Windows Architecture

Introduction

Microsoft Windows is the dominant desktop operating system, running on over 1.4 billion PCs worldwide. Whether you are gaming, developing software, or working in an office, chances are you interact with Windows daily. But beneath the familiar Start menu and taskbar lies a sophisticated operating system architecture that has evolved over three decades.

Modern Windows (Windows 10 and 11) is built on the Windows NT architecture, first designed by Dave Cutler and his team at Microsoft in the late 1980s. Cutler previously designed VMS at Digital Equipment Corporation, and many NT design decisions reflect lessons learned from that minicomputer operating system. Understanding Windows architecture helps you appreciate how a commercial OS balances backward compatibility, security, performance, and hardware diversity.

Architecture Overview

Windows uses a hybrid kernel architecture — it is not purely monolithic like Linux nor purely microkernel like Mach. It combines elements of both to achieve a balance between performance and modularity.

Key Components Explained

Hardware Abstraction Layer (HAL)

The HAL is a thin layer that hides hardware differences from the rest of the kernel. Different motherboards use different interrupt controllers, timers, and bus architectures. The HAL presents a uniform interface so the kernel does not need to know whether it is running on an Intel or AMD processor, or whether interrupts are managed by a legacy PIC or modern APIC.

Think of the HAL as a universal power adapter. Just as you use one adapter when traveling internationally (regardless of the outlet shape), the kernel uses the HAL regardless of the specific hardware underneath.

The Windows Kernel (ntoskrnl.exe)

The kernel proper handles the lowest-level OS functions: thread scheduling and dispatching, interrupt and exception handling, multiprocessor synchronization, and trap handling. It provides the foundation that the executive services build upon.

Windows uses a preemptive, priority-based scheduler with 32 priority levels (0-31). Levels 1-15 are for normal "variable priority" threads, while 16-31 are "real-time" priorities used by critical system tasks. The scheduler uses a multi-level feedback queue with round-robin within each priority level.

The Executive

The executive contains the high-level kernel services that user-mode programs rely on through system calls:

Object Manager — Everything in Windows is an object (files, processes, threads, registry keys, mutexes). The object manager provides a unified namespace and handles creation, deletion, and access control for all objects.

Process Manager — Creates and manages processes and threads. Each process has a private virtual address space, a handle table (references to kernel objects), and one or more threads.

Memory Manager — Implements virtual memory with demand paging. Windows uses a modified page replacement algorithm called the working set model, which tracks each process's active pages.

I/O Manager — Manages all input/output using an asynchronous, packet-driven model. I/O requests are packaged into I/O Request Packets (IRPs) that flow through a stack of device drivers.

Security Reference Monitor — Enforces access control by comparing a thread's security token (who you are) against an object's security descriptor (who is allowed).

Cache Manager — Provides a unified system cache for all file systems, caching frequently accessed file data in memory.

The Registry

Unlike Unix/Linux which uses text configuration files, Windows centralizes configuration in a hierarchical database called the Registry. It stores hardware settings, user preferences, installed software information, and system configuration. The registry is organized into hives (HKLM, HKCU, etc.) stored as binary files on disk.

Process and Thread Model

Windows has a rich process model. Each process contains one or more threads that share the process's address space. Windows also supports fibers (user-mode scheduled threads) and thread pools (system-managed worker threads).

A distinctive feature is that Windows processes are relatively heavyweight to create (compared to Linux's fork()). Windows does not have a fork equivalent — new processes are always created with CreateProcess(), which is more similar to the combined fork+exec in Unix. This design choice means Windows relies more heavily on threads for concurrency within applications.

The Windows Driver Model

Device drivers in Windows follow a layered model. Each I/O request travels through a stack of drivers:

NTFS File System

Windows's primary file system, NTFS, is a journaling file system that provides reliability, security, and advanced features. Everything in NTFS is stored as a file attribute in the Master File Table (MFT). NTFS supports file-level encryption (EFS), compression, hard links, symbolic links, and access control lists (ACLs) on every file and folder.

Real-World Analogy

Windows architecture is like a large corporation. The HAL is the mailroom — it handles all the different formats of incoming mail (hardware differences) and converts them into standard internal memos. The kernel is the operations team that keeps the building running (scheduling, synchronization). The executive is upper management (process manager, memory manager, I/O manager) — each department handles specialized tasks. User-mode programs are the clients who interact only through the front desk (system call interface) and never enter the back offices directly.

Key Takeaways

• Windows NT uses a hybrid kernel architecture balancing microkernel modularity with monolithic performance
• The HAL isolates the kernel from hardware specifics, enabling Windows to run on diverse hardware
• The executive provides high-level services through a consistent object-based model
• Security is enforced at every object access through the Security Reference Monitor
• Windows favors threads over processes for concurrency due to heavyweight process creation
• The layered driver model enables modular and extensible hardware support
• The Registry centralizes all system configuration in a hierarchical database
• NTFS provides enterprise features including journaling, encryption, and fine-grained permissions