Windows Fundamentals
Windows is a family of operating systems that connects applications and user accounts to a computer's processor, memory, storage, network, and devices. Its desktop tools expose that system while background services, drivers, permissions, updates, and recovery features keep it working.
itWindows and Microsoft infrastructure | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic — Windows Fundamentals
Windows is the operating system that sits between your applications and your hardware, scheduling processor work, assigning memory, storing files, controlling devices through drivers, and deciding whether an account may perform a requested operation. Before this course, most people experience it as the place where the Start menu lives. It is actually a much more interesting system with a clear architecture underneath the desktop.
The load-bearing mental model is seven parts. An account signs in and receives an access token representing its identity and group memberships. Applications run as processes, each with private virtual memory and one or more threads. services handle background work through the Service Control Manager. User mode restricts ordinary applications; kernel mode gives drivers and core components wider access, which is why a faulty driver can take down the whole machine while a broken application stays contained. NTFS stores files and permissions. The Registry stores configuration. Windows Update maintains trusted system components.
The real surprise is what happens before you ever touch the mouse. Firmware initializes the computer. Windows Boot Manager loads the operating system. The kernel and essential drivers start. Services follow. Authentication creates a session. Explorer builds the desktop. This matters because a failure before sign-in points to boot, storage, or driver state, while a failure after sign-in but only for one user points to that profile's settings. Knowing where the break occurs tells you which tool to reach for first.
The most useful first step in any Windows problem is to observe before changing. Record what failed and when. Check whether the effect is limited to one account, one application, one device, or one network path. Identify the most recent change. Apply the smallest reversible correction. Then retest the original symptom. A forced restart or broad permission change may remove evidence without resolving the cause, which is exactly the opposite of what you want from a diagnostic step.
For the map of identity, processes, services, drivers, files, configuration, updates, and recovery, read the Introduction and Slides. Use the Cheatsheet when you need the comparison tables and failure-triage order. The Practice tab turns diagnostic tools such as Task Manager, Event Viewer, and Device Manager into hands-on exercises. Field Notes covers the operational decisions that make a correct diagnostic output useful instead of merely decorative.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://support.microsoft.com/en-us/windows/
Supports
- Windows task areas for installation, updates, devices, files, security, accessibility, and repair
- Scope and progression of the Reference path
- https://learn.microsoft.com/en-us/windows/win32/com/processes--threads--and-apartments
Supports
- Processes as collections of virtual memory, code, data, and resources
- Threads as the execution sequences scheduled within processes
- Every process having at least one primary thread
- https://learn.microsoft.com/en-us/windows/win32/services/about-services
Supports
- Service Control Manager database and control role
- Windows services as managed background mechanisms
- Trigger-start and automatic service lifecycle distinctions
- https://learn.microsoft.com/en-us/windows/win32/system-services
Supports
- Windows APIs for memory, power, libraries, threads, service applications, system information, and component services
- Advanced Reference-path rationale
- https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/what-is-a-driver-
Supports
- Drivers connecting operating-system requests to device operations
- Application, operating system, driver, and hardware request path
- Hardware and software drivers
- https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/types-of-windows-drivers
Supports
- User-mode and kernel-mode driver distinction
- Kernel-mode drivers operating with protected system components
- Layered device-driver request flow
- https://learn.microsoft.com/en-us/windows-server/storage/file-server/ntfs-overview
Supports
- NTFS as the default file system for modern Windows
- Metadata, logging, security descriptors, quotas, and encryption integration
- File and folder access control lists with granular permissions
- https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-functions
Supports
- Registry storage of small configuration values, preferences, and per-user state
- Preference for supported application-data stores for broader app data
- https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
Supports
- Local account scope and Windows internal service accounts
- Account and access-control context used in the course
- https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-components
Supports
- Successful sign-in creating an access token for the user
- Access tokens carrying account, group, and privilege information into processes
- Security descriptors and ACLs protecting securable objects
- https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-lists
Supports
- DACL entries granting or denying requested access to securable objects
- ACL evaluation when a process requests object access
- https://learn.microsoft.com/en-us/windows-hardware/drivers/install/installing-a-boot-start-driver
Supports
- Boot-start drivers required for devices needed to start Windows
- Missing storage drivers causing inaccessible boot-device and disk-discovery failures
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/
Supports
- Standard user tokens for routine application execution
- Consent prompt before administrator-level operations
- UAC reducing standing administrator access for applications
- https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/
Supports
- Full-volume encryption against offline access to lost or removed storage
- Difference between volume encryption and file-system authorization
- Recovery-key dependency and device encryption behavior
- https://learn.microsoft.com/en-us/windows/deployment/update/release-cycle
Supports
- Cumulative monthly security updates
- Optional preview, out-of-band, and annual feature update distinctions
- Annual feature updates establishing support lifecycle
- https://learn.microsoft.com/en-us/windows/deployment/update/servicing-stack-updates
Supports
- Servicing stack and component-based servicing roles
- Cumulative update behavior and combined servicing payloads
- https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-security
Supports
- Windows Update delivery of operating-system updates, drivers, antivirus definitions, Microsoft Store apps, and other content
- Windows Update client and service request path
- https://learn.microsoft.com/en-us/lifecycle/faq/windows
Supports
- Supported Windows versions as a requirement for monthly quality updates
- Quality and feature update distinction
- https://support.microsoft.com/en-us/windows/experience/system-configuration-tools-in-windows
Supports
- Settings as the central supported configuration interface
- Task Manager views of processes, performance, startup applications, and users
- System Configuration and System Information diagnostic roles
- https://support.microsoft.com/en-us/windows/experience/startup-boot/configure-startup-applications-in-windows
Supports
- Per-user and machine startup application locations
- Task Manager startup view and startup-impact information
- https://support.microsoft.com/en-us/windows/experience/backup-recovery/recovery-options-in-windows
Supports
- Recovery choice by symptom
- Startup Repair, System Restore, Reset, and installation-media boundaries
- Need to back up data before recovery
- https://support.microsoft.com/en-us/windows/experience/backup-recovery/backup-restore-and-recovery-in-windows
Supports
- Backup, restore, transfer, and recovery distinctions
- Windows backup and recovery tool roles
- Reset, advanced startup, and Windows Recovery Environment behavior
- https://support.microsoft.com/en-us/windows/experience/backup-recovery/system-restore
Supports
- Restore points reverting system files, Registry settings, and installed programs
- System Restore not affecting personal files as a file backup would
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami
Supports
- whoami reports the user, groups, and privileges held by the current access token
- The /user, /groups, /priv, and /all parameters select which token contents are displayed
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
Supports
- icacls displays the discretionary access control list of a file or directory
- Simple rights are abbreviated F, M, RX, R, W, and D
- Inheritance is marked separately with (I), (OI), (CI), (IO), and (NP)
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works
Supports
- Signing in as an administrator creates a standard user access token and an administrator access token
- The standard user token has the administrative privileges and identifiers removed
- Applications start from the standard user token unless an elevation is approved
- https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service
Supports
- Win32_Service reports Name, DisplayName, State, StartMode, ProcessId, and ServiceType for each service
- StartMode values are Boot, System, Auto, Manual, and Disabled
- ServiceType distinguishes a service in its own process from one sharing a process
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent
Supports
- Get-WinEvent reads events from Windows event logs and event tracing channels
- Events carry a creation time, identifier, level, and provider used for correlation
- https://github.com/sindresorhus/awesome
Supports
- Discovery of the curated Awesome Windows list
- https://github.com/0PandaDEV/awesome-windows
Supports
- Discovery of PowerToys, Everything, Chocolatey, Rufus, and FreeFileSync
- Windows utility categories and learner-relevant project destinations
- https://learn.microsoft.com/en-us/windows/powertoys/
Supports
- PowerToys as free open-source utilities for Windows customization
- Window management, keyboard mapping, launcher, and file utility roles
- https://www.voidtools.com/support/everything/
Supports
- Everything as a Windows filename search engine
- Project documentation as the useful learner destination
- https://docs.chocolatey.org/en-us/getting-started/
Supports
- Chocolatey as a Windows software package manager
- Package installation, upgrade, uninstall, metadata, and dependency concepts
- https://rufus.ie/
Supports
- Rufus creation of bootable USB installation media
- Destructive replacement of target USB contents as an operational caution
- https://freefilesync.org/manual.php
Supports
- File and folder comparison and synchronization
- Synchronization as distinct from an independent backup strategy
- https://news.microsoft.com/de-de/features/windows-geschichte/
Supports
- Windows 1.0 retail release in 1985 as a graphical MS-DOS environment
- Windows 3.0, Windows 95, Windows 2000, Windows XP, Windows Vista, Windows 7, Windows 8, Windows 10, and Windows 11 milestones
- Start menu, taskbar, Plug and Play, NT lineage, and servicing-era changes
- https://news.microsoft.com/announcement/launch-of-windows-95/
Supports
- Windows 95 launch and introduction of the Start button, taskbar, long filenames, and Plug and Play
- https://blogs.windows.com/windowsexperience/2023/11/09/reflecting-on-20-years-of-windows-patch-tuesday/
Supports
- 2003 start of the predictable monthly Patch Tuesday process
- Trustworthy Computing origins and subsequent Windows security controls
- Windows 10 shift toward a service-based update model
- https://www.microsoft.com/en-us/microsoft-365/blog/2021/06/24/windows-11-the-operating-system-for-hybrid-work-and-learning/
Supports
- June 2021 Windows 11 announcement
- Redesigned Start experience and window Snap behavior
- https://www.microsoft.com/en-us/windows/windows-11
Supports
- Windows 11 product homepage for the desktop operating-system landscape
- https://www.apple.com/os/macos/
Supports
- macOS as Apple's current desktop operating-system product
- https://chromeos.google/
Supports
- ChromeOS as Google's cloud-oriented desktop operating-system product
- https://ubuntu.com/desktop
Supports
- Ubuntu Desktop as an open-source Linux desktop distribution
- Desktop installation, software, security, and support positioning
- https://fedoraproject.org/workstation/
Supports
- Fedora Workstation as a free open-source GNOME desktop
- Community updates, package sources, and hardware support positioning
- https://www.redhat.com/en/store/red-hat-enterprise-linux-workstation
Supports
- Red Hat Enterprise Linux Workstation as a paid supported workstation product
- Professional graphics, scientific, provisioning, and administration use
- https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/access-control
Supports
- Windows applies the more restrictive of share and NTFS permissions when a folder is reached over the network, and local login bypasses share permissions
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/disable-user-account-control
Supports
- Microsoft states disabling UAC makes all programs run with the full rights of the logged-in user and that same-desktop UAC elevation is not a security boundary
- https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry
Supports
- Registry state cannot be version-controlled and can only be restored from a backup taken before a change
- https://learn.microsoft.com/en-us/windows/deployment/update/waas-restart
Supports
- Windows Update cadence and forced restarts impose an operational cost that teams trade against accumulated patch risk
- https://support.microsoft.com/en-us/topic/kb5042421-crowdstrike-issue-impacting-windows-endpoints-causing-an-0x50-or-0x7e-error-message-on-a-blue-screen-b1c700e0-7317-4e95-aeee-5d67dd35b92f
Supports
- CrowdStrike Falcon sensor update triggering a Windows boot loop (BSOD 0x50 or 0x7E) on affected endpoints
