Windows® Internals, Sixth Edition, Part 1

AAAM (Admin Approval Mode), Running with Administrator Rightsaborts, Trap Dispatchingabsolute timers, Timer Expirationabstract classes, ProvidersAcceptEx function, Winsock Server Operationaccess, ACL Assignment, Ghosts, Network Access Protectioncaching, Ghostsdetermining, ACL Assignmentnetwork, Network Access Protectionaccess checks, Protecting Objects, ACL Assignment, Determining Access, Determining Access, Determining Accessaccess token-based, Determining Accessdiscretionary, ACL Assignment, Determining Accessuser-mode equivalents, Determining Accessaccess control, Security, Trusted Computer System Evaluation Criteria, Security Descriptors and Access Control, The AuthZ API, The AuthZ APIclaims based, The AuthZ APIdiscretionary, Trusted Computer System Evaluation Criteriaforms of, Securityidentity-based, The AuthZ APIaccess control entries (ACEs), Security Descriptors and Access Control (see ACEs (access control entries))access control lists (ACLs), Security Descriptors and Access Control (see ACLs (access control lists))access logging, Protecting Objectsaccess mask, specifying, Object Securityaccess rights, Reserve Objects, Protected Processes, Protected Processes, Determining Access, Assured Authentication, User Account Control and Virtualizationadministrative vs. user, User Account Control and Virtualizationgroup claims, Assured Authenticationprocess requests, Protected Processesprotected processes and, Protected Processesrevocation, Determining Accessto objects, Reserve Objectsaccess tokens, Services, Functions, and Routines, Processes, Threads, and Jobs, Local Session Manager (Lsm.exe), Tokens, Determining Access, Super Privileges, User Logon Steps, User Logon Steps, User Logon Steps, Application Identification (AppID)access checks based on, Determining AccessAppIDs in, Application Identification (AppID)creation, User Logon Stepsgeneration, Local Session Manager (Lsm.exe)privileges, adding, User Logon Stepsuser, User Logon Stepsaccess validation, Determining Access, Determining AccessACE ordering, Determining Accessalgorithms, Determining Accessaccess-denied errors, Process Monitor Troubleshooting TechniquesAccessCheck, Digging into Windows Internals, Object Security, Integrity Levels, Determining Accessobject integrity levels, viewing, Integrity Levelsobject security checks, Object SecurityAccessCheckByType function, Determining Accessaccount profiles, loading, Service Startupaccount rights, Conditional ACEs, Account Rightsdefined, Conditional ACEsACEs (access control entries), Security Descriptors and Access Control, Security Descriptors and Access Control, Security Descriptors and Access Control, Security Descriptors and Access Control, ACL Assignment, ACL Assignment, Determining Access, Determining Access, Determining Access, The AuthZ API, Security Auditing, Application Identification (AppID), AppLockeraudit types, Security Auditingconditional, The AuthZ API, Application Identification (AppID), AppLockerflags, Security Descriptors and Access Controlin SACLs, Security Descriptors and Access Controlinheritance, Security Descriptors and Access Controlorder of, ACL Assignment, Determining Accessprocessing, Determining Accesspropagation, ACL Assignmentviewing, Determining AccessACLs (access control lists), Reserve Objects, Service Isolation, Virtual Service Accounts, Virtual Service Accounts, Security Descriptors and Access Control, Security Descriptors and Access Control, Security Descriptors and Access Control, ACL Assignmentaccumulation of access rights, Security Descriptors and Access ControlACE order in, ACL Assignmentassigning, Security Descriptors and Access Controldisplaying, Reserve Objectsservices, permissions for, Service Isolationtypes, Security Descriptors and Access Controlvirtual service accounts in, Virtual Service Accounts, Virtual Service Accountsact as part of operating system privilege, Super PrivilegesAction Center, viewing crashes in, Windows Error Reportingactivation contexts, DLL Name Redirectionactive desktop, Winlogon InitializationActive Directory, HKEY_LOCAL_MACHINE, Security System Components, Security Descriptors and Access Control, RPC Operation, Remote Access, Remote Access, Remote Access, Active Directory, Active DirectoryACEs used in, Security Descriptors and Access ControlAPIs to access objects, Remote Accessarchitecture, Active Directorydirectory service, Active Directoryschema, Remote Accessserver name publishing integration, RPC OperationActive Directory Service Interfaces (ADSI), Remote AccessActive Directory Users and Groups MMC snap-in, Account Rights and Privilegesactive logon sessions, listing, User Logon Stepsactive probes, Registry Change MonitoringActiveX controls, WMI Architectureaddress mapping, Virtual Memoryaddress ordering, Data Structuresaddress sharing, restricting, Winsock Kerneladdress space, Virtual Memory, Wow64, Stage 3A: Setting Up the EPROCESS Objectfor Wow64 processes, Wow64initial process, Stage 3A: Setting Up the EPROCESS Objectlayout, Virtual MemoryAddress Windowing Extension (AWE), Virtual Memoryaddresses, Winsock Extensions, Network Load Balancing(see also IP addresses)well-known, Winsock ExtensionsAdjustBoost dispatch events, Boosts Due to Scheduler/Dispatcher EventsAdjustBoost priority boosts, Applying BoostsAdjustUnwait dispatch events, Priority BoostsAdjustUnwait priority boosts, Priority Boosts for CPU StarvationAdmin Approval Mode (AAM), Running with Administrator Rightsadministrative rights, User Account Control and Virtualization, Registry Virtualization, Running with Administrator Rights, Running with Administrator Rightsoperations requiring, Registry Virtualizationrequesting, Running with Administrator Rightsrunning with, Running with Administrator RightsAdministrator account name, Security Identifiersadministrators, Account Rights and Privileges, PrivilegesBypass Traverse Checking privilege, Privilegesprivileges assignment, Account Rights and Privilegesadmission control, QoSADSI (Active Directory Service Interfaces), Remote AccessAdvanced Local Procedure Call (ALPC), Executive (see ALPC (Advanced Local Procedure Call))Advanced Security Settings dialog box, Determining Access, Determining AccessEffective Permissions tab, Determining AccessPermissions tab, Determining AccessAdvanced Settings dialog box Adapters And Bindings tab, QoSAdvapi32.dll, Architecture Overview, API Sets, Protected Processesprocess-creation routines, Protected Processesvirtual DLL files, API SetsAFD (Ancillary Function Driver), Extending Winsockaffinity masks, Symmetric Multiprocessing, Thread Selection, NUMA Systems, Logical Processor State, Affinity, Affinity(see also processor affinity)extended, Affinityprocess, Affinityrestricting to specific node, NUMA Systemsthread, Logical Processor Stateaffinity policy, interrupts, Software Interrupt Request Levels (IRQLs)alertable wait state, Asynchronous Procedure Call InterruptsALPC (Advanced Local Procedure Call), Executive, Session Manager (Smss), Windows Global Flags, Windows Global Flags, Connection Model, Connection Model, Message Model, Message Model, Message Model, Message Model, Message Model, Asynchronous Operation, Asynchronous Operation, Asynchronous Operation, Asynchronous Operation, Views, Regions, and Sections, Views, Regions, and Sections, Views, Regions, and Sections, Views, Regions, and Sections, Blobs, Handles, and Resources, Blobs, Handles, and Resources, Security, Security, Debugging and Tracing, Debugging and Tracingasynchronous operation, Message Modelattributes, Views, Regions, and Sectionsblobs, Views, Regions, and Sectionscompletion list, Message Modelconnection model, Connection Modeldebugging, Debugging and Tracinghandle table, Blobs, Handles, and Resourceshandles, Views, Regions, and Sectionsmessage model, Message Modelmessage queues, Message Modelmessage zones, Securityperformance, Securityport creation, Session Manager (Smss)ports, Connection Model, Message Modelregions, Asynchronous Operationresources, Views, Regions, and Sectionssections, Asynchronous Operationsecurity, Asynchronous Operation, Blobs, Handles, and Resourcestracing, Debugging and Tracinguses, Windows Global Flagsviews, Asynchronous Operationaltitudes of registry callbacks, Stable StorageAMD-V Rapid Virtualization Indexing (RVI), Memory VirtualizationAncillary Function Driver (AFD), Extending WinsockANSI character text strings, converting to Unicode, Registryantivirus products, use of callback mechanism, Stable StorageAPC boosts, Unwait BoostsAPC delivery, Keyed Events, Fast Mutexes and Guarded Mutexes, Wow64 Process Address Space Layoutdisabling, Keyed Events, Fast Mutexes and Guarded Mutexesin Wow64, Wow64 Process Address Space LayoutAPC interrupt level, Software Interrupt Request Levels (IRQLs), Stage 7: Performing Process Initialization in the Context of the New Process, Interrupt Levels vs. Priority LevelsAPC objects, Dispatch or Deferred Procedure Call (DPC) InterruptsAPC queue, Dispatch or Deferred Procedure Call (DPC) InterruptsAPCs (asynchronous procedure calls), Dispatch or Deferred Procedure Call (DPC) Interrupts, Dispatch or Deferred Procedure Call (DPC) Interrupts, Asynchronous Procedure Call Interrupts, Reserve Objects, Stage 4: Creating the Initial Thread and Its Stack and Context, Priority Boosts, Lock Ownership Boosts, Priority Boosts for Multimedia Applications and Games, Choosing a Processor for a Thread When There Are Idle Processors, Per-Session CPU Quota Blocks, Per-Session CPU Quota Blocks, Charging of Cycles to Throttled Threads, Resuming Execution, RPC OperationCPU quota enforcement, Charging of Cycles to Throttled Threadsdisabling, Dispatch or Deferred Procedure Call (DPC) Interruptsinsertion and delivery behavior, Asynchronous Procedure Call Interruptspending, Priority Boosts for Multimedia Applications and Games, Choosing a Processor for a Thread When There Are Idle Processorsper-process CPU Quota APC structure, Per-Session CPU Quota Blocksper-thread, Per-Session CPU Quota Blocks, Resuming Executionqueuing to thread, Priority Boostsrate control, Stage 4: Creating the Initial Thread and Its Stack and Contextsignaling code implementation, Lock Ownership BoostsUser APC reserve object, Reserve ObjectsAPI redirection, Image Loader, Post-Import Process Initializationfor application compatibility, Post-Import Process Initializationimage loader support, Image LoaderAPI Sets, Image Loader, SwitchBackimage loader support, Image LoaderAPIC (Advanced Programmable Interrupt Controller), Hardware Interrupt Processing, Hardware Interrupt Processing, x64 Interrupt Controllers, Software Interrupt Request Levels (IRQLs), Synthetic Devicesarchitecture, Hardware Interrupt Processinginterrupt assignment, Software Interrupt Request Levels (IRQLs)viewing, x64 Interrupt Controllersvirtualizing, Synthetic DevicesAPIs, Post-Import Process Initialization, SwitchBack, Protocol Driversapplication-compatibility risks, Post-Import Process Initializationcategorization, SwitchBackseparating from underlying protocols, Protocol DriversAppID, Controlling UAC Behavior, AppLockercertificate verification, AppLockerapplication desktop, Logonapplication failures, troubleshooting, Process Monitor Internalsapplication layer in OSI reference model, The OSI Reference Modelapplication load failures, Import Parsing, Post-Import Process Initializationapplication manifests, Post-Import Process Initialization, Requesting Administrative Rightsexecution level information, Requesting Administrative Rightsversion-specific GUIDs in, Post-Import Process Initializationapplication setup programs, Services, Servicesservice initialization, Servicesservice registration, Servicesapplication start cursor, Stage 5: Performing Windows Subsystem–Specific Post-Initializationapplication-compatibility flags, Requesting Administrative Rightsapplication-compatibility shims, File System and Registry Virtualizationapplications, Environment Subsystems and Subsystem DLLs, Windows Subsystem, Timer Processing, Object Directories, Registry Redirection, Native Support, Native Support, Image Loader, SwitchBack, Viewing and Changing the Registry, Registry Usage, Process Monitor Internals, Process Monitor Internals, Process Monitor Troubleshooting Techniques, Process Monitor Troubleshooting Techniques, The Registry Namespace and Operation, Windows Diagnostic Infrastructure, Stage 5: Performing Windows Subsystem–Specific Post-Initialization, Thread Scheduling, Dynamic Processor Addition and Replacement, Access Checks, User Account Control and Virtualization, User Account Control and Virtualization, User Account Control and Virtualization, Running with Administrator Rights, Controlling UAC Behavior, Controlling UAC Behavior, Extending Winsock, RPC Operation, Background Intelligent Transfer Service, Location and Topologyadministrative rights, requesting, Running with Administrator Rightsaffinity updates, Dynamic Processor Addition and ReplacementAppIDs, Controlling UAC Behaviorbuffer overflows, Process Monitor Troubleshooting Techniquescompatibility levels, SwitchBackdebugging startup, Image Loaderdynamic configuration, Location and Topologygroup-aware, Thread SchedulingI/O control functions, Registry Redirectionidentification for security purposes, Controlling UAC Behaviorinitialization, Native Supportnonadministrative, User Account Control and Virtualizationnotification of registry changes, Process Monitor Internalspeer-to-peer support, Background Intelligent Transfer Serviceprivate objects, Access Checksproblem diagnosis requests, Windows Diagnostic Infrastructureregistry key creation, The Registry Namespace and Operationregistry settings, Registry Usageregistry settings, locating, Process Monitor Internalsresponse times, Timer ProcessingRPC, RPC Operationsingle-instancing, Object Directoriesstandard user rights, running with, User Account Control and Virtualizationstartup, Viewing and Changing the Registrysubsystem DLL calls, Environment Subsystems and Subsystem DLLsunprivileged user accounts, running in, Process Monitor Troubleshooting Techniquesuser data, saving, User Account Control and VirtualizationUSER function calls, Windows Subsystemuser-mode execution, Native Supportvirtualization, Stage 5: Performing Windows Subsystem–Specific Post-InitializationWinsock functions, access to, Extending WinsockAppLocker, Security System Components, The AuthZ API, Application Identification (AppID), AppLocker, AppLocker, AppLocker, AppLocker, AppLocker, AppLocker, AppLockerauditing mode, AppLockerCBAC use, The AuthZ APIconditional ACEs, Application Identification (AppID), AppLockerPowerShell commands, AppLockerregistry change notifications, AppLockerrules, AppLockerstorage location of rules, AppLockerAPs (authentication protocols), Assured Authenticationarbiters, Software Interrupt Request Levels (IRQLs)argument table, System Service Dispatchingartificial wait state, CPU Rate LimitsASMP (asymmetric multiprocessing), Portabilityassembly language, PortabilityASSERT checks, Checked Buildassociation classes, The WMI NamespaceAssured Authentication, User Logon Stepsasymmetric multiprocessing (ASMP), Portabilityasynchronous callbacks, for change notifications, Viewing and Changing the Registryasynchronous events, interrupts, Trap Dispatching(see also interrupts)asynchronous execution, Run Once Initializationasynchronous file transfer, Background Intelligent Transfer Serviceasynchronous messaging, Message Model, Securitymessage zones, Securityasynchronous notifications, Message Modelasynchronous procedure calls (APCs), Dispatch or Deferred Procedure Call (DPC) Interrupts (see APCs (asynchronous procedure calls))asynchronous RPC, RPC Operationatomic lock operations, Fast Mutexes and Guarded Mutexesattributes, Views, Regions, and Sections, Stage 1: Converting and Validating Parameters and Flags, The AuthZ API, Offline FilesALPC, Views, Regions, and Sectionscacheable, Offline FilesCBAC, The AuthZ APIprocess, Stage 1: Converting and Validating Parameters and FlagsAudio Device Graph process (Audiodg.exe), Protected ProcessesAudit Log, Security Descriptors and Access ControlAudit Object Access policy, Security Auditingaudit records, Security Auditing, Security Auditing, Security Auditing, Security AuditingACEs in, Security Auditingflow of, Security Auditinggeneration, Security Auditingobject-access, Security Auditingauditing, Security Auditing, Security Auditing, Security Auditing, Security Auditing, Security Auditing, Advanced Audit Policy Settingsadvanced policy settings, Advanced Audit Policy Settingsaudit events, generating, Security AuditingAudit Object Access policy, Security Auditinglocal system policies, Security Auditingmechanisms for, Security Auditingpolicy configuration, Security AuditingAuditPol command, Global Audit PolicyAuditQueryGlobalSacl API, Global Audit PolicyAuditSetGlobalSacl API, Global Audit Policyauthentication, Local Session Manager (Lsm.exe), Logon, Winlogon Initialization, Winlogon Initialization, Winlogon Initialization, User Logon Steps, User Logon Steps, User Logon Steps, User Logon Steps, Assured Authentication, Assured Authentication, RPC Operation, RPC OperationAssured Authentication, User Logon Stepsbiometric framework, Assured Authenticationcertificate-based, Assured Authenticationcredential providers, Local Session Manager (Lsm.exe)Kerberos, User Logon Stepslevels, RPC OperationMSV1_0, Winlogon Initializationnetwork communication, RPC Operationpassword-based, Winlogon Initializationremote, User Logon Stepssmartcard, User Logon Stepsuser, Logon, Winlogon Initializationauthentication packages, Security System Components, Logon, Winlogon Initializationfor user logon, Winlogon Initializationauthentication protocols (APs), Assured Authenticationauthentication services, RPC OperationAuthIP, Internet Protocol Security, Internet Protocol Securityauthorization, Determining AccessAuthZ Windows API, Access Checks, Determining AccessAUTHZ_CLIENT_CONTEXT, Determining Accessauto-elevation, Requesting Administrative Rightsauto-start services, Services, Interactive Services and Session 0 Isolation, The Service Control Manager, Service Startup, Service Startupdependencies, Service StartupAutochk.exe, Session Manager (Smss)automated problem detection, Windows Diagnostic Infrastructure(see also WDI (Windows Diagnostic Infrastructure))availability, Distributed File System NamespaceAWE (Address Windowing Extension), Virtual Memory