  →  Registry / config  →  Service or component  →  Kernel / driver  →  Hardware

Not every setting uses every link. The "Date and Time" chain has no driver of its own, but it does reach the clock chip. The "Programs and Features" chain has no hardware at all. This section walks through eleven applets.

A Complete Example: Changing the Mouse Pointer Speed

First, one chain in full. This is the clearest because you can watch the registry value yourself in the lab.

┌────────────────────────────────────────────────────────────────┐
│ 1. UI  (what you see)                                          │
│   You open Mouse (main.cpl) > Pointer Options, drag the        │
│   'Select a pointer speed' slider, click OK.                   │
└────────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌────────────────────────────────────────────────────────────────┐
│ 2. Applet code  (runs inside the host process)                 │
│   main.cpl reads the slider position (1 to 20)                 │
│   and calls a Windows function.                                │
└────────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌────────────────────────────────────────────────────────────────┐
│ 3. Windows API                                                 │
│   SystemParametersInfo(SPI_SETMOUSESPEED, 0, speed, ...)       │
└────────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌────────────────────────────────────────────────────────────────┐
│ 4. Registry  (the saved value)                                 │
│   HKCU\Control Panel\Mouse                                     │
│   MouseSensitivity = "10"  (text, 1 to 20; 10 is the default)  │
└────────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌────────────────────────────────────────────────────────────────┐
│ 5. Windows input system  (kernel side)                         │
│   Uses the new speed to scale each mouse movement.             │
└────────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌────────────────────────────────────────────────────────────────┐
│ 6. Driver and hardware                                         │
│   The mouse sends 'moved 5 steps'; the driver passes it on;    │
│   the pointer moves 'speed-times' further on the screen.       │
└────────────────────────────────────────────────────────────────┘

Step by step:

1. UI. main.cpl (the Mouse applet) shows a slider. The slider position is just a number from 1 to 20.
2. Applet code. When you click OK or Apply, the applet code runs inside its host process (Section 2.2).
3. Windows API. It calls SystemParametersInfo, a Windows function that is the official way to read and change many user settings (mouse speed, wallpaper, key repeat rate). The "action" asked for is SPI_SETMOUSESPEED.
4. Registry. Windows saves the value in your user settings, in the registry key HKEY_CURRENT_USER\Control Panel\Mouse. The value is called MouseSensitivity and is stored as text. 10 is the default. (A related setting, "Enhance pointer precision", is stored in MouseSpeed, MouseThreshold1 and MouseThreshold2.)
5. Windows input system. The part of Windows that turns raw mouse movement into pointer movement uses the new number as a multiplier.
6. Driver and hardware. The mouse driver delivers raw movement ("moved 5 steps"), and the pointer travels further or shorter on screen depending on the saved speed. The mouse hardware itself does not change.

You can read the saved value right now (this only reads):

Get-ItemProperty 'HKCU:\Control Panel\Mouse'

Key idea: The registry stores the wish. The API applies the wish now. At the next sign-in, Windows reads the same registry key again, so the wish is kept.

Now the eleven applets. For each one you see the chain and a short explanation.

3.1 System Settings (System Properties)

What it is: The System Properties window (sysdm.cpl) holds the computer name, advanced performance options, startup and recovery options, System Protection and Remote settings. On Windows 10 and 11 the first "About" page now lives in the Settings app, but the old tabbed dialog still opens with sysdm.cpl.

UI        : sysdm.cpl (tabs: Computer Name, Hardware, Advanced, System Protection, Remote)
   ↓
API       : SetComputerNameEx, SystemParametersInfo and other calls, depending on the tab
   ↓
Registry  : HKLM\SYSTEM\CurrentControlSet\Control\ComputerName       (the name)
            HKLM\SYSTEM\CurrentControlSet\Control\CrashControl       (crash dump settings)
   ↓
Component : Windows itself (some changes need a restart, such as a new computer name)
   ↓
Hardware  : usually none

Windows tip: Changing the computer name, performance and startup options needs administrator permission. That is why a shield icon appears on those buttons.

3.2 Network Settings (ncpa.cpl)

What it is: ncpa.cpl is the Network Connections folder. It lists each network adapter (Wi-Fi, Ethernet, virtual adapters) so you can enable, disable or rename it, or open its Properties to set an IP address and DNS.

Two terms first: An IP address is the number that names your PC on a network. DNS is the phone book that turns a name (like a website) into an IP address.

UI        : ncpa.cpl > adapter > Properties > Internet Protocol Version 4 (TCP/IPv4)
   ↓
API       : Network configuration APIs (the network shell, WMI and IP Helper functions)
   ↓
Registry  : HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{adapter GUID}
            (values such as EnableDHCP, IPAddress, SubnetMask, NameServer)
   ↓
Service   : Network connection services; the DHCP Client service if "Obtain automatically"
   ↓
Kernel    : The TCP/IP driver (tcpip.sys) and the NDIS network layer
   ↓
Hardware  : The network card (NIC), through its miniport driver

• Disabling an adapter is different from changing an IP. It tells the device itself to switch off, the same thing you can do in Device Manager (see Chapter 14).
• DHCP (Dynamic Host Configuration Protocol) means "let the router hand me an address". If you choose "Obtain an IP address automatically", the DHCP Client service asks the router.

3.3 Programs and Features (appwiz.cpl)

What it is: appwiz.cpl shows the programs installed on the PC and lets you uninstall, change or repair them.

UI        : appwiz.cpl  (the list, and the Uninstall button)
   ↓
API       : Reads the Uninstall registry keys; runs the program's own uninstaller
   ↓
Registry  : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
            HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall   (32-bit apps)
            HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall               (per-user apps)
   ↓
Service   : Windows Installer service (for .msi programs), or the app's own uninstaller
   ↓
Hardware  : none

Each installed program leaves a small key here with its name, version and an UninstallString. That string is the command Windows runs when you click Uninstall. The list you see is simply built from those keys. This is also why a program whose folder was "just deleted" can still appear in the list: its key was never removed.

The link "Turn Windows features on or off" opens a separate helper for optional Windows parts (for example Hyper-V or the Windows Subsystem for Linux).

3.4 Devices and Printers

What it is: The Devices and Printers applet (control /name Microsoft.DevicesAndPrinters) shows your mouse, keyboard, monitor, printers, phones and other plug-in devices as friendly pictures.

UI        : Devices and Printers  (a shell folder of device icons)
   ↓
API       : Plug and Play device-query functions; the Print Spooler APIs
   ↓
Registry  : HKLM\SYSTEM\CurrentControlSet\Enum    (every detected device)
            Printer settings under the Print Spooler's keys
   ↓
Service   : Plug and Play service; Print Spooler service (spoolsv.exe)
   ↓
Kernel    : The PnP manager, which loads the driver
   ↓
Hardware  : the device itself

This applet is a friendly face over the same device list that Device Manager shows in technical form. A printer on this page is managed by the Print Spooler service, which holds print jobs in a queue and sends them to the printer driver. If printing is stuck, restarting the Print Spooler service often helps.

3.5 Power Options (powercfg.cpl)

What it is: powercfg.cpl lets you choose a power plan: a named bundle of settings such as "turn off the display after 10 minutes", "sleep after 30 minutes" and processor speed limits.

UI        : powercfg.cpl > Change plan settings > Advanced power settings
   ↓
API       : powrprof.dll  (PowerSetActiveScheme, PowerWriteACValueIndex, PowerWriteDCValueIndex)
   ↓
Registry  : HKLM\SYSTEM\CurrentControlSet\Control\Power\User\PowerSchemes
            (the active plan, and each setting with its AC and DC value)
   ↓
Service   : The Power service
   ↓
Kernel    : The kernel's power manager, which tells drivers when to sleep or change speed
   ↓
Hardware  : display, disks, CPU speed, sleep states (ACPI)

• AC means plugged into the wall. DC means on battery. Every setting has two values, one for each.
• Each plan has a long unique ID (a GUID). The three classic plans are Balanced, High performance and Power saver. You can list yours (this only reads):

powercfg /list

• Windows tip: The kernel power manager and the sleep states (S0, S3, S4) were covered in Chapter 4, Section 5 (Power Management). This applet is the dial on top of that machinery.

3.6 User Accounts

What it is: The User Accounts applet (control /name Microsoft.UserAccounts, or the netplwiz tool) changes names, passwords and account types. In Windows 11 and recent Windows 10, much of it has moved to the Settings app under Accounts.

UI        : User Accounts applet (Change account type, Change your password)
   ↓
API       : Local account management functions (the NetUser and NetLocalGroup family)
   ↓
Store     : The SAM database (Security Account Manager)
            C:\Windows\System32\config\SAM, shown at HKLM\SAM (locked down)
   ↓
Service   : Local Security Authority (lsass.exe)
   ↓
Kernel    : The security reference monitor (checks who may do what)
   ↓
Hardware  : none

• SAM is the store where Windows keeps local account names and password hashes (a scrambled form of the password, never the password itself). Normal users cannot open it, which is intentional.
• Account type is really group membership. "Administrator" means the account is in the local Administrators group. "Standard" means it is only in Users.
• UAC (User Account Control) is the permission prompt you see when something needs admin rights.

3.7 Windows Defender Firewall (firewall.cpl)

What it is: A firewall is a guard that decides which network connections are allowed in and out. firewall.cpl shows its main page and links to Advanced settings.

UI        : firewall.cpl > Allow an app...  /  Advanced settings
   ↓
API       : Windows Firewall COM interfaces (INetFwPolicy2) and netsh advfirewall
   ↓
Registry  : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
            (the profiles: Domain, Private, Public; and the rules)
   ↓
Service   : Windows Defender Firewall service (MpsSvc) and Base Filtering Engine (BFE)
   ↓
Kernel    : Windows Filtering Platform (WFP) inside the network stack
   ↓
Hardware  : Packets from the network card are allowed or dropped before apps see them

• A profile is a set of rules for one kind of network. Public (cafe Wi-Fi) is strict; Private (home) is looser.
• Ticking a rule in the UI does not block anything by itself. The Base Filtering Engine loads the rule into the kernel filter, and the kernel enforces it on every packet.

3.8 Administrative Tools

What it is: Administrative Tools (called Windows Tools in Windows 11) is a folder of shortcuts to advanced management programs. It is not one applet that does something. It is a shelf that holds many.

UI        : Administrative Tools folder (shortcuts)
   ↓
API       : Each shortcut starts a tool; most are .msc files run by mmc.exe
   ↓
Registry  : (the shortcuts are plain files in the Start Menu program folders)
   ↓
Service   : depends on the tool (Event Log service, Task Scheduler, and so on)
   ↓
Kernel    : depends on the tool
   ↓
Hardware  : depends on the tool (for example Disk Management)

An .msc file describes a snap-in (a plug-in page) that opens inside the Microsoft Management Console (mmc.exe).

Some tools (such as Local Users and Groups and the Group Policy Editor) are not included in Windows Home editions.

3.9 Environment Variables (via System Properties)

What it is: An environment variable is a named piece of text that every program can read, for example PATH (where Windows looks for commands) or TEMP (where temporary files go). You edit them in System Properties → Advanced → Environment Variables, reached from sysdm.cpl.

UI        : sysdm.cpl > Advanced > Environment Variables
   ↓
API       : Registry functions, then a broadcast message (WM_SETTINGCHANGE)
   ↓
Registry  : HKCU\Environment                                                 (your variables)
            HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment  (all users)
   ↓
Component : The Explorer and other programs re-read them when told
   ↓
Kernel    : not involved; each new process gets a copy when it starts
   ↓
Hardware  : none

• There are two lists: User variables (only you) and System variables (everyone; admin needed).
• A program gets a copy of the variables when it starts. A program that was already open will not see your change. That is why you must open a new Command Prompt or PowerShell after editing PATH.
• You can read yours safely with Get-ChildItem Env: in PowerShell.

3.10 Date and Time (timedate.cpl)

What it is: timedate.cpl sets the date, the time, the time zone, and the Internet Time option that keeps your clock correct.

UI        : timedate.cpl (Date and Time, Additional Clocks, Internet Time tabs)
   ↓
API       : SetLocalTime / SetSystemTime, SetDynamicTimeZoneInformation
   ↓
Registry  : HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation     (the zone)
            HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters     (time server)
   ↓
Service   : Windows Time service (W32Time), which asks a time server over NTP
   ↓
Kernel    : The system clock, with the hardware layer driving the chip
   ↓
Hardware  : The real-time clock (RTC) chip on the motherboard, kept alive by the CMOS battery

• NTP (Network Time Protocol) is the language used to ask a time server "what time is it?". By default Windows asks a Microsoft time server.
• Changing the time needs a special privilege, because logs and security certificates depend on the clock. The change reaches the RTC chip (the clock and CMOS battery from Chapter 4, Sections 7 and 8).
• Windows normally treats the hardware clock as local time. (Some other systems treat it as UTC, which is why dual-boot PCs can show the wrong time.)

3.11 Region and Language (intl.cpl)

What it is: intl.cpl is the Region applet. It controls formats: how dates, times, numbers and currency look, and which day starts the week. (Language and keyboard choices have moved to the Settings app.)

UI        : intl.cpl > Formats / Administrative tabs
   ↓
API       : Locale functions (SetLocaleInfo, GetLocaleInfoEx) and NLS (National Language Support)
   ↓
Registry  : HKCU\Control Panel\International                      (date, decimal symbol, separators)
            HKLM\SYSTEM\CurrentControlSet\Control\Nls             (system-wide language data)
   ↓
Component : Programs read formats through the locale functions; no service is needed
   ↓
Kernel    : not involved for formats (the system locale also selects code pages for old programs)
   ↓
Hardware  : none

• A locale is a bundle of local rules: language, country, date style, number style. For example, one country writes 1,234.50 and another writes 1.234,50.
• The Administrative tab has "Change system locale" (the language for older non-Unicode programs) and "Copy settings" (apply your formats to the sign-in screen and new users).
• A change here affects every program that asks Windows for formats. A program with its own fixed date format will ignore it.

The Eleven Chains at a Glance

Summary