Windows® Internals, Sixth Edition, Part 1

CC programming language, Operating System Model, PortabilityC-state intervals, Intelligent Timer Tick Distributioncache manager, Executivecache-aware pushlocks, Pushlockscacheable attributes, Offline Filescaches, Offline Files, Offline Files, Ghosts, BranchCache, Caching Modesaccessing, Offline FilesBranchCache, BranchCacheOffline Files, Offline Filesrepublication, Caching Modesstructure, Ghostscaching, Offline Files, Offline Files, BranchCache, BranchCache, QoSclient-side, Offline Filescontent, BranchCachefiles, Offline Filesnetwork usage infomation, QoSsecurity, BranchCachecall managers, Variations on the NDIS Miniportcallable functions, Windows Operating System Versionscallbacks, Asynchronous Procedure Call Interrupts, Timer Expiration, Reserve Objects, Object Filtering, Object Filtering, Asynchronous Operation, Blobs, Handles, and Resources, User Callbacks, Post-Import Process Initialization, Viewing and Changing the Registry, Stable Storage, Network Address Translationallocation and deallocation, Blobs, Handles, and Resourcesasynchronous, Reserve Objects, Viewing and Changing the RegistryDPC, Timer Expirationexecutive objects, Asynchronous OperationNAT functionality, Network Address Translationpre and post, Object Filteringregistry, Stable StorageShim Engine, Post-Import Process Initializationto completion routine, Asynchronous Procedure Call Interruptsuser, User Callbacksverifying, Object Filteringcallout drivers, Windows Filtering Platformcallouts, Windows Networking ComponentsCBAC (Claims Based Access Control), The AuthZ APICBI (Component Based Servicing) stack, HKEY_LOCAL_MACHINEcell indexes, Hive Structurecells, registry hive, Hive Structure, Hive Structuredata types, Hive Structurecertificate chains, AppLockercertificate paths, reverification, Application Identification (AppID)certificate verification, AppLockercertificate-based authentication, Assured Authenticationchange notifications, asynchronous callbacks for, Viewing and Changing the RegistryChange Notify privilege, Running with Least PrivilegeChangeServiceConfig2 API, Running with Least PrivilegeChangeWindowMessageEx API, Determining AccessChangeWindowMessageFilter API, Determining Accesschecked build, Checked Build, Debugging and TracingALPC message logging, Debugging and Tracingchild partitions, Virtual Machine Manager Service and Worker Processes, Virtual Machine Manager Service and Worker Processes, Child Partitions, Child Partitions, Child Partitions, Emulated Devices, Synthetic Devices, Synthetic Devices, Memory Virtualization(see also hypervisor (Hyper-V))access to hardware, Virtual Machine Manager Service and Worker Processesaccess to memory, Memory Virtualizationemulated devices for, Emulated Devicesenlightenments, Child Partitionsprocessors, adding, Synthetic Devicesviewing, Child Partitionsvirtual processors, Synthetic Devicesvirtualization components, Child Partitionschild processes, Integrity Levels, Tokensintegrity level, Integrity Levelstoken inheritance, Tokenschimney offloading, NDIS DriversCIM (Common Information Model), WMI Architecture, Providersclasses, ProvidersCIMV2 namespace, Class AssociationCIM_ManagedSystemElement class, ProvidersClaims Based Access Control (CBAC), The AuthZ APIclasses, HKEY_USERS, Providers, Providers, Providers, Providers, The Common Information Model and the Managed Object Format Language, The Common Information Model and the Managed Object Format Language, The Common Information Model and the Managed Object Format Language, The WMI Namespace, The WMI Namespaceabstract, Providersassociations, The WMI NamespaceCIM, Providerscommon-model, Providersdefinitions, The Common Information Model and the Managed Object Format Languageextended-model, ProvidersMOF definitions, viewing, The Common Information Model and the Managed Object Format Languageobjects in, enumerating, The WMI Namespaceregistrations in registry, HKEY_USERSstatic, The Common Information Model and the Managed Object Format Languageclient communication ports, Connection Modelclient IDs, Processes, Threads, and Jobsclient operating systems, Scalability, Checked Build(see also operating systems)vs. server versions, Scalabilityclient processes, impersonation limits, Impersonationclient-side caching (CSC), Offline FilesClient/Server Run-Time Subsystem (Csrss.exe), Environment Subsystems and Subsystem DLLs(see also Csrss.exe (Client/Server Run-Time Subsystem))clients, Windows Networking Components, Windows Sockets, Network Access Protectionconnectionless, Windows Socketshealth monitoring, Network Access Protectionof the transport, Windows Networking Componentsclock cycles, Examining Thread Activity, Quantum, Quantum Accounting, Quantum End, Per-Session CPU Quota Blocks, Per-Session CPU Quota BlocksDFSS, triggering, Per-Session CPU Quota Blocksfor quantum targets, Quantum Endper quantum, Quantum Accountingthread run time, Examining Thread Activity, Quantumthreads, charging to, Per-Session CPU Quota Blocksclock interrupt handler, Dispatch or Deferred Procedure Call (DPC) Interruptsclock interrupts, Hardware Interrupt Processing, Software Interrupt Request Levels (IRQLs), Asynchronous Procedure Call Interrupts, Intelligent Timer Tick Distributionminimizing, Intelligent Timer Tick Distributionclock interval timer, scheduling on, Quantum Endclock intervals, Asynchronous Procedure Call Interrupts, Timer Processing, Dispatcher Database, Quantum, Quantumchange request tracing, Timer Processingfor running threads, Dispatcher Databasefrequency, Quantumlength of, Quantummodification, Asynchronous Procedure Call InterruptsClockres program, Quantumclose method, Object MethodsCLR (Common Language Runtime), Windows API, Windows APIWindows DLLs, Windows APICLR via C#, 3rd edition (Richter), Windows APIcluster hosts, Network Load BalancingClustered Shared Volumes (CSV), Live Migrationclustering, Network Load Balancingcoalescing, timer, Intelligent Timer Tick Distributioncode, Software Interrupt Request Levels (IRQLs), System Service Dispatching, Synchronization, Spinlocks, Pushlocks, Condition Variables, Run Once Initialization, Kernel Patch Protection, Kernel Patch Protection, Diagnostic Functionality, Protecting Objectsatomic execution, Run Once Initializationcritical sections, Synchronization, Spinlocks, Pushlocks, Condition Variablesdispatch, Software Interrupt Request Levels (IRQLs)integrity, Kernel Patch Protectionkernel-mode, System Service Dispatching, Kernel Patch Protection, Protecting ObjectsSelf-Monitoring Analysis and Reporting Technology (SMART) code, Diagnostic Functionalitycold patches, Kernel Transaction ManagerCOM API, WMI ArchitectureCOM class registrations, HKEY_USERSCOM objects, administrative rights requests, Auto-Elevationcommands, task-based, Consumer RegistrationCommon Criteria for Information Technology Security Evaluation (CCITSE), Objects and Handles, Trusted Computer System Evaluation CriteriaCommon Information Model (CIM), WMI ArchitectureCommon Language Runtime, Windows API (see CLR (Common Language Runtime))Common Language Runtime (CLR), Windows APIcommon-model classes, Providerscommunication ports, Connection ModelCompaq, Architecture Overviewcompatibility, Requirements and Design Goals, Image Loaderdynamic runtime, Image Loadercompletion lists, Message Model, SecurityALPC, Message ModelALPC support, Securitycompletion ports, Asynchronous OperationComponent Based Servicing (CBS) stack, HKEY_LOCAL_MACHINEComponent Services, Windows Operating System Versionscomponents, identifying, HKEY_LOCAL_MACHINEcompositing, Kernel Mode vs. User Modecompound TCP (CTCP), Protocol Driverscondition variables (CondVars), Low-IRQL Synchronization, User-Mode Resourcesconditional ACEs, The AuthZ API, Application Identification (AppID), AppLockerconditional expressions, The AuthZ APIconfiguration data, Viewing and Changing the Registry, HKEY_LOCAL_MACHINEreading, Viewing and Changing the Registrystorage location, HKEY_LOCAL_MACHINEconfiguration manager, Ntdll.dll, Object Methods, Logging Activity in Unprivileged Accounts or During Logon/Logoff, Hive Structure, Hive Structure, Hive Structure, Cell Maps, Cell Maps, Stable Storage, Stable Storage, Registry Filtering, Registry Filtering, Registry Filtering, Registry Virtualizationcell mapping, Hive Structurehive syncs, Stable Storagekey and value name storage, Registry Filteringkey control block lookups, Registry Filteringmemory management, Hive Structurenaming parsing, Cell Mapsobject manager’s object support, Cell Mapsperformance optimizations, Registry Filteringregistry filtering, Stable Storageregistry management, Logging Activity in Unprivileged Accounts or During Logon/Logoffregistry namespace implementation, Object Methodsregistry virtualization, Registry Virtualizationsubkey searches, Hive Structurecongestion, Protocol Drivers, Internet Protocol Security(see also network traffic)avoidance algorithm, Protocol DriversConnectEx API, Winsock Server Operationconnection blobs, Blobs, Handles, and Resourcesconnection-oriented clients, Variations on the NDIS Miniportconnection-oriented NDIS (CoNDIS), NDIS Drivers, Variations on the NDIS Miniportconnection-oriented network hardware, Variations on the NDIS Miniportconnection-oriented sockets, WSK Implementationconnectionless networking protocols, Winsock Server Operationconnections, Network Location Awareness (see network connections)connectivity status, Network Location Awarenessconsole applications, Windows Subsystem, Servicesservices, Servicesconsole window host (Conhost.exe), Windows Subsystemconsumers, Kernel Event Tracing, Kernel Support, Provider Registrationof debug events, Kernel Supporttrace data, Kernel Event TracingUBPM registration, Provider Registrationcontent, BranchCache, BranchCache, Caching Modes, Configurationcaching, BranchCacheidentification, Configurationpublishing, BranchCacherepublished, Caching Modescontention count, Executive Resourcescontext attribute, Views, Regions, and SectionsCONTEXT block, Processes, Threads, and Jobscontext switches, Processes, Threads, and Jobs, Hardware Support, Overview of Windows Scheduling, Quantum Accounting, Priority Boosts for Multimedia Applications and Games, Priority Boosts for Multimedia Applications and Gamesdefined, Overview of Windows Schedulingprocessor-specific implementations, Hardware Supportthread, Priority Boosts for Multimedia Applications and Gamescontrol handlers, Service Applicationscontrol objects, Executivecontrol points, Message Queuingcontrol sets, last known good, HKEY_LOCAL_MACHINEcontrollers, Kernel Event TracingConvertThreadToFiber function, Processes, Threads, and Jobscore parking, Processor SelectionCore Parking engine, Choosing a Processor for a Thread When There Are No Idle Processorscore system files, Architecture OverviewCoreProcessorSetvalue, Thread SelectionCoresPerPhysicalProcessor value, Thread Selectioncorporate networks, accessing, Direct Accesscorrected machine check interrupt level, Software Interrupt Request Levels (IRQLs)CPs (credential providers), Local Session Manager (Lsm.exe), Security System Components, Logon, Logon, Logonalternative, Logonloading, Logonuser identification tasks, LogonCPU, Synthetic Devices, Termination, Per-Session CPU Quota Blocks(see also logical processors; processors)idle thread, Terminationshare weight, Per-Session CPU Quota BlocksCPU 0 congestion, Processor SelectionCPU quotas, Distributed Fair Share Scheduling, Distributed Fair Share Scheduling, Charging of Cycles to Throttled Threads, Resuming Execution, DFSS Idle-Only Queue Schedulingenforcement, Charging of Cycles to Throttled Threadsper-session blocks, Distributed Fair Share Schedulingrecovering, Resuming Executionupdating and extending, DFSS Idle-Only Queue SchedulingCPU rate limits, CPU Rate LimitsCPU starvation, Priority Boosting After I/O Completion, Priority Boosts After GUI Threads Wake Upprevention, Priority Boosting After I/O Completionthread priority boosts for, Priority Boosts After GUI Threads Wake UpCPU Stress tool, viewing priority boosts, Priority Boosts for Foreground Threads After Waits, Priority Boosts for CPU StarvationCPU throttling, Stage 4: Creating the Initial Thread and Its Stack and Context, Priority Boosts for Multimedia Applications and Games, Per-Session CPU Quota Blocks, Charging of Cycles to Throttled Threadsclock cycles, charging to threads, Per-Session CPU Quota Blocksquota enforcement, Charging of Cycles to Throttled ThreadsCPU usage, Processes, Threads, and Jobs, Performance Monitor, System Process and System Threads, Examining Thread Activity, Using Tools to Interact with Priority, Quantum, Priority Boosts for Multimedia Applications and Games, CPU Rate Limitsdisplaying, Processes, Threads, and Jobs, Performance Monitorlimiting, CPU Rate Limitsmultimedia threads, Priority Boosts for Multimedia Applications and Gamesspecifying, Using Tools to Interact with Prioritysystem threads, mapping to, System Process and System Threadsthreads, Examining Thread Activity, Quantumcrash dump files, Debugging Tools for Windowscrashed applications, Windows Error Reporting, Windows Error Reportingerror reporting, Windows Error Reportinguser, informing, Windows Error Reportingcreate a token object privilege, Super Privilegescreate global object privilege, Session NamespaceCreateEventEx API, Object SecurityCreateFile function, ImpersonationCreateMailslot function, Mailslot OperationCreateMutexEx API, Object SecurityCreateNamedPipe function, HTTPCreatePrivateNamespace API, Object DirectoriesCreateProcess function, Protected Processes, Stage 1: Converting and Validating Parameters and Flags, Stage 2: Opening the Image to Be Executedflags and parameters, creating and validating, Stage 1: Converting and Validating Parameters and Flagsflow of, Protected Processesstage 1 decision tree, Stage 2: Opening the Image to Be ExecutedCreateProcessAsUser function, Service Startup, Running with Administrator RightsCreateRestrictedToken function, ImpersonationCreateSemaphoreEx API, Object SecurityCreateService function, ServicesCreateThread function, Birth of a Thread, Idle ThreadsCreationFlags parameter, Stage 1: Converting and Validating Parameters and FlagsCreator Group ID SID, Security IdentifiersCreator Owner ID SID, Security Identifierscredential providers (CPs), Local Session Manager (Lsm.exe) (see CPs (credential providers))critical sections, Synchronization, Spinlocks, Pushlocks, Pushlocks, Condition Variableslimitations, Pushlocksmutually exclusive access, Synchronizationspinlocks on, SpinlocksSRW Locks, replacement by, Condition Variablescritical structure corruptions, Kernel Patch Protectioncritical worker threads, System Worker ThreadsCSC (client-side caching), Offline FilesCsrCreateProcess function, Stage 5: Performing Windows Subsystem–Specific Post-InitializationCsrss.exe (Client/Server Run-Time Subsystem), Environment Subsystems and Subsystem DLLs, Service Shutdown, Service Shutdown, Processes, Threads, and Jobs, Data Structures, Data Structures, Protected Processes, Data Structures, Data StructuresCSR_PROCESS maintenance, Data StructuresCSR_THREAD maintenance, Data Structuresparallel proces structures, Processes, Threads, and Jobsparallel thread structures, Data Structuresprocess information, Data Structuresprocess-creation routines, Protected ProcessesSCM, killing, Service Shutdownshutdown routine, Service ShutdownCSR_PROCESS, Processes, Threads, and Jobs, Data Structures, Data Structures, Stage 5: Performing Windows Subsystem–Specific Post-Initialization, Data Structuresallocation, Stage 5: Performing Windows Subsystem–Specific Post-Initializationdumping, Data Structurespointer to, Data StructuresCSR_THREAD, Stage 5: Performing Windows Subsystem–Specific Post-Initialization, Data Structures, Data Structures, Data Structures, Data Structuresallocation, Stage 5: Performing Windows Subsystem–Specific Post-Initializationdumping, Data Structuresfields, Data StructuresCSV (Clustered Shared Volumes), Live MigrationCTCP (compound TCP), Protocol DriversCtrl+Alt+Delete key combination, Winlogon Initializationcurrent directory, path, DLL Name Resolution and Redirectioncurrent user, Registry Logical Structure, Choosing a Processor for a Thread When There Are No Idle Processors(see also users)preferences and software configuration, Registry Logical StructureCurrentControlSet key, Startup Errors