Windows

A Windows HANDLE is an opaque, per-process entry in that process's handle table referring to an object created by the NT object manager — a file, event, mutex, process, thread or registry key. A Unix file descriptor is a small integer naming a much narrower set of objects.

The Windows registry is the OS's hierarchical configuration database. HKLM holds machine-wide settings backed by hive files in %SystemRoot%\System32\config; HKCU holds the currently logged-on user's settings, backed by NTUSER.DAT inside that user's profile folder.

Windows NT layers user mode — applications, subsystem DLLs such as kernel32.dll, and ntdll.dll — over kernel mode, where ntoskrnl.exe holds the executive managers (I/O, memory, process, security), the kernel layer that schedules and dispatches interrupts, plus drivers and the HAL.

PowerShell's execution policy is refusing to load the script file — Windows clients default to Restricted, servers to RemoteSigned. It guards against accidentally running an untrusted file, not against a determined user: anyone who can start PowerShell can bypass it.

CreateProcess builds a new process from an executable image in one call, inheriting only handles that were explicitly marked inheritable. Unix fork first duplicates the caller's address space, so copy-on-write tricks and pre-fork server designs have no direct Win32 equivalent.

Windows ranks threads on 32 priority levels. The process priority class sets a base, the thread's relative priority shifts it, and the scheduler always runs the highest-priority ready thread, preempting lower ones. Temporary boosts lift threads in the dynamic range 1-15 so waiters and starved threads make progress.

Automatic starts a service during boot, Manual only when something requests it, and Disabled blocks starting at all. Automatic (Delayed Start) still starts unattended but after the automatic wave, at lowered priority, so it stops slow services from delaying logon.

WSL1 has no Linux kernel: an NT kernel driver translates Linux system calls, and Linux binaries run as pico processes. WSL2 boots a real Microsoft-built Linux kernel in a lightweight Hyper-V virtual machine, giving full syscall fidelity.

PowerShell is the management surface Windows itself exposes: server roles ship PowerShell modules, Server Core has no GUI, and a command is repeatable, reviewable and runnable against a whole fleet. GUI clicks and cmd.exe text tools are neither.

A hard link is a second directory name for the same file record on the same volume. Junctions and symbolic links are reparse points holding a target path: a junction is directory-only, absolute and resolved locally, while a symbolic link may target files, relative paths or remote shares.

Windows drives are mounted with DrvFs, which by default has nowhere to store Linux mode bits and synthesizes them from mount options, so chmod cannot persist. Either enable the metadata mount option in /etc/wsl.conf, or keep the key in the Linux filesystem.

Usually yes. Windows walks the DACL in stored order, and canonical order puts explicit entries ahead of inherited ones, so the explicit Allow grants the requested rights before the inherited Deny is ever reached. Deny only wins over Allow within the same tier.

User Account Control gives an administrator two tokens at logon. Ordinary processes get the filtered one, where the Administrators SID is deny-only and the integrity level is Medium, so ACEs granting Administrators do not apply. Elevation starts a new process with the full token.

On Windows the supported contract is the Win32 API and the native routines ntdll.dll exports, not the instruction-level interface. Microsoft renumbers system services freely between builds, so ntdll.dll is the only stable syscall boundary and hardcoded service numbers break on the next update.

This is the double-hop problem: PowerShell remoting authenticates you to the target server but does not delegate your credentials onward, so the target reaches the share as its own machine identity and is refused. Fixes are constrained delegation, CredSSP, or supplying a credential on the remote side.

Terminating a process on Windows kills only that process; there is no supervisory link that carries the kill to descendants. A job object does: assign the top process to a job, set JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, and every process in the job — children included — dies when the job handle closes.

A blocked callback occupies a shared worker thread. Because the pool adds threads gradually rather than instantly, other queued work — timers, waits and I/O completions from anywhere in the process — is delayed behind it. Call CallbackMayRunLong, use a private pool, or run long work on a dedicated thread.

LocalSystem is fully privileged locally and authenticates on the network as the computer account. NetworkService has low local privilege but the same computer-account network identity. LocalService is low privilege and anonymous on the network. A virtual account gives a per-service identity with the computer account's network access and no password to manage.

That key defines which binary the service runs and which account runs it. Anyone who can write it can point ImagePath at their own executable and have the Service Control Manager launch it as LocalSystem at the next start, turning a registry permission into full machine control.

Error 1053 means the process never reported back to the Service Control Manager in time. A service must connect to the SCM and report its status within roughly 30 seconds, reporting start-pending with a wait hint if initialisation is slow — an ordinary console program run as a service always fails this way.

Under WSL2, /mnt/c is served over the 9P protocol across the virtual-machine boundary, so every file operation is a round trip to Windows. Metadata-heavy workloads pay that latency thousands of times. Move the project into the Linux filesystem.

By default the WSL2 utility VM sits behind NAT on its own virtual adapter with its own IP. Windows-to-Linux works because WSL relays Windows localhost connections into the VM; there is no relay in the other direction, so localhost inside the VM means the VM.

Default to user mode and move to kernel mode only when you must sit in the I/O path or observe what no user-mode interface exposes. Kernel mode means a bug bugchecks the whole machine, and it commits you to IRQL and pool discipline, code signing, and lockstep servicing with the OS.

A hard affinity mask forbids the scheduler from using any other processor, so a pinned thread waits while cores sit idle and the mask encodes today's topology into the binary. Justify it only with measurements, and prefer softer expressions of preference such as an ideal processor or CPU sets.

REG_SZ is a plain string stored literally. REG_EXPAND_SZ is a string that still contains unexpanded environment-variable references such as %SystemRoot%, so the reader must expand it before use — otherwise it gets a path that does not exist.

WSL registers Windows executables with the Linux kernel's binfmt_misc mechanism, so exec'ing a .exe hands it to an interop service that starts it on the Windows side with stdio piped back. Windows programs cannot understand Linux paths, so convert them with wslpath.

NTFS stores a file as a set of named data streams, not one blob. Content beyond the default unnamed stream is an alternate data stream, addressed as file.txt:name. Windows writes one called Zone.Identifier to record that a file came from the internet.

A fiber is a user-mode execution context — its own stack and register state — that the application schedules itself by calling SwitchToFiber. The kernel never sees it and schedules only the host thread, so fibers are cooperative, give no parallelism on their own, and one blocking call stalls every fiber on that thread.

Windows NT 4.0 moved the window manager and GDI out of the user-mode subsystem server into kernel mode as win32k.sys, removing a process-boundary crossing from every drawing and message call. The cost is a very large kernel attack surface and graphics faults that can bugcheck the machine.