Windows Operating System Comprehensive Study Notes

Windows Accounts and Security Identity

• Definition of a Windows Account:

  • On Windows systems, an account exists to provide credentials required for authentication.

  • Once a user is authenticated, resource access is authorized based on the specific permissions and privileges granted to that account.

• User Account vs. Service Account:

  • User Account: A collection of information used by the system to determine a user's access and privileges. This includes data such as usernames, passwords, and group memberships.

  • Service Account: A special type of account used by Windows services for system management and configuration. It provides an account identifier for services to execute and often possesses more privileges than a regular user account.

• Access Tokens:

  • Creation: An access token is created by the Local Security Authority (LSA) after a user's credentials have been successfully authenticated.

  • Creator Process: The Local Security Authority (LSA) process, known as lsass.exe, is responsible for generating the access token.

  • Purpose: It identifies a user, their group memberships, and their privileges. It serves as the user's ID for verification against access control mechanisms when a process attempts to access a securable object or perform a privileged task.

  • Composition: An access token is comprised of the user's Security Identifier (SID), the SIDs of any groups the user belongs to, and a comprehensive list of the user's privileges.

  • Primary Security Context: This is the combination of a user's access token and an object's permissions, which together define what actions a user can take on a specific object.

• Security Identifiers (SIDs):

  • Assignment: A SID is assigned at the moment of account creation.

  • Persistence: A SID remains unchanged for as long as the account exists. Renaming an account does not change its SID.

  • Reuse: Deleting an account does not cause the SID to be reissued or reused; every SID is unique to that specific instance of an account.

  • SID Structure Components:

    • Revision Level: Indicates the version of the SID structure.

    • Authority Value: Identifies the authority that issued the SID.

    • Sub-Authority Value: Contains a domain or local computer identifier and a Relative Identifier (RID).

    • Relative Identifier (RID): A unique number assigned to an object within a domain.

  • Significant RID and SID Values:

    • Administrator: $500$

    • Guest: $501$

    • [Local] System: $S-1-5-18$

    • Local Service: $S-1-5-19$

    • Network Service: $S-1-5-20$

Network Environments and Operating System Types

• Workgroup vs. Domain:

  • Workgroup: A decentralized environment where each computer is a standalone system. Each machine is responsible for its own authentication and security, and accounts are managed locally.

  • Domain: A centralized environment where multiple systems share common configurations, resources, and security principles. These are managed via a central database called Active Directory (AD). Authentication is handled by a domain controller.

• Authentication Locations:

  • Local Accounts: Authenticated by the local Security Account Manager (SAM) database on the specific computer.

  • Domain Accounts: Authenticated by a domain controller within the AD environment.

• Workstation vs. Server Operating Systems:

  • Core Architecture: Both share core files and architectures.

  • Server OS: Optimized to provide application services and shared resources. It supports more robust hardware, including more CPUs and memory, and allows for unlimited concurrent connections.

  • Workstation OS: Optimized specifically for interactive desktop response time for the user.

Windows PowerShell Internals and Syntax

• Core Definitions:

  • CMDLET: A lightweight command used in the Windows PowerShell environment. It is not a standalone executable but a command interpreted by PowerShell.

  • Alias: An alternate, often abbreviated name for a PowerShell cmdlet, used as a shortcut for ease of typing.

  • Module: A package of PowerShell commands that can include cmdlets, functions, variables, and aliases.

• Parameters and Arguments:

  • Parameter: Used with a cmdlet to specify additional object attributes.

  • Parameter Categories (Capabilities):

    • Required: Must be provided for the command to execute.

    • Optional: The user can choose whether or not to provide them.

  • Parameter Techniques:

    • Named Notation: The parameter name is explicitly included before the argument.

    • Positional Notation: The parameter name is omitted, and PowerShell infers the parameter based on the argument's position in the command.

  • Argument: This defines the additional information associated with a parameter name.

• Data Handling and Redirection:

  • Pipe (|): Passes the output of one cmdlet as the input to the next.

  • Out-File: Redirects command output to a specified file.

  • Tee-Object (tee): Splits the output, sending it to a file and the display pipeline (the screen) simultaneously.

• Remote Enumeration:

  • A cmdlet is targeting a remote system if the -computername parameter is present.

System Identification and Logging

• Identifying Virtual vs. Physical Systems:

  • MAC Address OUI: Found via ipconfig /all.

  • System Manufacturer/Model: Found via systeminfo.

  • Running Processes: Found via tasklist (e.g., looking for vmtoolsd.exe).

  • PowerShell: Using the get-wmiobject win32_computersystem cmdlet.

• Windows Event Logs:

  • Three Logs on EVERY System: Application, System, and Security.

  • Three Logs Exclusive to Domain Controllers: Directory Service, DFS Replication, and DNS Server.

• Logging vs. Auditing:

  • Logging: The process by which the OS, services, and applications record actions, status messages, and security events.

  • Auditing: The tracking of changes or events, which are then recorded in the logs. Auditing must often be manually enabled to capture security-related events.

• Auditing and Filtering Mnemonics:

  • POPPSALAD (Security Events to Audit):

    1. Policy Change

    2. Object Access

    3. Privilege Use

    4. Process Tracking (Detailed Tracking)

    5. System

    6. Account Management

    7. Logon

    8. Account Logon

    9. Directory Service Access

  • DUCKLIST (Filtering Criteria for Logs):

    • Date and Time

    • User

    • Computer

    • Keywords

    • Level

    • ID (Event ID)

    • Source

    • Task Category

• Log Logics (Keywords/Levels):

  • Security Log: Keywords include "Success Audit" and "Failure Audit." The level is most often "Information."

  • Application/System Logs: Keywords are usually "Classic." Levels include "Error," "Warning," "Information," and "Critical."

The Windows Registry Architecture

• Root Hives:

  1. HKEY_CLASSES_ROOT (HKCR)

  2. HKEY_CURRENT_USER (HKCU)

  3. HKEY_LOCAL_MACHINE (HKLM)

  4. HKEY_USERS (HKU)

  5. HKEY_CURRENT_CONFIG (HKCC)

• Hive Relationships:

  • Master Hives: HKU and HKLM.

  • Derived Hives:

    • HKCR: Derived from HKLM\Software\Classes and HKU\<userSID>\Software\Classes.

    • HKCU: Derived from HKU\<userSID>.

    • HKCC: Derived from a link to HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current.

• Registry Access and Lifecycle:

  • Read Times: During the boot process, application startup, and user login.

  • User Settings (ntuser.dat): This file contains user settings. It is loaded into HKEY_USERS at logon and unloaded at logoff.

  • HKLM Sub-Keys: Includes BCD00000000, HARDWARE, SAM, SECURITY, SOFTWARE, and SYSTEM.

  • Run and RunOnce Keys:

    • HKLM: Programs here run at system startup for all users.

    • HKCU: Programs here run only when the specific user logs in.

    • RunOnce: These items delete their registry entry automatically after a single execution.

• Registry Data Types:

  1. REG_BINARY

  2. REG_DWORD (The most common type; 32-bit integer)

  3. REG_SZ (String)

  4. REG_EXPAND_SZ (String supporting variables)

  5. REG_MULTI_SZ (Multiple strings)

Processes and System Startup Sequence

• User Mode Initialization:

  • First User Mode Process: Session Manager Process (smss.exe), which is started by the kernel.

  • Session 0 Children of smss.exe: csrss.exe (Client/Server Runtime Subsystem) and wininit.exe (Windows Initialization Process).

• Authentication Sequence:

  1. LogonUI.exe: Collects user credentials and sends them to the authentication process, then exits.

  2. lsass.exe: Local Security Authority Subsystem Service verifies credentials and produces the access token.

  3. winlogon.exe: Receives the newly created access token to manage the session.

  4. userinit.exe: Launches the user shell and then terminates.

  5. explorer.exe: The Windows shell that indicates an interactive logged-on user.

• Session-Specific Processes:

  • Session 0 (System Services): smss.exe, csrss.exe, wininit.exe, lsass.exe, services.exe.

  • Session 1+ (User Sessions): Copies of smss.exe and csrss.exe, plus winlogon.exe and explorer.exe.

• Termination Logic:

  • Never Terminate: Core Session 0 processes like smss.exe, csrss.exe, wininit.exe, services.exe, and lsass.exe.

  • Logoff Termination: Processes in the user's session such as explorer.exe, applications, and the session-specific csrss.exe and winlogon.exe.

Windows Internals and Kernel Geometry

• Directory Redirection (64-bit Systems):

  • C:\Windows\System32: Holds 64-bit executables and DLLs.

  • C:\Windows\SysWOW64: Holds 32-bit executables and DLLs (Windows-on-Windows 64-bit).

  • C:\Program Files: Holds 64-bit application files.

  • C:\Program Files (x86): Holds 32-bit application files.

• System DLLs and Call Logic:

  • System Call Dispatcher: ntdll.dll.

  • Windows Sub-System DLLs: kernel32.dll, user32.dll, gdi32.dll, advapi32.dll, KERNELBASE.dll.

  • WOW64 Emulation DLLs: wow64.dll, wow64cpu.dll, wow64win.dll.

• Kernel Mode Components:

  • Core Components: Windows Executive, Kernel, HAL (Hardware Abstraction Layer), and Hyper-V Hypervisor.

  • The Windows Sub-System Kernel Component: win32k.sys.

  • The Windows Executive Managers:

    1. Object Manager: Manages system resources as objects.

    2. Security Reference Monitor (SRM): Performs object access protection and generates audit records (written to the Security event log).

    3. Process Manager: Creates and terminates processes/threads.

    4. Virtual Memory Manager (VMM): Manages virtual-to-physical address mapping.

    5. I/O Manager: Handles input/output requests.

    6. Configuration Manager: Manages the registry.

  • Kernel Responsibilities: Thread scheduling, interrupt/exception handling, low-level processor synchronization, and power failure recovery.

• Object Architecture:

  • Criteria: Statically defined class, shared kernel services, pointer-based references, hierarchical naming, and object-based security hooks.

  • Structure:

    • Header: Contains data used by the Object Manager.

    • Body: Controlled by the specific executive manager that created the object.

  • Deletion: A kernel object can be deleted only when its open handle count AND reference count reach zero. The two phases are "Name Retention" and "Object Deletion."

  • Security Descriptor: Contains the DACL (Discretionary Access Control List) and SACL (System Access Control List). Permissions come from default info, inheritance from a parent, or explicit assignment.

  • Special DACLs: An Empty DACL denies all access, while a Null DACL grants unconditional access.

Virtual Memory Management (VMM)

• Memory Allocation:

  • On a 64-bit system, a single process is given a $256\,TB$ virtual address space.

  • This is divided into $128\,TB$ for user space and $128\,TB$ for kernel space.

• Mechanisms:

  • Paging: Mapping the virtual address space to physical memory frames.

  • Swapping: Moving physical memory contents to the swap file on disk.

  • Page Tables: Managed by the VMM. They contain Page Table Entries (PTEs) holding physical page frame addresses.

  • Page Table Entry States: Valid/Committed, Invalid/Not Committed, Read-only, or No-execute.

• Page Faults: Occur when accessing a swapped-out page, an uncommitted page, or committing a read-only or no-execute violation.

• Shared Memory: Memory visible in the virtual address space of multiple processes. Protections involve Private Virtual Address Space, PTE control bits, Section Object ACLs, and DEP/NX (Data Execution Prevention/No eXecute).

Boot and Service Management

• Boot Process Stages:

  1. Bootmgr: The second-stage boot loader. It switches the processor to protected mode, reads the BCD (Boot Configuration Data), presents the boot menu, and starts winload.exe.

  2. Winload.exe: Queries firmware, loads Ntoskrnl.exe and hal.dll, and loads boot device drivers (Start value $0x0$).

  3. Ntoskrnl.exe: Initializes executive managers, maps Ntdll.dll, creates HKLM\HARDWARE, loads system drivers (Start value $0x1$), and starts smss.exe.

• Service Start Values:

  • $0x0$ (Boot): Loaded by winload.exe during the boot phase.

  • $0x1$ (System): Loaded by ntoskrnl.exe during kernel initialization.

  • $0x2$ (Automatic): Loaded by the Service Control Manager (services.exe) during user mode start-up.

  • $0x3$ (Manual): Started by a user or the SCM as needed.

  • $0x4$ (Disabled): Never loaded.

• Service Control Manager (SCM):

  • Handled by services.exe.

  • Responsible for managing services and launching all services with a start value of $2$.

  • Service Types: Type $0x10$ indicates a Win32 service running in its own process. Type $0x20$ indicates a Win32 service sharing a process (commonly using svchost.exe, which indicates the service is actually a DLL file).

  • Service Control Tools: services.msc (GUI) and net start/stop (CLI, local only).

File Systems and NTFS Internals

• File System Features and Types:

  • NTFS: Features include compression, encryption, quotas, security (permissions), mounted volumes, and high reliability.

  • ReFS: Optimized for very large data repositories and virtual disks.

  • exFAT: Designed for high-storage flash drives and cross-OS sharing.

• The 5 Layers of a File System:

  1. Physical Layer: The storage media itself.

  2. File System Layer: The overall layout and structure.

  3. Data Layer: The actual contents of the files.

  4. Metadata Layer: Contains allocation pointers and file info.

  5. Filename Layer: The mapping used by the user interface to access data.

• Master File Table (MFT):

  • An MFT entry is a record containing metadata about a file/directory on an NTFS volume.

  • Attribute Storage:

    • Resident: Data stored completely inside the 1KB MFT entry.

    • Non-Resident: Data stored in clusters outside the MFT. The MFT entry contains pointers (VCN-to-LCN mappings) to these locations.

  • Standard Information Attribute: Stores accurate timestamps and basic file attributes.

  • Filename Attribute: Stores a reference to the parent directory, the filename, size, and inherited timestamps.

• Operations and Permissions:

  • Copying:

    • Requires: Read access to source, Write access to destination.

    • Timestamps: New file gets a new Creation Time.

    • Permissions: Inherits permissions of the new parent folder.

  • Moving:

    • Requires: Read and Delete access from source, Write access to destination.

    • Same Volume: Timestamps and permissions are retained.

    • Different Volume: Treated as a copy-then-delete operation; file inherits parent permissions and gets a new Creation Time.

• Permission Processing Order:

  1. Explicit Deny

  2. Explicit Allow

  3. Inherited Deny

  4. Inherited Allow

• Access Concepts:

  • Direct Path Access: It is possible to access a file in a folder you cannot "see" if you know the direct path and have explicit file permissions.

  • TakeOwnership: A privilege allowing a user to take control of an object to change its permissions. In newer Windows architectures, Administrators can directly assign a new owner.

• Timestamps:

  • NTFS: Created, Modified, Accessed, MFT Modified.

  • FAT/exFAT: Created, Accessed, Written/Modified.

  • Limitation: The "Access" timestamp is often unreliable as it updates simply by viewing file properties.