Unit 1: Windows Operating System Fundamentals and Architecture - Subjective Questions

Windows is a graphical operating system developed by Microsoft. It acts as an interface between users, applications, and computer hardware.

Major functions include:

• User interface: Provides the desktop, Start menu, taskbar, windows, and other navigation tools.
• Process management: Creates, schedules, and terminates processes and threads.
• Memory management: Allocates RAM and virtual memory to running programs.
• File management: Organizes files and folders through file systems such as NTFS and FAT32.
• Device management: Uses drivers to communicate with hardware devices.
• Security: Supports user accounts, permissions, authentication, encryption, and auditing.
• Networking: Provides tools and protocols for communication over local networks and the Internet.
• System monitoring: Offers utilities such as Task Manager, Resource Monitor, and Event Viewer.

A Windows version identifies a major release or generation of the operating system, whereas a Windows edition identifies a feature set designed for a particular category of users.

• Version examples: Windows 7, Windows 8.1, Windows 10, and Windows 11.
• Edition examples: Home, Pro, Enterprise, Education, and Windows Server editions.

Important differences include:

• Home is intended mainly for personal and household use.
• Pro adds business-oriented capabilities such as BitLocker, Group Policy, Remote Desktop hosting, and domain joining.
• Enterprise provides advanced deployment, management, and security features for large organizations.
• Education is designed for academic institutions and generally includes many enterprise-level capabilities.

A computer may therefore run a combination such as Windows 11 Pro, where Windows 11 is the version and Pro is the edition.

The main components of the Windows user interface are:

• Desktop: The primary workspace containing the background, shortcuts, files, and folders.
• Start menu: Provides access to installed applications, settings, search, account controls, and power options.
• Taskbar: Displays pinned applications, running programs, the Start button, and the notification area.
• File Explorer: Enables users to browse drives, folders, files, and network locations.
• Search: Locates applications, documents, settings, and other indexed content.
• Notification area: Shows system status icons such as network, sound, battery, and security notifications.
• Settings and Control Panel: Provide interfaces for configuring hardware, accounts, networking, applications, and system behavior.
• Window controls: The minimize, maximize or restore, and close buttons help manage open application windows.

Together, these components provide graphical and searchable methods for opening programs, managing data, switching tasks, and configuring Windows.

Windows organizes data in a hierarchical tree structure.

• A drive is commonly represented by a drive letter, such as C: or D:.
• The top level of a drive is called its root directory, written as C:\\ for the C drive.
• The root contains folders, such as C:\\Windows and C:\\Users.
• Folders can contain subfolders, producing paths such as C:\\Users\\Student\\Documents.
• Folders and subfolders contain files, such as C:\\Users\\Student\\Documents\\notes.txt.

A path identifies the location of an item. An absolute path begins with a drive or root location, while a relative path is interpreted from the current working directory.

Windows also supports mounted volumes, network paths such as \\\\Server\\Share, file names, extensions, permissions, and metadata. File Explorer presents this hierarchy graphically, while CMD and PowerShell allow it to be navigated using commands.

NTFS and FAT32 are file systems supported by Windows, but they are intended for different purposes.

NTFS is normally preferred for Windows system and data drives because it provides stronger security and reliability. FAT32 remains useful when broad device compatibility is more important than large-file support or access control.

Important Windows folders include:

• C:\\Windows: Contains core operating system files, libraries, configuration resources, and system utilities.
• C:\\Windows\\System32: Stores essential executables, dynamic-link libraries, drivers, and administrative tools. Its contents should not be modified without a valid administrative reason.
• C:\\Program Files: Default location for 64-bit applications on a 64-bit Windows installation.
• C:\\Program Files (x86): Common default location for 32-bit applications on 64-bit Windows.
• C:\\Users: Contains user profile folders, including Desktop, Documents, Downloads, and per-user application data.
• Temporary folders: Locations represented by %TEMP% or %TMP% store temporary files created by Windows and applications.
• C:\\ProgramData: Stores application data shared among users.

These folders separate operating system components, installed software, shared data, and individual user data. This structure assists security, maintenance, and multi-user operation.

Environment variables are named values that provide applications and commands with information about the operating environment. Their values can differ by computer or user, allowing scripts and programs to avoid hard-coded paths.

• %PATH%: Lists directories that Windows searches when an executable command is entered without its complete path.
• %TEMP% and %TMP%: Identify locations used to store temporary files.
• %USERPROFILE%: Points to the current user's profile folder, such as C:\\Users\\Student.
• %WINDIR%: Identifies the directory in which Windows is installed, commonly C:\\Windows.
• %SYSTEMROOT%: Also identifies the Windows installation root and commonly has the same value as %WINDIR%.

Environment variables may be defined at the user or system level. In CMD, a value can be displayed using a command such as echo %PATH%. In PowerShell, environment variables are accessed through syntax such as $env:Path.

Windows uses a layered architecture that separates applications from privileged operating system components.

• User mode: Applications and many system processes run with restricted access. A failure in one user-mode application is less likely to crash the entire system.
• Kernel mode: Core operating system components run with extensive access to memory and hardware. Errors in kernel-mode code can cause system-wide failures.
• Kernel: Performs low-level functions such as thread scheduling, interrupt handling, synchronization, and coordination with hardware abstraction mechanisms.
• Executive services: Manage processes, virtual memory, input and output, security, objects, and system configuration.
• Services: Background programs managed by the Service Control Manager. They may start automatically and perform tasks such as networking, printing, updating, and security monitoring.
• Device drivers: Specialized software components that allow Windows to control hardware or implement kernel-level facilities.

Applications normally request operating system functions through system APIs. Windows validates and transfers these requests to the appropriate system components, which may then interact with drivers and hardware.

A Windows service is a background program managed by the Windows Service Control Manager. Services perform operating system or application functions such as printing, event logging, networking, updates, and database operation.

Services differ from ordinary desktop applications in the following ways:

• They can start automatically during system startup, before a user signs in.
• They usually run without a visible graphical interface.
• They may run under dedicated accounts such as Local System, Local Service, Network Service, or a configured user account.
• They can be started, stopped, paused, resumed, and configured through tools such as the Services console, sc, or PowerShell.
• Their startup types include Automatic, Automatic (Delayed Start), Manual, and Disabled.
• They can continue working even when no interactive user session is active.

Disabling an unfamiliar service can affect system stability or application functionality, so its dependencies and purpose should be checked first.

A device driver is software that enables Windows to communicate with and control a hardware device or a specialized system component.

Its major roles are:

• Translating operating system requests into device-specific operations.
• Handling input and output between software and hardware.
• Reporting device status and errors to Windows.
• Supporting features such as power management and Plug and Play.

Compatibility is important because a driver must match the hardware, Windows version, system architecture, and expected driver model. An incompatible or defective kernel-mode driver can cause malfunction, instability, or a stop error.

Digital signing helps Windows verify the identity of a driver's publisher and detect whether the package has been altered. Signed drivers are not automatically free from defects, but signature enforcement reduces the risk of installing unauthorized or tampered kernel code. Drivers should normally be obtained from Windows Update or the device manufacturer's trusted source.

Task Manager is a built-in Windows utility used to inspect and manage system activity.

Its principal areas include:

• Processes: Displays applications and background processes with CPU, memory, disk, network, and energy usage. It can end unresponsive tasks.
• Performance: Shows graphs and statistics for the CPU, memory, storage devices, network adapters, and GPU.
• App history: Reports resource usage for supported applications over time.
• Startup apps: Displays applications configured to start at sign-in and allows them to be enabled or disabled.
• Users: Shows signed-in users and the processes and resources associated with their sessions.
• Details: Provides technical process information such as process identifier, status, priority, and user name.
• Services: Displays service status and offers basic service management options.

Task Manager is useful for identifying resource-intensive or unresponsive applications. However, terminating critical system processes may cause data loss, sign-out, or system instability.

Task Manager provides a broad, accessible overview of running processes and system performance. Resource Monitor provides more detailed analysis of CPU, memory, disk, and network activity.

Resource Monitor is particularly useful for:

• Determining which process is reading from or writing to a specific file.
• Viewing per-process disk throughput and storage response times.
• Identifying network connections, listening ports, and per-process network traffic.
• Examining processes associated with a service.
• Viewing hard faults and detailed physical memory usage.
• Analyzing process dependencies and wait chains when programs appear unresponsive.

Task Manager is usually the first tool used to identify a general bottleneck or terminate an application. Resource Monitor is used when more granular information is required to locate the process, file, address, port, or resource involved in the problem.

A program is a passive set of instructions stored in an executable file. A process is a running instance of a program with its own virtual address space, handles, security context, and allocated resources. A thread is an execution path within a process.

Key points include:

• A process may contain one or many threads.
• Threads in the same process share code, data, and many process resources.
• Each thread has its own execution state, registers, stack, and instruction pointer.
• Windows schedules threads, rather than entire programs, for execution on logical processors.
• Scheduling decisions consider factors such as priority, readiness, processor availability, and time slices.
• Multiple threads can improve responsiveness and concurrency, but they require synchronization to avoid race conditions and data corruption.

For example, a word processor may use one thread for its user interface, another for spell checking, and another for background saving.

Physical memory, or RAM, is the hardware memory directly available to the system. Virtual memory gives each process a private virtual address space that Windows maps to physical memory or other backing storage.

Important concepts are:

• Address space: The range of virtual addresses that a process can use.
• Page: A fixed-size block used to manage virtual memory.
• Paging: The movement or mapping of memory pages as Windows manages available RAM.
• Page file: Disk-based storage that can back committed virtual memory and support crash-dump creation.
• Working set: The pages belonging to a process that are currently resident in physical memory.
• Hard fault: An event in which a required page is not currently in RAM and must be retrieved from disk or another mapped file. It is not necessarily a hardware error.

Virtual memory provides isolation, allows efficient sharing, and enables applications to use address spaces larger than immediately available RAM. Heavy paging can reduce performance because storage access is much slower than RAM access.

A systematic troubleshooting procedure is:

1. Open Task Manager and sort the Processes or Details view by CPU or memory usage.
2. Observe usage over time to distinguish a brief workload spike from a sustained problem.
3. Identify the process name, process identifier, publisher, user account, and related application or service.
4. Check the process's file location and digital signature when its identity is uncertain.
5. Use Resource Monitor for detailed CPU, memory, disk, or network analysis.
6. Save work and attempt to close the application normally.
7. If it remains unresponsive, use End task only after considering possible data loss and dependencies.
8. Investigate the underlying cause, such as a defective update, insufficient memory, malware, a damaged file, or an overloaded service.
9. Review Event Viewer logs and update, repair, reconfigure, or uninstall the responsible software when appropriate.

Critical Windows processes should not be terminated casually because doing so can force a sign-out, restart, or system failure.

The Windows Registry is a hierarchical database used to store configuration information for Windows, users, hardware, services, and applications.

Its structure includes:

• Hive: A major logical section of the Registry containing related configuration data.
• Key: A container comparable to a folder.
• Subkey: A key located beneath another key.
• Value: A configuration entry stored inside a key.
• Value name: The name that identifies a particular value. A key may also have an unnamed default value.
• Data: The information held by the value.
• Data type: The format of the data, such as REG_SZ, REG_DWORD, REG_QWORD, REG_BINARY, or REG_MULTI_SZ.

A Registry path such as HKEY_CURRENT_USER\\Software\\Vendor\\Application begins at a hive and continues through keys and subkeys. Values inside the final key store individual settings. Because Registry changes can affect system behavior, entries should be backed up and modified only when their purpose is understood.

The major Registry hives expose different categories of configuration:

• HKEY_LOCAL_MACHINE (HKLM): Stores system-wide information about hardware, installed software, security, drivers, and services. Its settings generally apply to the whole computer.
• HKEY_CURRENT_USER (HKCU): Contains preferences and configuration for the currently signed-in user, such as desktop and application settings.
• HKEY_CLASSES_ROOT (HKCR): Presents merged information about file associations and COM class registrations.
• HKEY_USERS (HKU): Contains loaded user-profile Registry data for multiple user security identifiers. HKCU represents the current user's relevant branch.
• HKEY_CURRENT_CONFIG (HKCC): Provides information about the hardware profile currently being used.

The distinction between computer-wide and user-specific settings is particularly important. Administrative privileges are often required to modify protected HKLM locations, while a user can usually modify many settings under that user's HKCU branch.

Command Prompt, or CMD, is the traditional Windows command-line interpreter. PowerShell is a more advanced command shell and scripting environment built around structured objects and the .NET platform.

CMD remains useful for compatibility, quick commands, and older scripts. PowerShell is generally better for repeatable administration because it can work directly with processes, services, Registry entries, files, and remote systems as objects.

Useful CMD commands include:

• systeminfo: Displays the operating system version, build, installation details, memory, updates, and hardware summary.
• hostname: Displays the computer name.
• whoami: Displays the current user identity.
• ipconfig /all: Shows detailed network adapter configuration.
• tasklist: Lists running processes.
• driverquery: Lists installed device drivers.
• sc query: Displays service information.

Useful PowerShell commands include:

• Get-ComputerInfo: Produces detailed operating system and computer information.
• Get-Process: Lists processes and exposes properties such as CPU and memory usage.
• Get-Service: Lists services and their states.
• Get-CimInstance Win32_OperatingSystem: Retrieves structured operating system information through CIM.
• Get-Volume: Displays volume, file system, capacity, and free-space information.
• Get-NetIPConfiguration: Shows network interface and IP configuration.

Some commands expose sensitive details or require an elevated terminal for complete results. Their output should be interpreted in the context of the troubleshooting task.

Event Viewer displays event records produced by Windows components, services, drivers, security mechanisms, and applications. It provides a timeline of system activity that can help identify the cause of failures.

Important Windows logs include:

• Application: Events written by applications and application-related components.
• System: Events from Windows services, drivers, and operating system components.
• Security: Audit events such as successful or failed sign-ins, depending on the audit policy.
• Setup: Events related to installation and configuration.
• Forwarded Events: Events collected from other computers when event forwarding is configured.

A troubleshooting process should:

1. Record the approximate time of the failure.
2. Open the relevant log and filter by time, level, source, event identifier, or keywords.
3. Examine nearby Critical, Error, and Warning events while also considering informational context.
4. Read the event source, identifier, message, and detailed data.
5. Correlate related events across Application and System logs.
6. Investigate the named component and verify the conclusion using other diagnostic tools.

An error event does not always identify the root cause by itself, so timing, repetition, dependencies, and surrounding events must also be evaluated.