Overview of Windows Operating System Architecture and Security

Disk Operating System (DOS)

Early storage relied on punch cards, tapes, and floppy disks.

MS-DOS

Basic interface for disk drive operations; foundation for early Windows GUIs.

Key MS-DOS commands

Commands include dir (Lists files), cd (Change directories), copy (Copy files), del (Delete files), mkdir (Create directories).

NT-based OS

Over 20 releases since 1993.

Windows 7 editions

Includes Starter, Home, Professional, Ultimate.

Windows 10 editions

Includes Home, Pro, Enterprise, Education.

Graphical User Interface (GUI)

Desktop: Central workspace with customizable backgrounds and icons.

Task Bar

Includes Start menu, quick launch icons, and notification area.

Context Menus

Access additional features via right-click.

Vulnerabilities

Flaws in millions of lines of code can be exploited by attackers.

Common recommendations for security

Use antivirus software, limit access to services, enforce encryption, implement strong passwords and controlled permissions.

Hardware Abstraction Layer (HAL)

Bridges hardware and kernel interactions.

Kernel

Core OS component managing memory, I/O, and processes.

User Mode

Restricted environment for applications.

Kernel Mode

Full access for core OS operations.

NTFS

Standard for Windows; supports large files, security, and reliability.

Master File Table (MFT)

Tracks file locations.

Boot Process

Firmware: BIOS or UEFI initializes hardware.

Bootmgr.exe

Loads system configuration (BCD).

Winload.exe

Prepares kernel and drivers.

Ntoskrnl.exe

Starts the Windows kernel.

Memory Management

Processes are isolated in virtual address spaces: 32-bit systems (Up to 4GB), 64-bit systems (Up to 8TB).

Registry

Hierarchical database storing system and user configurations.

HKEY_LOCAL_MACHINE

System info.

HKEY_CURRENT_USER

User-specific settings.

Administrative Best Practices

Avoid using admin accounts for daily operations.

CLI and PowerShell

CLI: Basic file and system navigation; PowerShell: Advanced automation via cmdlets and scripts.

Task Manager

Tabs include Processes, Performance, App History, Startup, Users, Details, Services.

Resource Monitor

Tracks CPU, memory, disk, and network usage.

Event Viewer

Logs application, system, and security events.

Security Policies

Includes password policies (e.g., lockout rules) and regular updates to patch vulnerabilities.