The registry, NTFS, the security model, and the enterprise tooling behind Microsoft's OS.
How Windows uses hardware virtualization to carve out a memory region even a compromised kernel can't touch, protecting credentials from pass-the-hash attacks.
The high-performance, always-available kernel tracing infrastructure that nearly every serious Windows diagnostic and monitoring tool is actually built on.
The layered, extensible packet-filtering architecture in Windows that both Windows Firewall and most third-party security software build on.
Working through the DNS client cache, adapter-specific resolver settings, and configured servers systematically, before jumping to a driver reinstall.
Reading gpresult's diagnostic output to distinguish a replication delay, a security filtering mismatch, and a corrupted client-side cache correctly.
Why domain authentication starts failing mysteriously when a machine's clock drifts from the domain controller's, and how to confirm and fix it.
Understanding what the Memory Compression process actually is before assuming it's a problem, versus identifying a genuine memory leak correctly.
Diagnosing whether a repeatedly crashing Print Spooler is a corrupted driver, a stuck job, or a security patch conflict, and clearing each correctly.
The progress bar hasn't moved in hours and Windows Update still says downloading — distinct from stuck installing, reset the download-side components.
Windows won't let you log in and shows this specific error — almost always a corrupted profile registry entry, fixable without deleting your files.