Skip to content
Windows

Windows Internals: From Boot to Enterprise Management

Process internals, the registry, and the service model first, then the security model and the tools (Group Policy, PowerShell Remoting) that manage Windows at scale.

9 posts, in order

  1. 1HistoryThe History of Windows: From a BASIC Interpreter to Windows NTHow Microsoft's 1975 founding led, eighteen years later, to hiring a DEC operating-system veteran to build Windows NT from scratch.
  2. 2Deep DiveUnderstanding the Windows Boot Process: UEFI, Boot Manager, and WinloadHow a modern Windows machine goes from firmware to a running kernel, and where each stage's configuration actually lives.
  3. 3Deep DiveWindows Process and Thread Internals: Handles, Tokens, and ObjectsHow the Windows kernel represents processes as containers of handles and a security token, and the tools to inspect both live.
  4. 4Deep DiveWindows Registry Internals: Hives, Keys, and How Settings Actually PersistHow the registry's hive files, keys, and value types work under the hood, and the tools to inspect and edit them safely.
  5. 5Deep DiveWindows Services and the Service Control ManagerHow the Service Control Manager starts, stops, and supervises background processes, and how to configure and debug a service directly.
  6. 6Deep DiveThe Windows Security Model: ACLs, Integrity Levels, and UACHow discretionary ACLs, mandatory integrity levels, and UAC's token-splitting combine to form Windows' layered access control model.
  7. 7Deep DiveGroup Policy Explained: How Enterprise Windows Configuration Actually WorksHow Group Policy Objects, ADMX templates, and the client-side refresh cycle turn Active Directory structure into enforced machine configuration.
  8. 8Deep DivePowerShell Remoting and WinRM: Managing Windows at ScaleHow WinRM and PowerShell Remoting turn scattered single-machine administration into fleet-wide scripted management across hundreds of servers.
  9. 9FixReading a Windows BSOD Minidump to Find the Actual CauseA blue screen flashes by too fast to read. Here's how to pull the crash dump it left behind and find out which driver actually caused it.