Windows® Internals, Sixth Edition, Part 1

Rrace conditions, Dynamic Processor Addition and Replacementrate limiting, CPU, CPU Rate LimitsRaw transport protocol, Winsock KernelRDBSS (Redirected Drive Buffering SubSystem), Surrogate Providers, Redirectormini-redirectors, RedirectorRDPDR mini-redirector, Mini-Redirectorsread-commit isolation level, Transactional Registry (TxR)ready queues, Stage 4: Creating the Initial Thread and Its Stack and Context, Thread States, Thread States, Thread States, Thread States, Quantum Accounting, Priority Boosts After GUI Threads Wake Up, Priority Boosts for CPU Starvation, Preemption, Thread Selection, Thread Selection, Thread Selection on Multiprocessor Systemscontext switch to, Quantum Accountingdeferred, Stage 4: Creating the Initial Thread and Its Stack and Contextdispatcher, Thread States, Thread Selectionper-processor dispatcher, Thread Statespreempted threads, Preemptionscanning, Thread States, Priority Boosts After GUI Threads Wake Up, Priority Boosts for CPU Starvation, Thread Selectionsystemwide, Thread Statesthread association with, Thread Selection on Multiprocessor Systemsready summary, Thread Statesready threads, Thread Scheduling, Using Tools to Interact with Priority, Thread States, Priority Boosts After GUI Threads Wake Upin ready queue, Thread Statespriority boosts for, Priority Boosts After GUI Threads Wake Upviewing, Thread SchedulingReal Time Clock (RTC), Asynchronous Procedure Call Interruptsreal-time processing, Software Interrupt Request Levels (IRQLs)reaper function, System Worker Threadsreason for access reporting, Security Auditingreceive window auto tuning, Protocol Driversrecv and send APIs, Windows SocketsRedirected Drive Buffering SubSystem (RDBSS), Surrogate Providersredirection, User Callbacks, DLL Name Resolution and Redirection, SwitchBackAPI Sets, SwitchBackin Wow64, User Callbacksof DLL names, DLL Name Resolution and Redirectionredirectors, Device Drivers, WSK Implementation, UPnP with PnP-X, UPnP with PnP-X, Multiple UNC Provider, Multiple UNC Provider, Multiple UNC Provider, Surrogate Providers, Surrogate Providers, Redirector, Mini-Redirectorscomponents, Surrogate Providersmini-redirectors, RedirectorMultiple Provider Router, UPnP with PnP-XMultiple UNC Provider, Multiple UNC Providerprefix cache, Multiple UNC Providerpriority order, Multiple UNC ProviderServer Message Block, Mini-Redirectorssurrogate providers, Surrogate Providersreference count, object, Object SecurityReg.exe, Viewing and Changing the Registry, Registry Virtualizationvirtualization state, displaying, Registry VirtualizationRegCreateKeyTransacted API, HKEY_PERFORMANCE_DATARegDeleteKeyTransacted API, HKEY_PERFORMANCE_DATARegedit.exe, Viewing and Changing the Registry, Hives, Security System Componentshives, loading and unloading, Hiveslocal system account, running as, Security System ComponentsRegFlushKey API, Stable StorageRegini.exe, Viewing and Changing the Registryregion blobs, Blobs, Handles, and Resourcesregions, mapping, Asynchronous OperationRegisterServiceCtrlHandler function, Service Applicationsregistry, Security, Security, Differences Between Client and Server Versions, Differences Between Client and Server Versions, Differences Between Client and Server Versions, Environment Subsystems and Subsystem DLLs, Session Manager (Smss), Registry Redirection, Registry Redirection, Management Mechanisms, Management Mechanisms, Management Mechanisms, Management Mechanisms, Viewing and Changing the Registry, Registry Usage, Registry Usage, Registry Usage, Registry Usage, Registry Usage, Registry Data Types, Registry Data Types, Registry Data Types, Registry Logical Structure, HKEY_USERS, HKEY_USERS, HKEY_USERS, HKEY_LOCAL_MACHINE, HKEY_LOCAL_MACHINE, HKEY_PERFORMANCE_DATA, HKEY_PERFORMANCE_DATA, HKEY_PERFORMANCE_DATA, Transactional Registry (TxR), Transactional Registry (TxR), Process Monitor Internals, Process Monitor Internals, Process Monitor Internals, Process Monitor Internals, Process Monitor Troubleshooting Techniques, Logging Activity in Unprivileged Accounts or During Logon/Logoff, Logging Activity in Unprivileged Accounts or During Logon/Logoff, Logging Activity in Unprivileged Accounts or During Logon/Logoff, Hive Size Limits, Hive Structure, Hive Structure, Stable Storage, Stable Storage, Registry Filtering, Services, Service Applications, Startup Errors, Startup Errors, Variable Quantums, Distributed Fair Share Scheduling, Global Audit Policy, File Virtualization, Requesting Administrative Rights, AppLockeractivity, montoring, Transactional Registry (TxR)applications settings, locating, Process Monitor InternalsAppLocker rules, AppLockerblocks, Hive Structurebuffer overflows, Process Monitor Troubleshooting Techniquescompacting, Hive Structureconfiguration data in, Registry Redirectionconfiguration manager management, Logging Activity in Unprivileged Accounts or During Logon/LogoffCurrentControlSet key, Startup Errorsdata types, Registry Usageediting, Management MechanismsEnableCpuQuota value, Distributed Fair Share Schedulingerror recovery, HKEY_PERFORMANCE_DATAfiltering, Stable Storageflushes, Stable Storageglobal audit policy, Global Audit Policyhives, Logging Activity in Unprivileged Accounts or During Logon/Logoff(see also hives, registry)HKEY_CLASSES_ROOT, HKEY_USERSHKEY_CURRENT_CONFIG, HKEY_LOCAL_MACHINEHKEY_CURRENT_USER, Registry Logical StructureHKEY_LOCAL_MACHINE, HKEY_USERSHKEY_PERFORMANCE_DATA, HKEY_PERFORMANCE_DATAHKEY_USERS, HKEY_USERSidle system activity, viewing, Process Monitor Internalsinitialization, Session Manager (Smss)internals, Logging Activity in Unprivileged Accounts or During Logon/Logoffkeys, Registry Usagelast known good configuration, HKEY_LOCAL_MACHINE, Startup Errorslinks, Registry Data Typeslogical structure, Registry Data Typesmissing keys or values, Process Monitor Internalsmodification, Registry Usagenaming scheme, Registry UsageNative and Wow64 portions, Registry Redirectionperformance counters, accessing, Securityperformance optimizations, Registry Filteringpermanent changes, Transactional Registry (TxR)ProductPolicy value, Differences Between Client and Server VersionsProductSuite value, Differences Between Client and Server VersionsProductType value, Differences Between Client and Server Versionsquantum settings, Variable Quantumsroot keys, Registry Data TypesServices key, Services, Service Applicationssubsystem startup information, Environment Subsystems and Subsystem DLLssymbolic links, Hive Size Limitstools for editing, Management Mechanismstransactional, HKEY_PERFORMANCE_DATAtroubleshooting problems, Process Monitor Internalsusage, Viewing and Changing the Registryvalues, Registry Usageviewing, Management Mechanismsvirtualization, File Virtualization, Requesting Administrative RightsRegistry Editor, HKEY_LOCAL_MACHINEregistry filter notifications, Kernel Patch Protectionregistry namespace, Object Methods, File System and Registry Virtualizationvirtualization, File System and Registry VirtualizationRegOpenKeyTransacted API, HKEY_PERFORMANCE_DATA.regtrans-ms extension, Transactional Registry (TxR)REG_BINARY values, Registry UsageREG_DWORD values, Registry UsageREG_LINK values, Registry Data TypesREG_SZ values, Registry Usagerelative identifiers (RIDs), Access Checksrelative timers, Timer Expirationreliability, Requirements and Design Goalsrelocation, Import ParsingRemediation Servers, Network Access Protectionremote access, Bindingremote authentication, User Logon Stepsremote clients, network connectivity, Direct Accessremote desktop connections, Kernel Mode vs. User Moderemote editing of BCD, HKEY_LOCAL_MACHINEremote file systems, Multiple UNC Provider, Surrogate Providers, Mini-Redirectorsaccessing, Multiple UNC Provider, Mini-Redirectorscaching, Surrogate Providersremote files, Mini-Redirectors, Offline Filescaching on local machine, Offline Filesrequests for, Mini-RedirectorsRemote NDIS, Connection-Oriented NDISremote performance monitoring, HKEY_PERFORMANCE_DATAremote procedure call (RPC), WSK Implementation (see RPC (remote procedure call))remote resources, accessing, Multiple Provider Router, Surrogate Providersremoting, Kernel Mode vs. User Modereplay protection, Internet Protocol Securityreplication, Distributed File System Namespace, Distributed File System Namespace, Distributed File System Namespacebenefits, Distributed File System Namespacemultimaster, Distributed File System Namespacetopologies, Distributed File System Namespacereplication groups, Distributed File System Namespacerepublication cache, Caching ModesRequiredPrivileges parameter, Service Applications, Running with Least Privilegereserve blobs, Blobs, Handles, and Resourcesreserve objects, Reserve Objectsresource accounting, Object Retentionresource exhaustion prevention, Diagnostic Functionalityresource management, Using Tools to Interact with PriorityResource Manager (RM), Kernel Transaction Manager, Transactional Registry (TxR)registry, Transactional Registry (TxR)Resource Manager SID, Security IdentifiersResource Monitor, Performance Monitor, Object Handles and the Process Handle Tableobject handles, viewing, Object Handles and the Process Handle Tableresources, displaying, Performance Monitorresources, Object Filtering, Running with Least Privilege, Service Isolation, UPnP with PnP-X, Multiple Provider Router, Surrogate Providersmutual exclusion and, Object Filteringpermissions, setting, Service Isolationremote, Multiple Provider Router, Surrogate Providersservice access to, Running with Least PrivilegeUNC name access, UPnP with PnP-Xresponsiveness, Priority Boosts, Lock Ownership Boosts, Priority Boosts for Foreground Threads After Waits, Priority Boosts for Foreground Threads After Waitsimproving, Priority Boosts, Priority Boosts for Foreground Threads After Waits, Priority Boosts for Foreground Threads After Waitsthread priority boosts and, Lock Ownership Boostsrestore files and directories privilege, Super Privilegesrestricted service SIDs, Service Isolationrestricted tokens, Tokens, Impersonationretail build, Checked BuildRichter, Jeffrey, Windows Operating System Versions, Windows API, Timer Coalescing, What Signals an Object?RIDs (relative identifiers), Access Checks, Security Identifiersviewing, Security Identifiersrings 0 through 3, Kernel Mode vs. User ModeRM (Resource Manager), Kernel Transaction Managerroaming profiles, HKEY_USERS, File Virtualizationregistry values, HKEY_USERSvirtualized files and, File Virtualizationrobustness, Requirements and Design Goalsroot keys, registry, Registry Data Typesroot \Sessions directory, Session Manager (Smss)routers, The OSI Reference Model, Protocol Driverscongestion, Protocol Driversrouting functions, The OSI Reference Modelrouting modes, Hardware Interrupt ProcessingRPC (remote procedure call), WSK Implementation, WSK Implementation, RPC Operation, RPC Operation, RPC Operation, RPC Operation, RPC Operation, RPC Implementation, RPC Implementation, RPC Implementationasynchronous, RPC Operationimplementation, RPC Implementationlocal and remote execution, RPC Operation, RPC Implementationoperation, WSK Implementationsecurity, RPC Operationserver name publishing, RPC Operationsubsystem, RPC Implementationunencrypted, RPC OperationRpcImpersonateClient function, Impersonation, RPC OperationRPCSS, RPC ImplementationRTC (Real Time Clock), Asynchronous Procedure Call InterruptsRtlUserThreadStart, Stage 7: Performing Process Initialization in the Context of the New ProcessRtlVerifyVersionInfo function, Differences Between Client and Server VersionsRun As Administrator command, Running with Administrator Rightsrun-once initialization (InitOnce), Low-IRQL Synchronization, Run Once Initializationrun-time patching, Image LoaderRunas command, HKEY_USERS, Process Monitor Troubleshooting Techniques, Running with Administrator Rightsrunning threads, Thread Statesruntime compatibility mitigations, Image LoaderRussinovich, Mark, Windows Driver Kit