Windows OS Under the Hood!
- What is the Registry?
- The Registry is the primary database for every Windows system.
- Registry hold settings. Registry is critical, without it, Windows won’t run!!!
- We use the ‘regedit’ (Registry Editor) utility to manually edit the Registry.
- The Registry has five root keys into which all data is organized.
- HKLM (Hkey local machine)–defines all the settings for a particular computer.
- Processes
- Every program currently running on a system is a process.
- Processes all use process IDs (PID)
- We use utilities like Task Manager to kill errant processes. At any moment our computer can be running hundreds of programs. These programs can be broken down into 2 groups:
- Applications & Services = Processes
- Applications–programs running that we can see and deal with.
- Services–programs running in the background.
- A process is a program that is actually running and taking up memory.
- Exe or DLL (Dynamic Link Libraries)
- Services (programs in the background)
- A service is a process that runs without an interface.
- The typical Windows system has many services running.
- We use tools such as “Services” to control our services.
- Your Windows Tool Set
- ‘Right-clicking’ in Windows gets you to the properties for almost anything.
- ‘Control Panel’ is the older collection of tools in Windows.
- ‘Administrative Tools’ stores ‘System Configuration’
- Settings is the newer collection of tools in Windows.
- Windows 7 Task Manager
- ‘Ctrl+Alt+Del’ and ‘Ctrl+Shift+Esc’ will both get you to the Windows 7 task manager.
- Windows 7 ‘Task Manager’ is split out into ‘Applications’, ‘Processes’, ‘Services’, ‘Performance’, ‘Networking’ and ‘Users’.
- ‘Resource Monitor’ was added to ‘Task Manager’ in Windows 7 and includes ‘CPU’, ‘Disk’, ‘Network’, and ‘Memory Data’.
- Windows 10 Task Manager
- ‘Ctrl+Alt+Del’, ‘Ctrl+Shift+Esc’, and ‘right-click’ on the Windows icon will all get you to the ‘Task Manager’ in Windows 10.
- Background processes are services.
- Windows 10 ‘Task Manager’ is split out into ‘Processes’, ‘Performance’, ‘App History’, ‘Startup’, ‘Users’, ‘Details’, and ‘Services’.
- Information & Configuration Tools
- ‘System Information’ (msinfo32) is an older tool that gives a comprehensive snapshot of your system.
- ‘System Configuration’ (msconfig) lists startup, boot, and services options.
- ‘System lists’ the Windows edition, System properties, computer name and domain settings, and Windows activation status.
- You can create your own utilities with the Microsoft Management Console (MMC).
- DEP (Data Execution Prevention)
- Performance Monitor
- ‘Performance Baseline’ gives your an idea as to how your system runs
- ‘Performance Monitor’ uses counters to monitor your system.
- Data Collector sets for extended time period logs.
- Event Viewer
- Event Viewer logs thousands of activities that take place on a Windows system.
- There are four different types of logs: Application, Security, Set-up, & System.
- You can add events to log using “Local Security Policy”
- Local Security Policy–sets up the policy for your system; Audit policy.
- Tools for Programmers
- Windows has two tools to support applications.
- The Open Database Connectivity tools lets a Windows system locate shared databases.
- ODBC–Open Database Connectivity
- based on SQL (Structured Query Language)
- allows any application to talk to any database
- ODBC is used to link the application to the database.
- The Component Services utility enables uses to edit Component Object Model features.
- COM+ (Component Object Model)
Users, Groups, & Permissions
- Introduction to Users & Groups
- Windows combined with NTFS gives tremendous control over resources
- NTFS Permissions are assigned to user accounts
- A group is a container for user accounts
- Permissions are assigned to groups for easy administration.
- Allow vs Deny
- Users & Groups
- Managing Users & Groups
- ‘Settings –> Accounts’ enables basic account creation
- ‘User Accounts’ in Control Panel provides more account control
- ‘Local Users & Groups’ provides the most control over users and groups
- NTFS Permissions
- All files & folders on an NTFS formatted drive have NTFS permissions.
- ‘Full Control permission’ gives the user complete control over the resource.
- ‘Inheritance’ is when a new folder or file gets the permissions of the folder in which it was created.
- ‘Inheritance’ is stopped with a deny.
- Linux & macOS Permissions
- Linux & macOS permissions use the ‘owner‘, ‘group‘, and ‘everyone‘ permission groupings.
- Each of these three can have read, write, or execute permissions.
- These are assigned by changing the file or folder properties.
- File Explorer
- File Explorer is the primary tool for folder and file manipulation in Windows.
- File Explorer is highly customizable.
- There’s usually multiple ways to do the same job in File Explorer.
- Sharing Resources
- Windows networking has both NTFS and Share permissions.
- Shared resources have a UNC name.
- UNC (Universal Naming Convention)
- Resources are first offered for sharing, then others access the shared resource.
- Shared resources can be mapped to a drive letter.
- Security Policies
- Security policies define a broad spectrum of security features.
- We use the Local Security Policy application to manage policies.
- Account policies enable login & password rules.
