Practical Lab: Desktop Internals Exploration

Objective

See the parts of the Windows desktop for yourself: the shell process, the compositor, window handles, the desktop folder, the clipboard history and (optionally) notification Focus. Everything here is safe and reversible. Part 2 restarts only the shell (not Windows), and the optional Part 7 can be switched back in one click.

Time: 25–30 minutes
You need: A Windows 10 or 11 PC. No extra software. Close or save any work that you care about before Part 2.

What to Open

Part 1: Meet the Shell and the Compositor (PowerShell)

Type this and press Enter:

Get-Process explorer,dwm | Select-Object Name, Id, CPU, WorkingSet

1. How many explorer lines do you see? ________________ (one is the shell. You may see more if you have separate folder windows running.)
2. Process ID (Id) of dwm: ________________
3. Does dwm appear exactly once? ________________

(If a name is not found, PowerShell prints an error for that name. The dwm process belongs to your sign-in session, so it should be there.)

Now open Task Manager → Details tab. Find explorer.exe and dwm.exe. Look at the User name column: Explorer runs as you. Is dwm.exe also shown as you, or as a special account such as DWM-1? ________________ (Either can be correct. DWM uses its own limited account on many systems.)

Part 2: Restart the Shell (Safe, but Save Your Work First)

This only restarts the Windows shell. It does not restart Windows, and it does not close your other programs. But a file copy in progress, and open File Explorer windows, will be interrupted. Save your work first.

• Open Task Manager (Ctrl + Shift + Esc). If you see the small view, click More details.
• On the Processes tab find Windows Explorer (under Apps or Windows processes).
• Right-click it and choose Restart.
• Watch the screen: the taskbar and desktop icons vanish for a moment, then return.
• Notice that Task Manager and your other programs stayed open the whole time.

Run Part 1's first command again.

4. Is the process ID of explorer the same as before? ________________ (Expect a new number: it is a new process.)

What this proved: The shell is just a process (Section 1.1). If your taskbar ever freezes, this is the first thing to try. If the taskbar does not come back, in Task Manager choose File → Run new task, type explorer.exe, and press Enter.

Part 3: Window Handles (PowerShell)

Open Notepad and a File Explorer window, and keep them open. In PowerShell run:

Get-Process | Where-Object MainWindowTitle -ne '' | Select-Object Name, MainWindowTitle, MainWindowHandle

5. Find your Notepad row. Its MainWindowHandle is: ________________
6. Is every running process in this list? ________________ (No. Only those with a visible main window. Services and background programs are missing.)
7. Close Notepad and open it again. Run the command again. Is the handle the same? ________________ (It will be different: a new window gets a new handle.)

(Optional: if you have Visual Studio, its Spy++ tool shows the full tree of windows and their messages. It is not required.)

Part 4: The Desktop Is a Folder

• Press Win + R, type shell:desktop, and press Enter.
• A File Explorer window opens showing the same items as your desktop icons.
• Look at the address bar. It shows C:\Users\<your name>\Desktop (or a OneDrive path, if your Desktop is backed up with OneDrive).
• Press Win + R, type shell:common desktop and press Enter. This is the Public Desktop: icons shared with all users.

8. Name two icons that appear on your desktop but are not in the first folder (they might be special shell items such as This PC and Recycle Bin): ________________

Now press Win + R and type shell:startup, then Enter. This opens the folder of programs that start when you sign in.

9. Is it empty? ________________ (Do not add or delete anything. Just look.)

Press Win + R, type shell:programs and Enter. That is your personal Start Menu → Programs folder (%AppData%\Microsoft\Windows\Start Menu\Programs). Shortcuts here are what appear in your Start menu's app list.

Part 5: Composition and Previews

• Press Win + Tab. You see Task View: a picture of each open window. These pictures come from DWM's per-window buffers (Section 4.2). Press Esc to close.
• Hold Alt and press Tab once or twice, then release. Same idea.
• Hover the pointer over a taskbar button for a second: you see a live preview.
• Drag a window quickly around the screen.

See the GPU at work (optional). In Task Manager, open the Details tab, right-click a column header, choose Select columns, and tick GPU and GPU engine. Click OK. Drag windows around while you watch the dwm.exe row.

10. Does dwm.exe show some GPU use while you drag? ________________ (A small amount is normal.)

(To undo: right-click a column header → Select columns → untick the two items. This only changes what Task Manager shows.)

Part 6: Clipboard History

• Press Win + V. If a message asks you to turn on clipboard history, you may click Turn on, or skip this part. (To undo: Settings → System → Clipboard → Clipboard history → Off.) Leave Sync across devices off.
• Copy a word in Notepad (Ctrl + C), then copy a different word.
• Press Win + V again. You see both items in a list. Click the first one to paste it.
• Open Paint. Now copy a picture (for example, right-click an image in a browser → Copy image) and paste it in Paint. This is the format idea of Section 5.2: text versus bitmap. Then, with the picture still copied, try Ctrl + V in Notepad.

11. Does Notepad accept a copied picture? ________________ (No. It wants text format. Paint accepts a bitmap.)

When finished, in the Win + V panel choose Clear all so nothing private stays in the history.

Part 7 (Optional): Notification Focus

• Click the clock in the taskbar to open the notification centre. Note what is listed.
• Turn Do not disturb or Focus on (Windows 11: bell icon in the notification centre; Windows 10: Focus assist in the Action Center).
• Trigger something that normally pops a toast (for example connect a USB drive, or use a timer app). Notice that no pop-up appears but the item still arrives in the centre.
• Undo: turn Do not disturb or Focus off again.

What Should Happen

• Part 1 and 2 show that explorer.exe and dwm.exe are ordinary processes, and that Explorer gets a new process ID after a restart.
• Part 3 lists handles for windows only, and each new window has a new handle.
• Part 4 shows that the desktop is a folder.
• Part 5 shows previews made from each window's own picture.
• Part 6 shows that the clipboard can hold several items and several formats.

Interpretation Guide

Follow-Up Questions

1. Why do your other programs keep running when Explorer restarts?
2. Why is the process ID of Explorer different after the restart, while Windows itself stays up?
3. Why does MainWindowHandle change when you reopen Notepad?
4. If the desktop is just a folder, where would you look to find out why an old shortcut still shows up on it?
5. Why does pasting into Notepad lose the bold formatting that Word kept?