Windows 10 and Windows Server Architecture

Introduction

Did you know that Windows 10 can execute unmodified Linux binaries natively at near-bare-metal speed, completely bypassing traditional virtualization? This capability is not a trick of emulation, but a masterclass in modern, layered operating system design. This lesson covers the architectural evolution, core design principles, and intricate internal subsystems of Windows 10 and Windows Server 2016.

Learning Objectives

• Trace the evolutionary path of Windows from OS/2 and Windows NT to the modern "Windows-as-a-Service" model.
• Analyze core design principles including hardware-isolated security, hybrid performance optimizations, and backward compatibility layers.
• Deconstruct the system components, comparing the Normal World (VTL 0) with the Hyper-V-isolated Secure World (VTL 1).
• Examine the mechanics of the kernel dispatcher, the Executive subsystems, NTFS, and the Win32 programmer interface.

History and Evolution of Windows NT to 10

Windows 10 is the latest successor in a family of operating systems based on the portable New Technology (NT) codebase, which originally replaced consumer systems built on the Windows 95/98 architectures.

• The OS/2 and NT Roots: In the mid-1980s, Microsoft and IBM collaborated on OS/2 for single-processor Intel 80286 systems. In 1988, Microsoft exited the joint effort to design a portable, multi-processor, multi-environment operating system (NT) under VAX/VMS architect Dave Cutler. Initially targeted to run the OS/2 API natively, NT was shifted during development to use a new 32-bit Windows API (Win32).
• Early Milestones: Windows NT 3.1 and NT 4.0 adopted the Windows user interface and progressively moved graphic device routines into kernel space to improve execution speed. Windows 2000 stabilized the architecture, supporting IA-32 systems, plug-and-play, distributed file systems, and introducing Active Directory.
• XP, Vista, and 7: Released in 2001, Windows XP brought a modern GUI to consumers and launched 64-bit editions (for IA-64 and AMD64). Windows Vista introduced major architectural security upgrades but suffered from compatibility and sluggishness issues. Windows 7 resolved these defects, using system-wide constant event tracing instead of passive counters to pinpoint performance bottlenecks.
• The Windows 8 Shift: Driven by mobile computing, Windows 8 introduced the Metro touch-centric UI, the WinRT programming model, and sandboxed AppX package management via the Windows Store. It supported ARM architectures natively (Windows RT/Phone) but struggled due to UI friction and app scarcity. Windows 8.1 restored standard keyboard/mouse usability features and mitigated Metro-based constraints.
• Windows 10 and Windows-as-a-Service (WaaS): Windows 10 introduced a rolling update cycle of monthly rollups and biannual feature updates, using telemetry to perform A/B quality testing. It unified development under the Unified Windows Platform (UWP) and introduced the Windows Desktop Bridge to package legacy Win32 apps. To bridge platforms, Windows 10 replaced multi-subsystem architectures with Pico Providers, implementing the Windows Subsystem for Linux (WSL) to run unmodified ELF binaries through a proxy driver called LxCore.
• Platform & Hardware Execution: Today, client editions of Windows 10 share their binary kernel and driver codebase with Windows Server 2016. High-fidelity 64-bit AMD64 environments run 32-bit IA-32 code seamlessly, while modern ARM64 devices utilize dynamic JIT recompilation (WoWA64) to run legacy 32-bit applications.

Windows Design Principles

To meet the demands of enterprise and consumer markets, Windows 10 balances security, reliability, compatibility, high performance, extensibility, portability, internationalization, and energy efficiency.

• Security Mitigations: Beyond discretionary access control lists (ACLs), Windows Vista introduced Integrity Levels (No, Low, Medium, High) to limit process capabilities. Windows 10 introduced Attribute-Based and Claim-Based Access Control (ABAC/CABC) for dynamic policy evaluation. It implements rigorous exploit mitigations: Data Execution Prevention (DEP) prevents stack/heap execution; Address Space Layout Randomization (ASLR) randomizes memory regions; Control-Flow Guard (CFG) validates indirect branches; and Arbitrary Code Guard (ACG) stops runtime generation or modification of executable code. Hardware-enforced mitigations like Control-flow Enforcement Technology (CET) block return-oriented programming (ROP) using shadow stacks.
• Reliability Architecture: Windows moves complex, failure-prone logic out of the kernel into user-space services (e.g., third-party font rendering, audio stacks). It utilizes boot-time and runtime memory diagnostics to proactively test for failing RAM. A fault-tolerant memory heap intercepts and repairs minor corruption bugs (like use-after-free) on the fly, unless explicitly disabled by developer policies to maintain strict security.
• Compatibility Strategies: Compatibility is maintained via the Shim Engine, utilizing a database of over 6,500 application-specific workarounds. The SwitchBranch mechanism allows Win32 APIs to emulate old OS behaviors, visible in Task Manager. Multi-architecture translation layers exist for running 16-bit code (WoW32), 32-bit code on 64-bit systems (WoW64), and IA-32 code on ARM64 (WoWA64).
• Performance a nd Scalability: Windows supports symmetrical multiprocessing (SMP) with priority-based preemptive scheduling. High-efficiency queued spinlocks and pushlocks reduce bus-cycle lock contention. For massive server platforms, Windows handles up to 20 processor groups, scaling up to 640 logical processors. Locking mechanisms are highly decomposed and often lock-free. Graphics performance is offloaded via DirectX DirectCompute, using general-purpose GPU (GPGPU) scheduling natively in the kernel.
• Extensibility and Portability: Extensibility is achieved through a strictly layered architecture. The executive kernel uses loadable drivers for filesystems, networks, and Pico Providers. Local interprocess communications utilize high-speed Advanced Local Procedure Calls (ALPC) alongside MS-RPC. To maintain portability, the OS is written almost entirely in C/C++, isolating architecture-specific chipsets within the Hardware Abstraction Layer (HAL) DLL. On ARM platforms, HAL Extensions dynamically load SOC-specific drivers.
• Internationalization (NLS): The National Language Support (NLS) API manages regional configurations. Windows uses UTF-16LE as its native Unicode encoding, converting legacy ANSI text at runtime. Multiple User Interface (MUI) support decouples core binaries from language-specific resources by moving translation tables into isolated .mui files.
• Energy Efficiency & Dynamic Devices: Windows increases idle states by routing clock ticks dynamically (Dynamic Tick) and coalescing timers. The Process Lifetime Manager (PLM) automatically suspends idle UWP apps. Connected Standby (via the Desktop Activity Moderator, or DAM) freezes system execution immediately upon screen-off, simulating a mobile device sleep state while preserving system state. For hardware, the Plug-and-Play (PnP) manager dynamically allocates IRQs, DMA channels, and IO memory, while Windows Server supports hot-adding and hot-replacing CPUs and RAM.

Architectural Layers: Hypervisor, Secure Kernel, and HAL

Windows 10 implements privilege isolation both vertically (via processor execution modes) and horizontally (using hardware virtualization).

• Virtual Secure Mode (VSM): By leveraging the Hyper-V hypervisor, Windows 10 partitions execution into two Virtual Trust Levels (VTLs). VTL 0, or the Normal World, runs the standard Windows client user-mode, system processes, and the standard kernel/HAL. VTL 1, or the Secure World, runs a secure kernel and isolated, highly secure micro-applications called Trustlets.
• Hyper-V Hypervisor: Running in VMX Root Mode, the hypervisor intercepts interrupts, memory access, and CPU instructions using hardware-assisted virtualization (Intel VT-x or AMD SVMX). It exposes a hypercall interface to allow communications across VTL boundaries.
• Secure Kernel (VTL 1): The secure kernel acts as the execution environment for Trustlets (such as the LSA Isolation process, lsaiso.exe). It does not schedule threads, manage standard I/O, or load third-party drivers. Instead, it proxies resource scheduling back to VTL 0. It controls access to TPM hardware secrets, processes code-integrity signature policies, and uses Second Level Address Translation (SLAT) to completely hide physical pages from VTL 0, powering protections like Credential Guard and Device Guard.
• Hardware Abstraction Layer (HAL): The HAL exports a virtualized hardware interface, allowing the executive kernel and device drivers to remain chipset-independent. Motherboard mapping details (such as DMA and interrupt configurations) are abstracted, meaning a single compiled kernel binary can run across vastly different hardware designs.
• The Executive Kernel Core: Operating in Ring 0, the kernel is responsible for thread scheduling, low-level CPU synchronization, exception/trap dispatching, and kernel-to-user context switching. The majority of the core kernel is written in C, relying on assembly language only for direct processor register access and low-level trap handlers.

Kernel Core: Threads, Dispatching, and Interrupts

Windows is a thread-scheduled operating system where processes act solely as containers for resource management and address spaces.

• Dual-Stack Thread Execution: Every Windows thread has two modes of execution: a User Thread (UT) and a Kernel Thread (KT). The thread maintains two isolated stacks—one for UT execution and one for KT execution. System calls or interrupts trap the CPU, switching execution context to the KT stack and placing the CPU in Ring 0.
• Thread States: Schedulable threads transit through eight distinct states: Initializing, Ready, Deferred-Ready (selected for a specific processor but not yet scheduled), Standby (the next thread to run on a core), Running, Waiting (blocked on a dispatcher object), Transition (waiting for resources, like paging in a stack), and Terminated.
• Scheduling Priorities: The dispatcher utilizes a 32-level scheduling priority database. Variable priorities span levels 1 to 15, while Real-time (static) priorities span levels 16 to 31. Level 0 is reserved for the per-processor Idle Thread. Ready threads are tracked via a linked list bitmap. To eliminate global database lock contention on multi-core systems, Windows uses per-processor databases, with cores grouping into local shared ready queues to share load without high latency.
• Dynamic Priority Boosts and Decay: Priority boosts are applied to variable-priority threads waking up from waits. Audio and sound I/O yield major boosts; disk I/O yields moderate boosts. GUI threads receive a foreground priority separation boost of +2 to ensure UI responsiveness. Lock-handoff boosts raise a waiting thread to one level above the lock owner to prevent priority inversion. At the end of each execution quantum, these boosts decay by one level (or are removed entirely for GUI/lock boosts) to prevent compute-bound threads from monopolizing resources.
• Interrupt Request Levels (IRQLs): Windows prioritizes software and hardware interrupts via a 16-level hierarchy (32 on legacy x86). Thread execution runs at PASSIVE_LEVEL (IRQL 0). Asynchronous Procedure Calls run at APC_LEVEL (IRQL 1). Deferred Procedure Calls and the scheduler run at DPC_LEVEL (IRQL 2). Device interrupts map to IRQLs 3 to 26, while the system clock and Interprocessor Interrupts (IPIs) occupy the top levels, capped by HIGH_LEVEL (IRQL 31).
• Software Interrupts (APCs vs. DPCs): Asynchronous Procedure Calls (APCs) execute code within a specific thread's context. Kernel-mode APCs execute at IRQL 1, whereas user-mode APCs run only when the thread is in an alertable wait state. Deferred Procedure Calls (DPCs) postpone non-critical interrupt processing. An Interrupt Service Routine (ISR) handles urgent hardware needs and queues a DPC to run at IRQL 2. DPCs cannot invoke page faults, call pageable system code, or wait on dispatcher objects, because doing so would halt the scheduler.
• Exceptions and Trap Handling: Hardware-level traps are converted by kernel handlers into architecture-independent exceptions. If a kernel exception is unhandled, the system halts via a bugcheck ("blue screen"). For user processes, exceptions are routed sequentially: to a debugger port, to an frame-registered exception handler, to an ALPC environment exception port (csrss), and finally to the Windows Error Reporting (WER) service.

Executive Services: Object, Virtual Memory, and Process Management

The Windows Executive encapsulates the core operating system services, operating as an object-oriented system framework.

• Object Manager: The Object Manager unifies kernel resource tracking. Entities (such as files, mutexes, processes, and section objects) are represented as objects. User programs access objects using indirect, process-specific handles. The Object Manager maps handles to system objects via process-level handle tables. It tracks both handle counts and reference counts (which include pointer-based references from kernel drivers), ensuring an object is not freed prematurely. It manages an internal namespace using directory objects and implements the parse() virtual function to delegate path parsing (e.g., mapping C:\foo to specific device objects via file system driver routines).
• Virtual Memory Manager: Windows manages virtual-to-physical address translation via multi-level page tables (using PDEs, PTEs, PML4, and PML5 structures). Physical page allocation states are categorized in the Page Frame Number (PFN) database (Valid, Transition, Standby, Modified, Free, Zeroed, Bad). Features include Guard Pages (no-access pages designed to detect stack/heap overflows), copy-on-write page sharing, and section objects to map files directly into memory views. SuperFetch monitors paging patterns via Markov chains, pre-populating standby lists during idle times. The Memory Compression Process acts as a compressed store, compressing standby and modified pages in RAM to reduce physical page swapping overhead.
• Process Manager: The Process Manager coordinates processes, threads, and job objects. Job objects enforce multi-process resource controls, CPU throttling ratios, and containerization boundaries (referred to as silos). Process creation follows a structured sequence: calling CreateProcess(), converting parameters to NT format, calling NtCreateUserProcess() to initialize the Process Environment Block (PEB) and Thread Environment Block (TEB), setting up the initial thread stack in a suspended state, notifying the Win32 subsystem (csrss), and finally resuming the thread to run the ntdll.dll user-mode link loader.

Executive Services: Communication, I/O, Security, and Booting

Operating alongside the core resource managers, the remaining Executive systems coordinate communication, I/O processing, runtime security, and bootstrap execution.

• ALPC Communication: Local client-server operations utilize Advanced Local Procedure Calls (ALPC). Communication ports are established to pass messages. Small messages (< 64 KB) are copied twice via kernel queues. Large messages utilize shared-memory section objects with a data view attribute, avoiding copy operations.
• I/O Manager: Windows I/O is packet-driven and targeted to file objects. The I/O Manager translates user requests into I/O Request Packets (IRPs) and routes them down a device-stack of device and filter drivers. Filter drivers implement services like BitLocker (disk encryption) and Shadow Copies (snapshots). High-speed driver designs utilize the Kernel-Mode Driver Framework (KMDF) or User-Mode Driver Framework (UMDF).
• Cache Manager: Rather than caching physical disk blocks, the Cache Manager caches virtual file views. It maps files in 256 KB blocks tracked by Virtual Address Control Blocks (VACBs) inside a private working set. It utilizes Fast I/O to bypass standard IRP overhead for cached hits, performs sequential read-ahead prefetching, and executes write-back caching to consolidate disk writes.
• Security Reference Monitor (SRM): The SRM performs runtime access validation. When an object is opened, the SRM compares the caller's Security Token (containing User SID, Group SIDs, Privileges, Integrity Levels, and Claims) against the object's security descriptor (DACL/SACL). If validation succeeds, permissions are cached in the handle table as an access mask, bypassing subsequent security checks. Packaged UWP apps execute inside an AppContainer token, which sets integrity to low, disables standard user SIDs, and restricts capabilities to specific micro-permissions managed via system brokers.
• PnP and Power Managers: The Plug-and-Play manager coordinates resource arbiters, sending add-device, start-device, and query-remove requests. The Power Manager implements energy-saving strategies, handling Sleep (RAM powered, CPU low) and Hibernation (RAM saved to disk, system unpowered). The Power Framework (PoFX) provides fine-grained, component-level power control.
• The Registry: Decoupled into specialized database files called hives, the Registry stores system and application configurations as hierarchical keys. It features application-isolated hives, transactional commits to prevent corruption, and self-healing recovery via System Restore Points.
• Booting Sequence: Upon power-on, UEFI Secure Boot validates digital signatures of boot-time elements. The boot manager (bootmgfw.efi) executes, launching winload.efi (or hvloader.exe to initialize the hypervisor first if VSM is enabled). The kernel (ntoskrnl.exe), HAL, and boot-start drivers are loaded. The kernel starts the Session Manager (SMSS.exe), which initializes user-mode sessions, starting csrss.exe and wininit.exe in Session 0, and winlogon.exe in consumer sessions.

NTFS File System Architecture

NTFS is the native filesystem of Windows, engineered for reliability, large-volume scalability, and granular security.

• Internal Layout: NTFS organizes storage into virtual blocks called clusters (defaulting to 4 KB for volumes > 2 GB) addressed via Logical Cluster Numbers (LCNs). A file is an object comprised of typed attributes (e.g., $FILENAME, $STANDARD_INFORMATION, and $DATA). Standard file content is stored in an unnamed data attribute, but multiple named streams can be attached via a filename:attribute syntax.
• The Master File Table (MFT): Every file or directory is defined by at least one 1 KB to 4 KB record in the MFT. Small attributes are stored directly in the record (resident). Large attributes are stored in external device extents pointed to by MFT descriptors (nonresident). If a file is heavily fragmented or has excessive attributes, a base file record links to overflow MFT records. Files are referenced via a 64-bit file reference containing a 48-bit MFT record index and a 16-bit sequence number (incremented upon record reuse to prevent stale pointers).
• Directory B+ Trees: Directories index file names using a B+ tree structure. The index root contains the top level of the tree. Entries store file names, references, file sizes, and timestamps. This redundant design allows file search queries and directory listings to run without reading the individual MFT records of every file.
• NTFS Metadata Files: System metadata is stored in hidden files within the volume, including the MFT ($Mft), its backup duplicate ($MftMirr), the Log File ($LogFile), the Volume File ($Volume), the Attribute Definition Table ($AttrDef), the Root Directory ($), the Bitmap File ($Bitmap), the Boot File ($Boot), and the Bad Cluster File ($BadClust). These files are cached by the Cache Manager.
• Transaction Recovery: NTFS logs all metadata modifications in transactions. Before altering an internal data structure, change details are written to the circular queue of $LogFile. If a crash occurs, NTFS reads the log, redoes committed transactions, and undoes uncommitted ones. Checkpoints are written every 5 seconds to trim log dependencies. User data payload is not transactionally guaranteed.
• Advanced Features: NTFS supports POSIX traversal check overrides using prefix matching caches. It compresses data in 16-cluster compression units and handles sparse files by leaving physical gaps in MFT allocations for blocks of zeros. Directory-level mount points, absolute/relative symbolic links, and hard links are fully supported. The Change Journal logs all file modifications for indexing engines, while Volume Shadow Copies leverage copy-on-write snapshots to maintain historical file backups.

Networking Architecture and Protocols

The Windows networking stack is structured to decouple network interface hardware, transmission protocols, and user applications.

• Network Interfaces: The Network Device Interface Specification (NDIS) abstracts physical network interface cards (NICs) from protocols, allowing multiple protocols to bind to a single card. The Transport Driver Interface (TDI) abstracts session-layer components from transport-layer mechanisms.
• Core Protocols: Protocols are implemented as dynamic drivers. Core protocols include Server Message Block (SMB/CIFS) for remote file/printer access, a dual IPv4/IPv6 TCP/IP stack with hardware offloading, Point-to-Point Tunneling Protocol (PPTP) for Virtual Private Networks (VPNs), a kernel-mode HTTP driver (http.sys) to minimize web-server routing latency, and WebDAV for HTTP-based file modification.
• Named Pipes and RPC: Named Pipes provide connection-oriented messaging accessed through the filesystem namespace using the Uniform Naming Convention (UNC) (e.g., \\server\share\pipe). Remote Procedure Calls (RPC) compile interfaces using MIDL, marshalling function arguments across networks or local ALPC channels. Component Object Model (COM) and Distributed COM (DCOM) utilize RPC as their foundation.
• Redirectors and MUP: Remote file access uses a client-side Redirector and a remote Server driver running in kernel mode. When a UNC path is requested, the I/O Manager sends an IRP to the Multiple UNC Provider (MUP). The MUP queries registered redirectors and caches the correct driver connection. For Win32 applications, a Multi-Provider Router (MPR) performs a similar resolution.
• DFS, Folders, and Domains: Distributed File System (DFS) aggregates multiple servers into a unified namespace. Folder Redirection relocates user files to servers, utilizing Client-Side Caching (CSC) to cache files offline. Windows networks group into Domains governed by Kerberos trust and Active Directory, which implements LDAP directory services and manages Group Policies.

The Win32 Programmer Interface

The Win32 API is the native interface for managing Windows system resources, processes, threads, and memory allocations.

• Kernel Object Access and Sharing: Kernel objects are instantiated via CreateXXX API functions, which return process-specific handles. Handles are closed using CloseHandle(). Objects can be shared between processes via three techniques: Handle Inheritance (setting bInheritHandle to TRUE during creation and process fork), Named Objects (creating named instances in the global namespace accessed via OpenXXX), and Handle Duplication (using the DuplicateHandle() API to inject handles directly into another process's table).
• Process and Thread Scheduling Rules: Thread priorities are determined by mapping the process's base Priority Class (Idle, Below Normal, Normal, Above Normal, High, Realtime) to thread-specific relative adjustments ranging from THREAD_PRIORITY_LOWEST (base - 2) to THREAD_PRIORITY_HIGHEST (base + 2). Threads can be explicitly frozen and thawed using SuspendThread() and ResumeThread(). Windows implements thread pools to minimize creation overhead, allowing developers to enqueue work using SubmitThreadpoolWork().
• Synchronization Mechanisms: Wait operations are managed via WaitForSingleObject() and WaitForMultipleObjects(). User-mode mutual exclusion within a process is managed via Critical Section objects, which spin to acquire locks before fallback-allocating a kernel-mode mutex to minimize overhead. Slim Reader-Writer (SRW) Locks provide fast, single-writer multi-reader locks alongside Condition Variables.
• Fibers and User-Mode Scheduling (UMS): Fibers are cooperatively scheduled user-mode threads. Because fibers share a single Thread Environment Block (TEB), they are prone to state-corruption when calling Win32 APIs. User-Mode Scheduling (UMS) in Windows 7 separates each thread into a User Thread (UT) and a Kernel Thread (KT). If a UT traps to the kernel and blocks, UMS registers a Primary Thread to immediately resume user-mode execution of a different UT, bypassing kernel context-switch latency.
• Windows Messaging IPC: GUI threads utilize message queues. Messages are passed via asynchronous PostMessage() or synchronous SendMessage() APIs. Memory-range data transfers across process boundaries utilize the WM_COPYDATA message, causing the kernel to duplicate buffer payloads into the receiver's address space.
• Memory Management APIs: Virtual memory is allocated, committed, and released via the VirtualAlloc() and VirtualFree() APIs, operating on page boundaries. Memory-Mapped Files are established by creating a mapping object (CreateFileMapping()) and assigning views (MapViewOfFile()). Private Heaps are allocated via HeapCreate(), utilizing a Low-Fragmentation Heap (LFH) algorithm to reduce memory fragmentation. Thread-Local Storage (TLS) assigns thread-specific global variables dynamically (TlsAlloc()) or statically (__declspec(thread)), tracking data within the TEB. The Address Windowing Extension (AWE) allows 32-bit applications to map raw physical pages directly via AllocateUserPhysicalPages().

Summary

Let's review the key concepts covered in this comprehensive look at Windows 10 architecture:

• Architectural Evolution: Windows 10 is the modern iteration of the NT codebase, shifting to a rolling "Windows-as-a-Service" update model. It supports 32-bit, 64-bit AMD64, and ARM64 processors with backward compatibility translations (WoW64/WoWA64).
• Layered Security & VSM: Virtual Secure Mode (VSM) uses the Hyper-V hypervisor to divide execution into VTL 0 (Normal World) and VTL 1 (Secure World), protecting system credentials (Credential Guard) and signatures (Device Guard) in an isolated, hardware-protected zone.
• Kernel and Thread Scheduling: Windows schedules priority-based, preemptive threads across 32 priority levels. The scheduling logic is distributed throughout kernel functions. Prioritized interrupts are handled via 16 IRQLs, deferring long-running work to DPCs to maintain responsiveness.
• The Executive Services: Subsystems handle Object management, Process/Job orchestration, Advanced Local Procedure Calls (ALPC), packet-driven asynchronous I/O (IRPs), and unified logical file views (Cache Manager).
• Robust File System (NTFS): NTFS features transactional metadata logging for rapid crash recovery, B+ trees for high-speed directory searching, resident/nonresident attributes inside the Master File Table, and copy-on-write Shadow Copies.
• Decoupled Networking: The NDIS and TDI interfaces decouple physical adapters from protocols. MUP and MPR handle UNC network path redirection, while Kerberos and Active Directory coordinate enterprise domains.
• Win32 Developer API: Programmers access system capabilities via handles. Thread synchronization is optimized via Critical Sections and SRW Locks, while memory can be managed at virtual, heap, mapped-file, or physical (AWE) levels.