Skip to content

Lesson 01 — Windows Architecture

Microsoft Windows is one of the most widely used operating systems in the world.

It powers:

  • Enterprise Workstations
  • Corporate Laptops
  • Domain Controllers
  • File Servers
  • Microsoft Azure Virtual Machines
  • Enterprise Applications
  • Active Directory Infrastructure

Although Linux dominates cloud infrastructure, Windows remains the standard operating system in many enterprise environments.

Every Cloud Engineer, Cybersecurity Professional, DevOps Engineer, System Administrator, and SOC Analyst should understand how Windows works internally.

In this lesson, you’ll learn how Windows is designed, how it starts during boot, and how its major components work together.


After completing this lesson, you will be able to:

  • Understand Windows architecture.
  • Explain User Mode and Kernel Mode.
  • Learn the Windows boot process.
  • Identify core Windows components.
  • Understand Windows services and processes.
  • Explore enterprise Windows architecture.
  • Apply Windows architecture knowledge in enterprise environments.

Windows is a graphical operating system developed by Microsoft.

It provides:

  • Hardware Management
  • Memory Management
  • Process Scheduling
  • Security
  • Networking
  • Storage Management
  • User Interface

Windows allows users and applications to interact safely with computer hardware.


Microsoft provides different editions for different use cases.

Examples include:

  • Windows 11 Home
  • Windows 11 Pro
  • Windows Enterprise
  • Windows Server 2025
  • Windows Server Datacenter
  • Azure Edition

Enterprise environments commonly use Windows Pro, Enterprise, and Windows Server.


Windows is built using a layered architecture.

Applications
User Mode
Windows API
Kernel Mode
Hardware Abstraction Layer (HAL)
Hardware

Each layer performs a specific function while protecting the operating system.


Applications run in User Mode.

Examples:

  • Microsoft Word
  • Google Chrome
  • Visual Studio Code
  • PowerShell
  • Microsoft Teams

Characteristics:

  • Limited privileges
  • Cannot directly access hardware
  • Isolated from the Windows kernel
  • Application crashes usually do not crash the operating system

Kernel Mode has unrestricted access to system resources.

Responsibilities include:

  • CPU Scheduling
  • Memory Management
  • Device Drivers
  • Process Management
  • File System Management
  • Hardware Communication

Only trusted operating system components execute in Kernel Mode.


Separating applications from the kernel improves:

  • Stability
  • Security
  • Reliability
  • Performance

If a browser crashes, Windows continues running because the browser operates in User Mode.


The Windows Kernel is the core of the operating system.

It manages:

  • Processes
  • Threads
  • Virtual Memory
  • Scheduling
  • Synchronization
  • Interrupt Handling

The kernel ensures all applications share system resources efficiently.


The Hardware Abstraction Layer (HAL) sits between Windows and the physical hardware.

Its purpose is to:

  • Hide hardware differences
  • Improve compatibility
  • Simplify driver development

Applications never communicate directly with hardware.


The Windows startup process follows several stages.

Power On
UEFI / BIOS
Windows Boot Manager
Windows Loader
Kernel
Drivers
Services
Logon Screen
Desktop

If any stage fails, Windows may not boot correctly.


The Windows Boot Manager is responsible for:

  • Starting Windows
  • Selecting the operating system
  • Loading boot configuration

Configuration is stored in the Boot Configuration Data (BCD) store.


The Windows Loader performs several tasks:

  • Loads the Windows kernel
  • Loads hardware drivers
  • Initializes memory
  • Starts system services

Once complete, Windows continues the startup process.


Every running application becomes a process.

Examples:

  • explorer.exe
  • winlogon.exe
  • svchost.exe
  • powershell.exe
  • chrome.exe

Windows schedules these processes using the kernel.


A process can contain multiple threads.

Example:

Microsoft Edge
Thread 1
Thread 2
Thread 3

Threads allow applications to perform multiple tasks simultaneously.


Windows uses:

  • Physical Memory (RAM)
  • Virtual Memory
  • Paging Files

If RAM becomes full, Windows temporarily stores inactive data in the page file on disk.


Windows primarily uses:

  • NTFS
  • FAT32
  • exFAT
  • ReFS (Server)

NTFS is the enterprise standard because it supports:

  • Permissions
  • Encryption
  • Compression
  • Auditing
  • Large file support

You’ll explore NTFS in the next lesson.


Background applications are called Windows Services.

Examples:

  • Windows Update
  • Print Spooler
  • Windows Defender
  • DNS Client
  • DHCP Client

Services start automatically during boot and run without user interaction.


Windows stores configuration settings in a central database called the Registry.

It contains:

  • Hardware configuration
  • User preferences
  • Installed software
  • System settings

You’ll study the Registry in a later lesson.


Windows security includes:

  • User Accounts
  • Groups
  • Active Directory
  • Windows Defender
  • BitLocker
  • Firewall
  • User Account Control (UAC)

These features protect enterprise systems from unauthorized access.


Cloud Engineers commonly deploy:

  • Azure Virtual Machines
  • Amazon EC2 Windows Instances
  • Remote Desktop Servers
  • IIS Web Servers
  • Active Directory Servers

Understanding Windows architecture helps administrators troubleshoot and manage cloud workloads.


Security professionals analyze:

  • Windows Processes
  • Services
  • Registry Changes
  • Authentication Events
  • Event Logs
  • Memory
  • System Boot

Understanding the operating system’s architecture is essential for incident response and threat hunting.


Display system information:

Terminal window
systeminfo

Display Windows version:

Terminal window
winver

Display computer name:

Terminal window
hostname

Display running processes:

Terminal window
tasklist

Display memory information:

Terminal window
Get-ComputerInfo

A company deploys Windows Server in Azure.

Azure Virtual Machine
Windows Server
Active Directory
DNS
Group Policy
Enterprise Applications
Employees

Understanding Windows architecture enables administrators to deploy, manage, and troubleshoot enterprise services effectively.


As a Windows administrator:

  • Keep Windows updated.
  • Install only trusted drivers.
  • Monitor critical services.
  • Understand the Windows boot process.
  • Document system configurations.
  • Follow the Principle of Least Privilege.
  • Use enterprise editions for business workloads.
  • Monitor system health regularly.

These practices improve reliability, security, and operational efficiency.


After completing this lesson, you should understand:

  • Windows architecture.
  • User Mode and Kernel Mode.
  • Windows boot process.
  • Windows kernel.
  • Hardware Abstraction Layer (HAL).
  • Windows processes and threads.
  • Windows services.
  • Enterprise Windows architecture.

Windows Architecture provides the foundation for every enterprise Windows system.

Understanding how Windows boots, manages memory, schedules processes, and communicates with hardware will help you troubleshoot problems, administer enterprise systems, and secure Windows environments.

These concepts will support everything you learn throughout the Windows Fundamentals module, including Active Directory, PowerShell, Windows Security, and Enterprise Administration.


➡️ Lesson 02 — Windows File System (NTFS & Storage)

In the next lesson, you’ll explore the Windows file system, learn how NTFS stores and secures data, understand drives, folders, partitions, permissions, and enterprise storage management.