Windows® Internals, Sixth Edition, Part 1

SSACLs, Security Descriptors and Access Control, Security Descriptors and Access Control, Security Descriptors and Access Controlassigning, Security Descriptors and Access Controlsafe DLL search mode, Early Process Initializationsafe mode, Service Startup, Service Startupregistry keys, Service StartupSAM (Security Accounts Manager), Security System Components, Security System Componentssecurity descriptors, Security System ComponentsSAM APIs, Remote AccessSAM database, Security System ComponentsSAPICs (Streamlined Advanced Programmable Interrupt Controllers), Hardware Interrupt ProcessingSAS (secure attention sequence), Trusted Computer System Evaluation Criteria, Winlogon Initialization, Winlogon Initializationimplementation, Winlogon Initializationlogon startup, Winlogon InitializationSAs (security associations), Internet Protocol Securitysc command, Consumer RegistrationSc tool, virtual service account creation, Virtual Service Accountsscalability, Symmetric Multiprocessingscatter-gather, Networking APIsScAutoStartServices function, The Service Control ManagerScGenerateServiceDB function, Interactive Services and Session 0 IsolationScGenerateServiceTag function, Shared Service ProcessesScGetBootAndSystemDriverState function, The Service Control ManagerSChannel, RPC OperationScheduled Tasks service, Provider Registrationscheduling, Thread Scheduling, Thread Scheduling, Choosing a Processor for a Thread When There Are No Idle Processorsprocessor share-based, Choosing a Processor for a Thread When There Are No Idle Processorsthread, Thread SchedulingWindows system, Thread Schedulingscheduling events, System Processes, Boosts Due to Scheduler/Dispatcher Eventsthread priority boosts, Boosts Due to Scheduler/Dispatcher Eventsscheduling priorities, thread, Software Interrupt Request Levels (IRQLs)(see also priority levels)ScInitDelayStart function, Service StartupScLogonAndStartImage function, Service StartupSCM (Service Control Manager), Session Manager (Smss), Services, Service Applications, Service Applications, Service Applications, Service Applications, Running with Least Privilege, Service Isolation, Interactive Services and Session 0 Isolation, Interactive Services and Session 0 Isolation, Interactive Services and Session 0 Isolation, Interactive Services and Session 0 Isolation, Interactive Services and Session 0 Isolation, The Service Control Manager, Service Startup, Service Startup, Startup Errors, Accepting the Boot and Last Known Good, Service Shutdown, Shared Service Processes, Initializationboot-verification program startup, Accepting the Boot and Last Known Goodcommands, Service Applicationsinternal service database, Interactive Services and Session 0 Isolationlast known good control set, Startup Errorsnamed pipe creation, Service Startupnetwork drive letter tracking, The Service Control Managerservice characteristics, Service Applicationsservice database, Interactive Services and Session 0 Isolationservice deletion, Service Applicationsservice entry and group order lists, Interactive Services and Session 0 Isolationservice privileges, accounting, Running with Least Privilegeservice registry key creation, Servicesservice SID generation, Service Isolationservice-start command, Service Applications, Service Startupshutdown routine, Service Shutdownstartup, Interactive Services and Session 0 IsolationSvcHost process launch, Shared Service ProcessesUBPM initialization, InitializationSCM Extension DLL (Scext.dll), Service Tagsscopes, Offline Filesscript execution, controlling, Software Restriction Policiesscripting API, WMI Architecturescripts, Class AssociationScStartService function, Service StartupScTagQuery (Winsider Seminars & Solutions Inc.), Shared Service ProcessesSDDL (Security Descriptor Definition Language), The AuthZ APISeAccessCheck function, Access ChecksSeAuditPrivilege, Security Auditingsecond-chance notification, Exception DispatchingSecond-Level Address Translation (SLAT), Memory Virtualizationsection blobs, Blobs, Handles, and Resourcessection objects, Executive Objects, Asynchronous Operation, API Sets, Stage 1: Converting and Validating Parameters and Flagsmapping to API Sets, API Setssecure attention sequence (SAS), Trusted Computer System Evaluation Criteria (see SAS (secure attention sequence))Secure Socket Transmission Protocol (SSTP), Remote Accesssecurity, Objects and Handles, Security, Windows Subsystem, Reserve Objects, Object Directories, Asynchronous Operation, Asynchronous Operation, HKEY_LOCAL_MACHINE, Registry Filtering, Service Applications, The Local System Account, Running with Least Privilege, Interactive Services and Session 0 Isolation, WMI Implementation, WMI Implementation, Protected Processes, Job Limits, Impersonation, Determining Access, Super Privileges, RPC Operation, BranchCache, Network Address Translation(see also security mechanisms)access control, Securityconsole processes, Windows Subsystemdebugger-based attacks, Protected Processesfor namespaces, WMI ImplementationIPsec, Network Address Translationjob object limits, Job Limitslocal system account characteristics, The Local System Accountobject, Reserve Objectsobject name squatting, Object Directoriesof cache content, BranchCacheof registry keys, Registry Filteringof RPC, RPC Operationprivilege exploitation, Super Privilegesregions and, Asynchronous Operationsection objects and, Asynchronous Operationservice isolation, Running with Least Privilegeservice security contexts, Service Applicationsshatter attack prevention, Interactive Services and Session 0 Isolation, Determining Accessspoofing prevention, Impersonationsystemwide policies in registry, HKEY_LOCAL_MACHINEWMI, WMI ImplementationSecurity Accounts Manager (SAM), Security System Components, Security System Componentssecurity associations (SAs), Internet Protocol Securitysecurity attribute, Views, Regions, and Sectionssecurity auditing, Security, Trusted Computer System Evaluation Criteria, Security Auditing, Security Auditing, Global Audit Policyglobal audit policy, Global Audit Policyobject access auditing, Security Auditingsecurity blobs, Blobs, Handles, and Resourcessecurity boundaries, Registry Virtualizationsecurity checks, Determining Accesssecurity components, Security System Components, Controlling UAC Behaviorapplication identification, Controlling UAC Behaviorcommunication paths, Security System Componentssecurity contexts, Processes, Threads, and Jobs, Security, Tokensidentifying, Tokensprocess, Processes, Threads, and Jobsuser, Securitysecurity credentials, user, Securitysecurity descriptors, Examining Thread Activity, Security Descriptors and Access Control, Security Descriptors and Access Control, Security Descriptors and Access Control, Security Descriptors and Access Controlattributes, Security Descriptors and Access Controlflags, Security Descriptors and Access Controlthread, Examining Thread Activityviewing, Security Descriptors and Access Controlsecurity identifiers (SIDs), Access Checks (see SIDs (security identifiers))security mechanisms, Blobs, Handles, and Resources, Security, Security, Security System Components, Protecting Objects, Protecting Objects, Protecting Objects, Determining Access, Conditional ACEs, Conditional ACEs, Super Privileges, Logon, User Account Control and Virtualization, Controlling UAC Behavior, AppLocker, Software Restriction Policiesaccess checks, Protecting Objectsaccess logging, Protecting Objectsaccess tokens, Super Privilegesaccount rights, Conditional ACEsALPC mechanisms, Blobs, Handles, and ResourcesAppID, Controlling UAC BehaviorAppLocker, AppLockerAuthZ Windows API, Determining Accesscore components, Security System Componentslogon, Logonobject protection, Protecting Objectsprivileges, Conditional ACEsratings, SecuritySoftware Restriction Policies, Software Restriction PoliciesUAC, User Account Control and Virtualizationsecurity method, Object MethodsSecurity parameter, Service Applicationssecurity policy, Security AuditingSecurity Policy MMC snap-in, AppLocker management, AppLockersecurity quality of service (SQOS), Impersonationsecurity ratings, Security, Trusted Computer System Evaluation CriteriaCommon Criteria for Information Technology Security Evaluation, Trusted Computer System Evaluation CriteriaTrusted Computer System Evaluation Criteria, Securitysecurity reference monitor (SRM), Executive, Reserve Objects, Security System Componentsaccess rights checking, Reserve Objectssecurity routine, Type Objectssecurity support providers (SSPs), RPC OperationSecurity Target (ST), Trusted Computer System Evaluation Criteriasecurity tokens, Processes, Threads, and Jobssecurity validation of impersonating threads, Protecting ObjectsSelf-Monitoring Analysis and Reporting Technology (SMART) code, Diagnostic Functionalitysemaphore object type, Executive Objectssemaphores, Executive Objects, Executive Objects, Object Directories, What Signals an Object?, Keyed Events, Fast Mutexes and Guarded Mutexes, User-Mode Resources, Access Checksdefault security, Access ChecksETHREAD, Keyed Eventsfor shared resources, User-Mode Resourcesfor shared waiters, Fast Mutexes and Guarded Mutexesobject directory, Object Directoriessignaled state, What Signals an Object?SeNotifyPrivilege, Privilegesserver communication ports, Connection Modelserver connection ports, Connection ModelServer Message Block (SMB), Mini-Redirectors (see SMB (Server Message Block))server name publishing, RPC Operationserver operating system versions vs. client versions, Scalabilityservers, Dispatcher Database, Dynamic Processor Addition and Replacement, Impersonation, Winsock Server Operation, Winsock Extensions, RPC Operation, Distributed File System Namespace, Distributed File System Namespace, Distributed File System Namespace, Network Access Protectionaccept operations, queuing, Winsock Server OperationCPU addition and replacement, Dynamic Processor Addition and Replacementfile-system change replication, Distributed File System Namespace, Distributed File System Namespaceimpersonation, Impersonationprincipal names, RPC Operationquantum length, Dispatcher DatabaseRemediation Servers, Network Access Protectionreplication groups, Distributed File System Namespacewell-known addresses, Winsock Extensionsservice applications, Services, ServicesSCPs, ServicesService Control (Sc.exe), Running with Least PrivilegeService Control Manager (SCM), Session Manager (Smss)service control programs, Consumer Registrationservice groupNetworkService-NetworkRestricted, Shared Service Processesservice hardening, Determining AccessService Host (SvcHost), services running in, Service Shutdownservice logon SIDs, Service Isolationservice processes, Architecture Overview, Session Manager (Smss), Service Control Manager (SCM), Service Control Manager (SCM)management, Session Manager (Smss)service details, viewing, Service Control Manager (SCM)services in, mapping, Service Control Manager (SCM)service provider interface (SPI), Winsock Extensionsservice tags, Shared Service ProcessesService-0x0-3e7$ window station, Service Isolationservices, Session Manager (Smss), Session Manager (Smss), Service Control Manager (SCM), Services, Services, Services, Services, Services, Services, Service Applications, Service Applications, Service Applications, Service Applications, Service Applications, Service Applications, Service Applications, Service Applications, The Local System Account, The Local System Account, The Local Service Account, The Local Service Account, The Local Service Account, The Local Service Account, Running with Least Privilege, Running with Least Privilege, Running with Least Privilege, Service Isolation, Service Isolation, Service Isolation, Interactive Services and Session 0 Isolation, Interactive Services and Session 0 Isolation, Interactive Services and Session 0 Isolation, Interactive Services and Session 0 Isolation, Interactive Services and Session 0 Isolation, The Service Control Manager, The Service Control Manager, Service Startup, Service Startup, Service Startup, Service Startup, Service Startup, Service Startup, Service Startup, Service Startup, Service Startup, Service Startup, Service Failures, Service Failures, Service Shutdown, Service Shutdown, Service Shutdown, Service Shutdown, Shared Service Processes, Shared Service Processes, Shared Service Processes, Consumer Registration, Service Control Programs, Winsock Extensions, Background Intelligent Transfer Service(see also Windows services)account settings, The Local Service Accountalternate accounts, running in, The Local Service Accountauthenticating to other machines, The Local System Account, The Local System Accountauto-start, Services, Interactive Services and Session 0 Isolation, The Service Control ManagerChange Notify privilege, Running with Least Privilegecharacteristics, Service Applicationsdelayed auto-start, Service Startup, Service Startupdependencies, Service Startupentry points, Service ApplicationsFailureActions and FailureCommand values, Service Failuresfailures, Service Failuresgroup startup ordering, Interactive Services and Session 0 Isolation, Service Startupgroupings, Shared Service ProcessesImagePath value, Service Startupinitializing, Service Applicationsinteractive, Interactive Services and Session 0 Isolation, Service Startupisolation, Running with Least Privilegeleast privilege, running with, The Local Service Accountlisting, Service Control Manager (SCM)local system account, running in, Service Applicationslogon information, Service Startupmain thread, Service Applicationsnames, Session Manager (Smss)ObjectName value, Service StartupParameters subkey, Service Applicationspeer-to-peer support, Background Intelligent Transfer Serviceprivileges, specifying, The Local Service Accountprivileges, viewing, Running with Least Privilegeprocess, launching, Service Startupregistering, Servicesrunning in processes, viewing, Shared Service Processessecurity context, Service Applicationssecurity descriptors, Service Control Programsservice applications, ServicesService Control Manager, Interactive Services and Session 0 Isolationservice SIDs, Service Isolationservice tags, Shared Service ProcessesServices key, ServicesSession Zero Isolation, Service Isolationshared processes, Service Shutdownshutdown, Service Shutdownshutdown notifications, Service Shutdownshutdown order, Service Shutdownstartup, Session Manager (Smss), Services, The Service Control Managerstartup errors, Service Startupstatus messages, Service Applicationstriggers, Consumer Registrationuser notifications, Interactive Services and Session 0 Isolationwell-known addresses, Winsock Extensionswindow stations, Service IsolationServices key, Services, Service ApplicationsServices MMC snap-in, Service Control ProgramsServiceSidType parameter, Service ApplicationsSeSecurityPrivilege, Security Auditingsession create requests, Session Manager (Smss)session layer in OSI reference model, The OSI Reference Modelsession manager (Smss), Environment Subsystems and Subsystem DLLs, Session Manager (Smss)session namespace, Object Directories, Session Namespaceinstancing, viewing, Session NamespaceSession Zero Isolation, Service Isolationsessions, Kernel Mode vs. User Mode, Terminal Services and Multiple Sessions, Per-Session CPU Quota Blocks, DFSS Idle-Only Queue Scheduling, User Logon Steps, NetBIOSaccounting information, Per-Session CPU Quota Blocksactive logon, listing, User Logon Stepsdisconnecting, Terminal Services and Multiple Sessionsmultiple, Kernel Mode vs. User ModeNetBIOS, NetBIOSsession weight, DFSS Idle-Only Queue SchedulingSet API, DFSS Idle-Only Queue SchedulingSetInformationJobObject function, AffinitySetPriorityClass function, Priority LevelsSetProcessAffinityMask function, AffinitySetProcessWorkingSetSizeEx function, Using Tools to Interact with PrioritySetServiceStatus function, Service ApplicationsSetThreadAffinityMask function, Affinitysetup programs, virtualization, Stage 5: Performing Windows Subsystem–Specific Post-InitializationSetWindowsHook function, Winlogon Initializationshadow page tables (SPTs), Memory Virtualizationshared access, executive resources for, Fast Mutexes and Guarded Mutexesshared memory, Processes, Threads, and Jobs, Asynchronous Operation, Asynchronous Operationcommunication, Asynchronous Operationregions, Asynchronous Operationsections, Processes, Threads, and Jobsshared processes, Service Shutdown, Service Shutdownof services, Service Shutdownshatter attacks, Interactive Services and Session 0 Isolation, Determining AccessShellExecute API, Running with Administrator Rightsshifting, Timer Coalescingshims, Image Loader, Stage 5: Performing Windows Subsystem–Specific Post-Initialization, File System and Registry Virtualization, Windows Filtering Platformapplication-compatibility, File System and Registry Virtualizationelevation, Stage 5: Performing Windows Subsystem–Specific Post-Initializationshutdown, Service Shutdown, Service Shutdown, Service Shutdown, Diagnostic Functionalitynotifications, Service Shutdownordering, Service Shutdownperformance diagnostics, Diagnostic Functionalityservices, Service Shutdownside-by-side assemblies, Stage 5: Performing Windows Subsystem–Specific Post-Initialization, Birth of a Threadside-by-side redirection, DLL Name RedirectionSIDs (security identifiers), Service Isolation, Service Isolation, Access Checks, Access Checks, Security Identifiers, Security Identifiers, Security Identifiers, Security Identifiers, Integrity Levels, Determining Access, Winlogon Initializationassignment, Security Identifiersfirewall rules and, Service Isolationintegrity level, Integrity Levelslist of, Security Identifierslocal logon, Winlogon InitializationOwner Rights, Determining Accessstructure, Security Identifierstypes, Service Isolationvalues in, Access Checksviewing, Security IdentifiersSigcheck, viewing application manifests with, Requesting Administrative Rightssignaled state, defining, Waiting for Dispatcher Objectssigned files, Application Identification (AppID)silent process death, Windows Error Reporting, Windows Error Reportingsolving, Windows Error Reportingsimple problem scenarios, Windows Diagnostic Infrastructuresingle instancing, Object DirectoriesSIPolicy tool, Differences Between Client and Server VersionsSLAT (Second-Level Address Translation), Memory VirtualizationSleep API, Ideal and Last ProcessorSleepConditionVariableSRW API, Condition VariablesSlim Reader-Writer Locks (SRW Locks), Low-IRQL Synchronization, User-Mode Resourcesslow-link latency threshold, Caching Modessmartcard authentication, User Logon StepsSMB (Server Message Block), Mini-Redirectors, Server Message Block and Sub-Redirectors, BranchCache, Configuration, Configurationbackward compatibility, Server Message Block and Sub-RedirectorsBranchCache application retrieval sequence, ConfigurationBranchCache integration, ConfigurationBranchCache use, BranchCacheSMB 2.0, Mini-RedirectorsSMB 2.1, Server Message Block and Sub-Redirectors, ConfigurationSMB mini-redirector, Mini-Redirectors, Server Message Block and Sub-RedirectorsSMB WNet provider, Multiple Provider RouterSmith, Guy, Windows Driver KitSMP (symmetric multiprocessing), PortabilitySmss (session manager), Environment Subsystems and Subsystem DLLs, Session Manager (Smss), Session Manager (Smss), Session Manager (Smss)initialization steps, Session Manager (Smss)session startup instance, Session Manager (Smss)subsystem startup, Environment Subsystems and Subsystem DLLsSMT sets, Thread Selectionsockets, Networking APIs, Windows Sockets, Windows Sockets, WSK Implementation, WSK Implementationcategories, WSK Implementationclient connections to, Windows Socketsextension interfaces, WSK Implementationlisten operations, Windows SocketsWindows support, Networking APIssoftware, Differences Between Client and Server Versions, Trap Dispatching, Trap Dispatching, IA64 Interrupt Controllers, Software Interrupt Request Levels (IRQLs), Running with Administrator Rights, The OSI Reference Model(see also applications)exceptions and interrupts, Trap Dispatchingin OSI reference model, The OSI Reference Modelinterrupt request levels, IA64 Interrupt Controllersinterrupts, Trap Dispatching, Software Interrupt Request Levels (IRQLs)licensing, Differences Between Client and Server VersionsSoftware Restriction Policies (SRP), Stage 5: Performing Windows Subsystem–Specific Post-Initialization (see SRP (Software Restriction Policies))special boot menu, Service StartupSPI (service provider interface), Winsock Extensionsspinlocks, Spinlocks, Spinlocks, Spinlocks, Queued Spinlocks, Queued Spinlocks, Queued Spinlocks, Instack Queued Spinlocks, Instack Queued Spinlocks, Low-IRQL Synchronizationfor interlocked functions, Instack Queued Spinlocksglobal, Queued Spinlocksimplementation, Spinlocksinstack queued, Instack Queued Spinlockskernel-mode, Spinlocksqueued, Queued Spinlocksrestrictions on, Low-IRQL Synchronizationviewing, Queued SpinlocksSpinstall.exe, auto-elevation, Auto-Elevationspoofing prevention, ImpersonationSPTs (shadow page tables), Memory VirtualizationSQOS (security quality of service), Impersonationsquatting attacks, Object DirectoriesSRM (security reference monitor), Executive, Security System Components, Security System Components, Access Checks, Security Auditingaudit policy, passing, Security AuditingLSASS connection, Security System Componentssecurity model equation, Access ChecksSRP (Software Restriction Policies), Stage 5: Performing Windows Subsystem–Specific Post-Initialization, AppLocker, AppLocker, Software Restriction Policiesenforcement, Software Restriction PoliciesSRW Locks, User-Mode ResourcesSSPs (security support providers), RPC OperationSSTP (Secure Socket Transmission Protocol), Remote Accessstack frames, exception handlers, Exception Dispatchingstack traces, Object Retentionstack, thread, Examining Thread Activitystandard user rights, User Account Control and Virtualization, User Account Control and Virtualization, Running with Administrator Rights, Running with Administrator Rightsapplication execution with, User Account Control and Virtualizationelevation, Running with Administrator Rightsrunning as administrative rights, Running with Administrator Rightsstandard user tokens, Tokensstandby threads, Using Tools to Interact with Priority, Thread Selection, Choosing a Processor for a Thread When There Are Idle Processorsstandby/resume performance diagnostics, Diagnostic FunctionalityStart parameter, Service Applicationsstart-of-thread function, Exception Dispatchingstart-stop problem scenarios, Windows Diagnostic InfrastructureStartService function, ServicesStartServiceCtrlDispatcher function, Service Applicationsstartup, The Service Control Manager, Service Startup, Service Startup, Startup Errors, Diagnostic Functionality(see also boot process)errors, Service Startup, Startup Errorsrepair tool, Diagnostic Functionalityservices, The Service Control ManagerStartup Programs Viewer, Digging into Windows Internalsstations, The OSI Reference Model, The OSI Reference Modelpoint-to-point communications between, The OSI Reference ModelStreamlined Advanced Programmable Interrupt Controllers (SAPICs), Hardware Interrupt Processingstride value, Ideal and Last ProcessorStrings, dumping API Set table with, API Setsstructured exception handling, Timer Coalescingstub procedures, RPC Operation, RPC Operationgenerating, RPC OperationSUA (Subsystem for UNIX-based Applications), Subsystem for Unix-based Applicationssub-DLLs, SwitchBacksubkeys, registry, Registry Usage, Transactional Registry (TxR)(see also keys, registry)transacted deletion, Transactional Registry (TxR)subsystem DLLs, Architecture Overview, Environment Subsystems and Subsystem DLLs, User-Mode Debugginguser-mode debugging APIs, User-Mode DebuggingSubsystem for UNIX-based Applications (SUA), Subsystem for Unix-based Applications, Executive Objectsexecutive objects, Executive Objectssubsystem processes, creation, Session Manager (Smss)subsystems, Environment Subsystems and Subsystem DLLs, Subsystem Startup, Subsystem for Unix-based Applications, Subsystem for Unix-based Applications, Subsystem for Unix-based Applications, Data Structures, RPC ImplementationGDI, Data Structuresinternal support functions, Subsystem for Unix-based ApplicationsPOSIX, Subsystem for Unix-based ApplicationsRPC, RPC Implementationstartup, Environment Subsystems and Subsystem DLLsSubsystem for UNIX-based Applications, Subsystem for Unix-based ApplicationsWindows, Subsystem StartupSunRPC, WSK ImplementationSuperfetch, Executivesurrogate providers, Multiple UNC Provider, Surrogate ProvidersSvcCtrlMain function, Interactive Services and Session 0 IsolationSvchost.exe, Processes, Threads, and JobsSwitchBack, Post-Import Process Initialization, SwitchBackinvoking, SwitchBackSwitchBranch mechanism, Image LoaderSwitchToFiber function, Processes, Threads, and JobsSwitchToThread() call, Ideal and Last Processorsymbol files, Kernel Debuggingsymbol server, Processes, Threads, and Jobs, Kernel Debuggingconfiguring, Processes, Threads, and Jobsloading symbols from, Kernel Debuggingsymbolic link objects, Object Directoriessymbolic links, Object Directories, Hive Size Limits, Server Message Block and Sub-Redirectorsregistry, Hive Size LimitsSMB support, Server Message Block and Sub-Redirectorssymmetric multiprocessing (SMP), Portability, Synchronizationmutual exclusion, SynchronizationSync Center control panel interface, Offline Filessynchronization, Type Objects, Object Filtering, Synchronization, Synchronization, Low-IRQL Synchronization, Low-IRQL Synchronization, Low-IRQL Synchronization, Low-IRQL Synchronization, What Signals an Object?, Keyed Events, Fast Mutexes and Guarded Mutexes, Executive Resources, Pushlocks, Pushlocks, Pushlocks, User-Mode Resources, Condition Variables, Run Once Initialization, Dispatcher Databasecondition variables, User-Mode Resourcescritical sections, Pushlocksdata structures, What Signals an Object?deadlocks, Pushlocksdispatcher objects, Low-IRQL Synchronizationexecutive resources, Low-IRQL Synchronization, Fast Mutexes and Guarded Mutexeshigh-IRQL, Synchronizationinterlocked operations, Synchronizationkernel mechanisms, Low-IRQL Synchronizationlow-IRQL, Low-IRQL Synchronizationmutexes, Keyed Eventsobject support of, Type Objectsof dispatcher database, Dispatcher Databasepushlocks, Executive Resourcesrun once initialization, Run Once Initializationscalable, pointer-size, Condition Variablesuser-mode objects, Pushlockssynchronization interrupt level, Software Interrupt Request Levels (IRQLs)synchronization objects, Low-IRQL Synchronization, Low-IRQL Synchronization, Waiting for Dispatcher Objects, Data Structuresexecutive resources, Low-IRQL Synchronizationkeyed events, Data Structuresrules of behavior, Waiting for Dispatcher Objectsstate, Low-IRQL Synchronizationsynchronous event exceptions, Trap Dispatchingsynchronous execution, Run Once Initializationsynthetic devices, Emulated Devicessysenter instruction, System Service DispatchingSysinternals Site Blog, Windows Driver KitSysinternals tools, Windows Driver Kitsystem, Debugging Tools for Windows, System Architecture, Architecture Overview, Symmetric Multiprocessing, Checked Build, Trap Dispatching, Software Interrupt Request Levels (IRQLs), System Worker Threads, Registry Usage, HKEY_USERS, HKEY_LOCAL_MACHINE, Process Monitor Internals, Diagnostic Functionality, Stage 2: Opening the Image to Be Executed, Extended Affinity Mask, AppLocker, Network Access Protection(see also operating systems; system mechanisms; Windows operating system)affinity mask, Extended Affinity Maskarchitecture, System Architecture (see system architecture)configuration, HKEY_USERSconnecting live, Debugging Tools for Windowscrashes, Software Interrupt Request Levels (IRQLs)global flags, System Worker Threadshealth policies, Network Access Protectionidle, Process Monitor Internalsinitialization, Stage 2: Opening the Image to Be Executed (see system initialization)license policy file, Symmetric Multiprocessinglockdown, AppLockerregistry settings, Registry Usageresponsiveness performance diagnostics, Diagnostic Functionalitysecurity policies, HKEY_LOCAL_MACHINEservice calls, Trap Dispatchingsupport processes, Architecture OverviewSystem account security settings, HKEY_LOCAL_MACHINEsystem address space, Processes, Threads, and Jobs, Stage 7: Performing Process Initialization in the Context of the New Processdata structures in, Processes, Threads, and JobsETHREAD and other structures in, Stage 7: Performing Process Initialization in the Context of the New Processsystem architecture, System Architecture, System Architecture, Operating System Model, Architecture Overview, Portability, Symmetric Multiprocessing, Scalability, Checked Build, Key System Components, Environment Subsystems and Subsystem DLLs, Subsystem for Unix-based Applications, Ntdll.dll, Executive, Hardware Support, Device Drivers, System Processesclient vs. server versions, Scalabilitydevice drivers, Device Driversdiagram, Key System Componentsenvironment subsystem, Environment Subsystems and Subsystem DLLshardware abstraction layer, Hardware Supportkernel, Executivekey system components, Checked BuildNtdll.dll, Subsystem for Unix-based Applicationsoverview, Operating System Modelportability features, Architecture Overviewrequirements and design goals, System Architecturescalability features, Symmetric Multiprocessingsymmetric multiprocessing capabilities, Portabilitysystem processes, System ProcessesWindows executive, Ntdll.dllsystem call table, System Service Dispatching, System Service Dispatching, Service Descriptor Tablescompaction, System Service Dispatchingsystem calls, Windows API, System Service Dispatching, System Service Dispatching, System Service Dispatching, System Service Dispatching, Service Descriptor Tables, Wow64 Process Address Space Layoutdefined, Windows APIexported, System Service Dispatchingfrom 32-bit systems, System Service Dispatchingfrom 64-bit systems, System Service Dispatchingfrom kernel-mode code, System Service Dispatchingfunctions and arguments, mapping to, Service Descriptor Tablesin Wow64, Wow64 Process Address Space LayoutSystem Calls/Sec performance counter, Service Descriptor Tablessystem clock, Hardware Interrupt Processing, Asynchronous Procedure Call Interrupts, Asynchronous Procedure Call Interrupts, Timer Processing, Per-Session CPU Quota Blocks(see also clock cycles; clock intervals)interval timer, Asynchronous Procedure Call Interruptsmaintenance of, Asynchronous Procedure Call Interruptsrestoring default value, Timer Processingupdating, Hardware Interrupt Processingsystem code and data protection, Kernel Mode vs. User Modesystem events, thread state changes, What Signals an Object?system files, restoring, Diagnostic FunctionalitySystem Health Agent (SHA), Network Access ProtectionSystem Health Validator (SHV), Network Access Protectionsystem idle process, System Processes, Idle Threadssystem images, undocumented interfaces, Windows Driver Foundationsystem initialization, Session Manager (Smss), Session Manager (Smss), Run Once Initialization, Stage 2: Opening the Image to Be Executed, Logonparent processes, Stage 2: Opening the Image to Be ExecutedSmss functions, Session Manager (Smss)system worker threads, Run Once InitializationWininit.exe functions, Session Manager (Smss)Winlogon initialization, Logonsystem mechanisms, System Mechanisms, Service Descriptor Tables, Object Filtering, Run Once Initialization, System Worker Threads, Windows Global Flags, Kernel Event Tracing, Wow64, User-Mode Debugging, Native Support, Hypervisor (Hyper-V), Live Migration, Kernel Transaction Manager, Hotpatch Support, Kernel Patch ProtectionAdvanced Local Procedure Call, Windows Global Flagscode integrity, Kernel Patch Protectionglobal flags, System Worker Threadshotpatch support, Kernel Transaction ManagerHypervisor, Hypervisor (Hyper-V)image loader, Native Supportkernel event tracing, Kernel Event TracingKernel Patch Protection, Hotpatch SupportKernel Transaction Manager, Live Migrationobject manager, Service Descriptor Tablessynchronization, Object Filteringsystem worker threads, Run Once Initializationtrap dispatching, System Mechanismsuser-mode debugging, User-Mode DebuggingWow64, Wow64system objects, integrity protection, Objects and Handlessystem physical address space (SPA space), Memory VirtualizationSystem process, System Processes, Object Handles and the Process Handle Table, Run Once Initialization, Protected Processes, Idle Threadshandles, Object Handles and the Process Handle Tableprotected mode, Protected Processessystem worker threads, Run Once Initializationsystem processes, System Processes, System Processes, System Processes, System Processes, Session Manager (Smss), Session Manager (Smss), Session Manager (Smss), Service Control Manager (SCM), Local Session Manager (Lsm.exe), Priority LevelsLocal Session Manager, Service Control Manager (SCM)priority level, Priority LevelsService Control Manager, Session Manager (Smss)Session Manager, Session Manager (Smss)system idle process, System ProcessesSystem process, System Processes (see System process)tree, viewing, System ProcessesWindows logon process, Local Session Manager (Lsm.exe)Wininit.exe process, Session Manager (Smss)system profile, HKEY_USERSsystem resources, Object Methods, Object Filtering(see also resources)handles to, Object MethodsSystem Service Descriptor Table (SSDT), Kernel Patch Protectionsystem service dispatcher, Windows Error Reporting, System Service Dispatching, System Service Dispatchinglocating, System Service Dispatchingsystem service tables, locating, System Service Dispatchingsystem service tables, System Service Dispatchingsystem services, Subsystem for Unix-based Applications, Ntdll.dll, Windows Error Reporting, System Service Dispatching, System Service Dispatching, Service Descriptor Tablesactivity, viewing, Service Descriptor Tablesdispatch stubs, Subsystem for Unix-based Applicationsdispatch table, System Service Dispatchingdispatching, Windows Error Reportingnumbers, System Service DispatchingSystem software interrupts, Trap Dispatchingsystem threads, Kernel Mode vs. User Mode, System Processes, System Process and System Threads, System Process and System Threads, Priority Levels, Priority Boosts After GUI Threads Wake Up(see also threads)balance set manager, Priority Boosts After GUI Threads Wake Updevice drivers, mapping to, System Process and System Threadsexecution, mapping, System Process and System Threadsmode usage, Kernel Mode vs. User Modepriority levels, Priority Levelssystem time, Dispatch or Deferred Procedure Call (DPC) Interrupts, Timer Expiration, Per-Session CPU Quota Blocks(see also clock cycles; system clock)keeping track of, Timer Expirationupdating, Dispatch or Deferred Procedure Call (DPC) Interruptssystem timers, Processor Selectionsystem traps, Trap Dispatchingsystem unresponsiveness, Dispatch or Deferred Procedure Call (DPC) Interrupts, Security(see also performance)DPCs and, Dispatch or Deferred Procedure Call (DPC) Interruptssystem worker threads, Run Once Initialization, Run Once Initialization, System Worker Threads, System Worker Threads, System Worker Threads(see also system threads; threads)dynamic, System Worker Threadslisting, System Worker Threadsnumber of, System Worker Threadstypes, Run Once Initializationsystem-start drivers, Interactive Services and Session 0 IsolationSystem.log, parsing and repairing, Stable Storagesystemwide cookies, Stage 7: Performing Process Initialization in the Context of the New Processsystemwide thread startup stub, Stage 7: Performing Process Initialization in the Context of the New Process