3: The Windows Operating System

Disk Operating System (DOS)

An operating system that the computer uses to enable data storage devices to read and write files.

Master Boot Record (MBR)

Contains small program responsible for locating and loading operating system.

Windows NT

Stands for "New Technologies".

Vulnerability

Some flaw in the operating system.

Hardware Abstraction Layer (HAL)

Software that handles all of the communication between the hardware and the kernel.

Kernel

The core of the operating system and has control over the entire computer. It handles all of the input and output requests, memory, and all of the peripherals connected to the computer.

File System

How information is organized on storage media.

New Technology File System (NTFS)

This is the most commonly used file system when installing Windows. All versions of Windows and Linux support NTFS.

Partition

Areas into which a hard drive is divided. Each partition is a logical storage unit that can be formatted to store information.

Master File Table (MFT)

Table that contains locations of all files and directories on partition, including file attributes such as security information and timestamps.

MACE

The timestamps Modify, Access, Create, and Entry Modified are often used in forensic investigations to determine the history of a file or folder.

Alternate Data Streams (ADS)

By using NTFS, you can connect Alternate Data Streams to the file. This is sometimes used by applications that are storing additional information about the file.

Windows Boot Process

Many actions that occur between time computer power button is pressed and Windows is fully loaded.

Basic Input-Output System (BIOS)

BIOS firmware was created in the early 1980s and works in the same way it did when it was created.

Unified Extensible Firmware Interface (UEFI)

Designed to replace BIOS and support new features.

Boot Configuration Database (BCD)

Contains additional code needed to start computer.

Registry

Record of all settings, options, hardware, and software the computer has.

Process

Any program that is currently executing.

Thread

A part of the process that can be executed. The processor performs calculations on the thread.

Services

Programs that run in the background to support the operating system and applications.

Virtual Address Space

The set of virtual addresses that the process can use.

Virtual Address

Not the actual physical location in memory, but an entry in a page table that is used to translate the virtual address into the physical address.

Process Handle

The process handle provides the access needed by the user space process without a direct connection to it.

Windows Registry

Windows stores all of the information about hardware, applications, users, and system settings in a large database known as the registry.

HKEYCURRENTUSER (HKCU)

Holds information concerning the currently logged in user.

HKEY_USERS (HKU)

Holds information concerning all the user accounts on the host.

HKEYCLASSESROOT (HKCR)

Holds information about object linking and embedding (OLE) registrations. OLE allows users to embed objects from other applications (like a spreadsheet) into a single document (like a Word document).

HKEYLOCALMACHINE (HKLM)

Holds system-related information.

HKEYCURRENTCONFIG (HKCC)

Holds information about the current hardware profile.

Local User

When you start a new computer for the first time, or you install Windows, you will be prompted to create a user account. This is known as a local user.

Group

Will have a name and a specific set of permissions associated with it.

Domain

A type of network service where all of the users, groups, computers, peripherals, and security settings are stored on and controlled by a database.

Domain Controller (DC)

Special computers or groups of computers where the domain database is stored.

Batch Files

Files that can be created to execute multiple commands in succession, much like a basic script.

Windows Management Instrumentation (WMI)

Used to manage remote computers. It can retrieve information about computer components, hardware and software statistics, and monitor the health of remote computers.

net command

Used in the administration and maintenance of the OS.

Domain Name System (DNS)

Should be tested because it is essential to finding the address of hosts by translating it from a name, such as a URL.

Server Message Block (SMB)

Originally developed by IBM, Microsoft aided in the development of the SMB protocol to share network resources.

Universal Naming Convention (UNC)

Format used to connect to resources.

Administrative Share

Special shares automatically created by Windows, identified by dollar sign ($) after share name.

Remote Desktop Protocol (RDP)

Feature that allows logging in to remote host and manipulating that computer as if it were local, to make configuration changes, install software, or troubleshoot an issue.

Windows Server

Edition of Windows mainly used in data centers. Family of Microsoft products that began with Windows Server 2003.

Process ID (PID)

Each process running on the computer has a unique PID.

Windows Event Viewer

Logs the history of application, security, and system events.

Zero-Day Exploits

These are attacks that come so quickly that defenses against them have not yet been devised and distributed.

Patches

Code updates that manufacturers provide to prevent a newly discovered virus or worm from making a successful attack.

Service Pack

From time to time, manufacturers combine patches and upgrades into a comprehensive update application called a service pack.

Security Policy

A set of objectives that ensures the security of a network, the data, and the computer systems in an organization.

Windows Local Security Policy

Can be used for stand-alone computers that are not part of an Active Directory domain.

Malware

Includes viruses, worms, Trojan horses, keyloggers, spyware, and adware. These are designed to invade privacy, steal information, damage the computer, or corrupt data.

Windows Defender

Windows has built-in virus and spyware protection called Windows Defender.

Firewall

A firewall selectively denies traffic to a computer or network segment.

Restrictive Security Policy

By opening only the required ports on a firewall, you are implementing a restrictive security policy. Any packet not explicitly permitted is denied.

Permissive Security Policy

Permits access through all ports, except those explicitly denied.