Chapter 30 · Windows Desktop Internals

Knowledge Check

9 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What are the two jobs of explorer.exe?
  2. Which programs start Explorer when you sign in?
  3. What happens to your other programs if Explorer crashes?
  4. Where are the files that appear as desktop icons stored?
  5. What is an HWND?
  6. What is a window procedure (WndProc)?
  7. What does DWM (dwm.exe) do?
  8. Which message tells a window "the left button was double-clicked on you"?
  9. What is delayed rendering on the clipboard?
  10. What does it mean when a window shows "Not Responding"?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. Two jobs of explorer.exe

It is File Explorer (folder windows) and the shell, which draws the desktop, taskbar, Start button and notification area.

2. Who starts Explorer

winlogon.exe and userinit.exe set up your session after sign-in and start the shell (Chapter 24).

3. Explorer crash

The taskbar and icons disappear, but the other programs keep running. They are separate processes. You can start Explorer again from Task Manager (File → Run new task → explorer.exe).

4. Desktop icon storage

In C:\Users\<name>\Desktop (yours) and C:\Users\Public\Desktop (shared). Explorer shows both, plus special items like This PC and Recycle Bin.

5. HWND

A handle to a window: an identity number the system gives each window. Programs use it to ask the window manager to do things, without touching the kernel's real window object.

6. Window procedure

The function registered with a window class that receives and handles all messages for the windows of that class (paint, click, key, close).

7. DWM

It composes the final screen image. Each window draws into its own buffer. DWM stacks them in order, adds transparency, shadows and animations, and uses the GPU.

8. Double-click message

WM_LBUTTONDBLCLK.

9. Delayed rendering

The program announces a clipboard format but only creates the data when somebody actually pastes. It saves time and memory for big items.

10. Not Responding

The thread that owns the window has stopped handling its messages for several seconds (it is busy or stuck). The rest of the PC normally keeps working.

UNDERSTANDING QUESTIONS

Q1. Why can Windows restart Explorer without signing you out?

Answer Explorer is a normal user-mode process, not part of the kernel. Your session, your other programs and the services do not depend on it. Restarting the shell is just stopping one process and starting a new one, which then redraws the taskbar and desktop.

Q2. Why did the Windows 8 and later desktop stop having smears behind moving or hung windows, unlike old Windows?

Answer Because of composition. Windows have been drawing into private buffers since Windows Vista, and DWM keeps the last picture of each window. When a window is moved or uncovered, DWM simply redraws from the stored pictures, with no need for the program to repaint. (Vista introduced this; Windows 8 made DWM mandatory.)

Q3. Why does each window-owning thread have its own message queue?

Answer So that one slow or stuck program cannot block input for the others. The input system sorts events into separate queues. A hung thread only fills its own queue, which is why one window can say "Not Responding" while the pointer and other programs keep working.

Q4. Why do the keyboard and mouse use different rules to choose the target window?

Answer Mouse input is about **position**: you expect the click to go to what is under the pointer, so Windows does hit testing. Keyboard input has no position, so it goes to the window with **focus**, which you chose earlier by clicking or tabbing.

Q5. Why does pasting the same copied text give different results in Word and in Notepad?

Answer Copy places several formats on the clipboard at once (private, rich text, plain text). Each pasting program picks the best format that it understands. Word picks the rich format and keeps bold and colour. Notepad understands only plain text, so formatting is lost.

SCENARIO QUESTIONS (Troubleshooting)

S1. The taskbar is frozen and Start does nothing, but your browser works. What do you try first?

Answer Open Task Manager (`Ctrl + Shift + Esc`), select **Windows Explorer** and choose **Restart**. This restarts only the shell. Save your work first, because copies in progress may be interrupted.

S2. After a crash, the taskbar and icons are gone and only the wallpaper shows. How do you bring them back?

Answer Press `Ctrl + Shift + Esc`, choose **File → Run new task**, type `explorer.exe` and press Enter. The shell starts again and draws the desktop and taskbar.

S3. Right-clicking in File Explorer takes five seconds to show a menu, but only for some file types. What is a likely cause?

Answer A slow third-party **shell extension** (context menu handler) loaded into Explorer. Remove or update the program that added it, or use a tool that lists shell extensions to find it.

S4. You double-click a shortcut on the desktop and get "Windows cannot find ...". Which step of the chain failed?

Answer The shell-execute step. The shortcut's target path no longer exists (the program was moved or uninstalled). Check the shortcut's **Properties → Target** and fix or delete the shortcut.

S5. Notepad is fine, but one big program shows "Not Responding" while you move the mouse smoothly everywhere. What does this tell you?

Answer The system and input path are healthy. Only that program's window thread is not pumping messages, perhaps because of a long task. Wait a bit; if it does not recover, use **End task** in Task Manager. A frozen pointer everywhere would instead point to a driver or system problem.

INTERVIEW QUESTIONS

I1. Describe what a window message loop is.

Answer A loop in a GUI thread that calls `GetMessage` to wait for the next message from the thread's queue, `TranslateMessage` to turn key presses into characters, and `DispatchMessage` to call the target window's window procedure. It repeats until the program quits. If a handler runs too long, the loop stops and the window shows Not Responding.

I2. What does DWM do, and why does it use the GPU?

Answer DWM collects the off-screen buffer of every window and composes them into a single frame for the display. It treats each buffer as a texture and asks the GPU to blend them, which is fast and leaves the CPU free. This enables transparency, shadows, animations and window previews.

I3. Walk through what happens from a double-click on a desktop icon to a running program.

Answer Mouse report, drivers and the input system update the pointer. A hit test finds the desktop window (Explorer). Explorer gets `WM_LBUTTONDBLCLK`, its shell view maps it to the item and calls shell execute. The shell resolves the shortcut or file association, runs checks, and calls `CreateProcess`. The new process creates its window, draws into a buffer, and DWM and the GPU compose it for the monitor.

I4. What is the difference between USER/GDI and DWM?

Answer USER and GDI (user32.dll, gdi32.dll and the kernel-side win32k family) manage windows, messages, input and basic drawing. DWM is a separate user-mode process that takes the finished window pictures and composes the final screen image using the GPU.

I5. How does the clipboard let programs from different vendors exchange data?

Answer It is a system-wide shared object owned by the window station. The copying program places data in one or more agreed formats; the pasting program asks Windows for the format it prefers. Windows handles the memory sharing, so neither program needs to know about the other.

PRACTICAL TASK

Draw "one click on my desktop". Pick one icon on your own desktop. On paper or in a drawing tool, draw the full chain for double-clicking it: mouse, USB report, drivers, input system, hit test, Explorer, shell execute (write down whether yours is a shortcut or a file and what program opens it), CreateProcess, the new window, DWM and the monitor. Use Get-Process and the MainWindowHandle one-liner after launching the program to write down its process ID and window handle on the diagram.

Why This Matters

When something goes wrong (a click does nothing, a program will not start, a window freezes), you can point at the exact box in your drawing where the problem probably is. That is the skill that separates guessing from troubleshooting.

CHAPTER SUMMARY

  • explorer.exe is File Explorer and the shell: desktop, taskbar, Start, tray. It starts at sign-in and can be restarted without logging out. Shell extensions add features inside it.
  • The desktop is a folder shown as icons; the taskbar shows one button per window plus the notification area; the Start menu is built from shortcuts, pinned items and search.
  • A window has an HWND, a class and a window procedure; each GUI thread has a message queue and a message loop. Stopping the loop gives "Not Responding".
  • USER/GDI (win32k family) manage windows and input; DWM composes every window's buffer with the GPU, giving effects and smooth previews.
  • Notifications are toasts drawn by the shell; the clipboard is a shared object holding data in several formats, with delayed rendering and optional history.
  • The input system sends mouse messages to the window under the pointer (hit test) and keyboard messages to the focus window.
  • The complete chain: mouse → driver → input system → hit test → Explorer → shell execute → CreateProcess → new window → DWM → GPU → monitor.