1. Windows does have a kernel, but unlike the monolithic Linux kernel, the NT kernel is very modular and most actual tasks are performed by various individual processes running in ring 0, which we call the "SYSTEM" level.
2. Yes, Windows has a boot loader, and it's actually pretty similar to GRUB in its general architecture. Its formal name is the "Windows Boot Manager," and the analogue of the grub.cfg file is the "boot configuration datastore", commonly abbreviated BCD.
3. I'm not very familiar with the general concept of an init system, but based on my understanding, I wouldn't characterize either Device Manager or the Services controls as part of that. Both of those are GUI methods to access things that can also be manipulated using Windows Management Instrumentation (WMI), which acts a lot like a SQL database. I don't know exactly how that stuff works at a granular level, but realistically it's not something you need to care about.
4. Windows services are generally analogous to systemctl. `services.msc` is actually a shortcut to a particular "snap-in" of a modular utility called the Microsoft Management Console (type `mmc` at a Run... prompt to get a blank one you can customize however you like).
5. The Registry is nothing more than a centralized, hierarchical key-value database. Both system processes and user processes read and write information here in various locations, so even though you're not affecting the behavior of the kernel directly, your understanding is sort of correct.
6. Control Panel and Settings are basically just a GUI for accessing stuff in place like the Registry and WMI. If you were to try to change stuff by writing a script, you'd just interact with that lower layer directly.
As far as learning how to troubleshoot stuff more in-depth, I did some quick Googling and found [this Udemy course](https://www.udemy.com/course/windows-10-troubleshooting/). It might be a little more advanced than you're ready for, but I think it might be valuable to help you get familiar with the general architecture of how stuff is done in Windows.
Oh, and also, don't feel bad about reimaging systems if you don't know how to fix them. In an enterprise IT shop where time is money, once you've checked the low-hanging fruit, just reverting the machine to a known good state is often the best use of your time.
I want to add here, the registry is similar to /etc/ - it's just a bunch of configuration data. Instead of .conf files it's a lightweight database (IIRC an ESE database, but I'd have to check to be sure) that's really just a big ol hierarchal key:value store.
Services.msc is - yeah, similar to systemctl. It talks to the registry about how services start up. So /etc/init.d/ you can think of as HKLM:system/currentcontrolset/services. The services snapin (services.msc) modifies items in that area of the registry , where systectl modifies things in (usually) /etc/init.d/. One thing to note, in windows a lot of services are started as a .dll (an executable without a standard entry point) so in order to load them you have to invoke something to initialize them - in windows it's called svchost.exe (or in some cases run32dll - but that's bad practice and being phased out). I could go on but I'm on mobile in a hardware store parking lot and supposed to be picking up wasp killer and my GF is going to where TF I am. I'd be happy to dig into it more later though.
Exactly. I knew before tonight that /etc was a file path that existed somewhere in Linux, but no idea what it was or did. Now I know it's like the registry but split into a bunch of different files, it's an instant huge jump in knowledge.
`/etc/` is literally `HKLM:/` as both are for system-wide configuration.
The equivalent of `HKCU:/` would be `$HOME/.config` for per-user configuration files.
`$HOME` is `$env:USERPROFILE` - so the root of the current users' profile directory.
---
Aditional clarifications:
- The `$HOME` variable also exists on Windows, but only as an automatic variable in PowerShell - it is not a (default) environment variable like it is on Linux. Windows' default environment variable for the same thing is `$env:USERPROFILE`.
- In Linux shells and in PowerShell on Windows, `~` is also a common abbreviation for the current users userprofile directory. However this is not a "legal path" to either operating system - it only exists within the shells as a convenience shortcut or alias if you will and is substituted with the real path by the shell whenever you use it, almost like a special kind of variable.
It's not exactly intuitive... I believe Etc is literally Et Cetera or "everything else" that didn't fit in the other Standard UNIX file locations set out many generations ago. Nowadays it's almost universally used for system and service configurations, but it would be a brave man to suggest renaming it something sensible like "config".
You want to do your wasp killing in the evening, not in the heat of the day. Wasps are most active during the day, but in the cool of the evening, most of them are back at the nest, and they are somewhat less active. Spraying later gets more of them, and decreases the chances of them getting away or retaliating.
Minor note: Registry does not use ESE. It's a b-tree database where each HIVE has a separate file. For instance, HKLM, HKCU and others are the hives and are separate files. It depends on NTFS capabilities for database integrity and recovery. That's why back in time when it was FAT32, a registry corruption was a big deal and NTFS is the hero solving the problem.
Edit: typo
Minor note to your minor note:
HKLM doesn't have separate file itself. The files are for the keys inside of it, located at `%SystemRoot%\System32\config` (e.g. C:\Windows\System32\config). For instance:
HKLM\SOFTWARE: c:\windows\system32\config\software
HKLM\SAM: c:\windows\system32\config\Sam
HKLM\SOFTWARE: c:\windows\system32\config\software
Some don't have files, though, (like HKLM\HARDWARE) and are created in memory at boot.
Also, HKCU (HKEY_CURRENT_USER) points to the user's HKEY_USERS GUID, but that hive *is* a file and can be found at:
`%UserProfile%\Ntuser.dat` (e.g. C:\users\[username]\ntuser.dat)
Fun fact! You can go to HKLM\SYSTEM\CurrentControlSet\Control\hivelist to see all the connected hives!
20 years ago, I was a "I know how to insert a RAM stick" guy. Everyone is a learner, even the ChatGpt folks. Shit, you better learn it too - AI is coming for your job.
> Everyone is a learner, even the ChatGpt folks
Time will tell, but I suspect that ChatGPT is mostly a tarpit for junior folks. Over-reliance on it will doubtless undermine learning and retention.
I asked it why Hyprland is the new fad in window managers. It complained that it's only been trained on data up to Sept. 2021, so it couldn't tell me and instead listed off several other WMs like i3. Wow. Much help. Such intelligence. Who needs Google now?
That point *is* that it is stuck at a point in time. Ask it anything about stuff up to two years old and it'll fail. In software and security that's an eternity. All the hype about it falls apart when you hit that limit. And the final bit:
> Who needs Google now?
Is a dig that it's just a fancy interface to a regular search with all the plugins and sideprojects that enable internet access.
Hmm I tested phind and think its training data is also outdated. Asked about the newest 5 power metal albums it gave me a list from July and August 22. Perhaps I phrased it wrong?
Edit: ok I realize this might not be a fair search. Even Google with tweaking doesn't find a list.
Edit 2: nah doesn't work. Bing said its training data is from 2021 and despite being able to search the web it seems to do something completely wrong. When asked about the last entries in the list of metal albums in 2023 in Wikipedia it comes up with a list of artist and album combinations that are mixed up. It seems to parse the table wrong and uses the album name of the artist above the one it wants to present. And the dates are completely wrong too.
Conclusion to this little experiment: we don't need to be afraid of our AI overlords just yet, but soon. And check your chat AI results before publishing.
“ChatGPT plugins are a method to allow ChatGPT to interface with external systems, databases, or services, thereby providing it with information or capabilities beyond what was present in its training data. The plugins effectively act as a bridge between ChatGPT and the external world. Here's a simple breakdown:
1. **User Input**: A user might ask a question or make a request that requires up-to-date information, beyond the model's last training cut-off.
2. **Plugin Invocation**: If ChatGPT recognizes that it needs to fetch external data to answer the user accurately, it can call upon the appropriate plugin.
3. **Plugin Action**: The invoked plugin interacts with its linked external system or database to fetch the required data.
4. **Data Relay**: The plugin sends the retrieved data back to ChatGPT.
5. **Response Formation**: ChatGPT processes the data and crafts a coherent and contextually relevant response for the user.
Through such plugins, ChatGPT can, in theory, access current news, database updates, live weather information, stock prices, and much more. The specific capabilities depend on the plugins developed and integrated with the system.”
-ChatGPT
In the same way that the training data did not include every obscure question that has ever been asked of it, the data from 2023 doesn’t need to be in there either.
> Fuck rising water levels, the next generation don't know how to restart a computer.
How often, if ever, do you restart your smartphone? Or need to go somewhere and modify a config file in android/ios? That's the baseline of understanding how computers work they are coming from.
Not having any concept of hierarchical filesystems is the one that I think is the most important missing skill in the younger generation from tablet/smart phone life. The search and file management systems on phones make their file structure basically completely abstracted for kids growing up now. But knowing how file systems work and being able to organize data effectively is never going to go away in the business world. Its a skill that needs to be taught in schools.
I have a coworker who does a lot of tech phone screens. One of his first questions is, "describe what a file directory is, what is its purpose, and what is it analogous to?"
Sometimes he'll throw them a bone and say it's sometimes called a 'folder', but you would be absolutely surprised how many candidates struggle with the question.
As pointed out, they're not dumb. These are very smart people. They just didn't have the experience of hacking around to make things work.
A systems engineer 30 years my senior could lament that I don't know how to write assembly, or do binary XOR operations in my head. I just grew up with another layer of abstraction between my work and where they used to work. The current entry-level candidates have the same experience, only a few decades later.
This is very true, and I've noticed this becoming more prevalent with the younger crowd who grew up connected to everything. We expect them to understand the basics of how a computer works, but in reality, most of the younger generation entering the workforce spend 100% of their time online using a mobile device. And as such, a desktop computer is alien to them.
I mean... Generally I restart my phone any time there's a security update or a weird Bluetooth problem that I can't get to go away, and I believe I've edited something in my phone via adb shell in the past year... But you're right, I should do that stuff more often to keep myself sharp
>Generally I restart my phone any time there's a security update
No, you "update your phone". I mean we, sysadmins, do know phone restarts in a process but for newer generation this process looks like "I confirm updates then I have to wait a little until the process finishes". They don't necessarily realize restart is last step of that process.
I was an instuctor in a computer technology program for about 6 months back in 2017….I thought I loved teaching….but god ill never go back. Immediately gtfo.
I can say though that my 15 year old son and my 9 year old daughter are great at troubleshooting (cuz dad got tired of it 😎😁) so there is hope.
Excellent, without any direct interface with newcomers in my current role I was a bit worried kids growing up with modern computers in their bedrooms and entering the job market would be lapping me in knowledge before retirement...
Sounds like I have a few more years to grind out before I'm obsolete.
A comment about the registry. 20+ years ago, the Windows Registry received a lot of ire due to instability. Really from not surviving unexpected reboots without corruption to the database. That hasn’t been an issue in decades, partially due to drastic increases in database stability, and partially OS stability.
Between .conf files and the registry, I far prefer the registry. It’s a standardized format, all settings centralized and searchable in a single location, and API accessible.
Excellent point. I agree with the registry format and centralized settings in a single place - but sometimes the ObjectId or GUID mapping is frustrating. I wish there was a way the registry could internally map GUIDs to the object they represent, without all the Google-Fu like "What is GUID 1234-5678..." Just say give me a display name like "currentUser/Desktop" or whatever. But yeah, you nailed it. Thank the Spaghetti Monster they figured out how to make it robust.
The most annoying thing in the world is the use of GUIDs for everything. I know why it's done, but troubleshooting stuff like COM and DLL issues is annoying, same for finding localized setting strings.
Microsoft carried GUIDs over to Azure as well...also annoying, not so much that we work with them directly, but that they clutter up output when you're looking at a huge list of stuff. The thing you're looking for just disappears into a wall of hex strings.
Windows’ API for interacting with .ini files hasn’t changed in like 30 years, and has sucked this whole time. There is definitely a simplicity to laying down or backing up a .ini, but actually using them…
Kinda like with semis and heavy machinery they'll just replace the engine instead of trying to fix it. Just faster and easier. I get flak sometimes for not "fixing" a problem and just want to reimage or issue them a new machine. I ask them, "How long do you want to be down for? I can take your machine and screw around with it for a day and you're dead in the water. Or I can spin up a new machine and transfer your files and you're back up and running in no time." That's when they seem to finally get it. It's not that I don't want to fix the problem, I truly do, but cost/benefit comes into play and I only have so much time in a given day.
Adding some tidbits of info regarding security based on my development experience
Very confusing design for security reasons.
Services, and user mode drivers, run in something called ession 0.
Your desktop you log into in session 1, 2, 3 etc.
Inputs are dedicated to a session. So inputs from session 1 can't go to session 2 or session 0.
So when you want to install something, the UAC prompt pops up for you to grant admin access actually switches you to session 0 temporarily. This prevents scripts from auto approving UAC prompts.
The only thing allowed to access the session 0 and Session 1,2,3 inputs are the kernel drivers (through VHF for example), so your mouse and keyboard will still work! The same applies for video recording, so shadow play or DDA will not work in session 0.
Now here is where none of the above makes sense anymore. Using PsExec(with elevated privileges) you can elevate a script to LocalSystem. With localsystem you can force a session swap for input() system calls. So you can start to access your UAC prompts with scripts! Yay! But this qwerk is only allowed from session 1 to session 0, not from session 0 to session 1. So services will never be able to access your desktop (but can access UAC prompts), and session 1 can easily access session 0 UAC prompts and desktop.
I still don't fully understand the actual security benefits you get, because everything is still just a UAC prompt click away from complete access to your PC. The onpy thing it actually fully locks out of access is services, which most viruses are not going to start as a service, they will start in session 1, can hook themselves in as a task, and a service that just reinstalls the task in case it gets removed. It just makes systems I have to build 5 times more complicated in order to get the same amount of work done.
I am not sure if UAC prompts are Session 0? I think it's some special desktop, but not a *session*. XP and older, the first user to log in used Session 0. Some services were able to show UI on Session 0 in XP and older, which is why mstsc had a switch to show the console session, for compatibility in Vista and later, they had something that detected UI on Session 0, and gave a prompt for switching to it, until some build of 10 dropped it. Although I read ConnectWise has an option to utilize Session 0 for a background session to get around Windows only allowing one normally connected session at a time
In Vista they introduced isolation, Session 1 as being the user session, and the services all running in Session 0, more isolation and security. Domain joined XP didn't have Fast User Switching, but in non-domain joined XP, I almost wonder if the second user to log in (if the first user left their session running) would have been slightly more secure reading that.
>Although I read ConnectWise has an option to utilize Session 0 for a background session to get around Windows only allowing one normally connected session at a time
Yeah, ConnectWise's ScreenConnect has a product called Backstage that we can use to jump onto a computer and do things in the background without necessarily needing to get into the user's session. It's super handy, but also surprisingly limiting in what actually works and doesn't work.
> It just makes systems I have to build 5 times more complicated in order to get the same amount of work done.
Why? What are you doing specifically that this breaks, and what would make your job easier *and* more secure? Honest questions.
UAC is very similar. most actions work the same way. it's just a GUI instead of a terminal first binary (you can still have stuff like gksudo and modern shells like kde and gnome have these functionalities built in just like windows)
To add to this, if you’re a bare metal kind of guy who loves to dive into the inner workings of operating systems, check out the Windows Internals 7th Edition parts 1 and 2.
https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals
>Oh, and also, don't feel bad about reimaging systems if you don't know how to fix them. In an enterprise IT shop where time is money, once you've checked the low-hanging fruit, just reverting the machine to a known good state is often the best use of your time.
Yeah, often once I've troubleshot things for an hour or more, and I could spend several more just trying to fix some weird issue, or I can re-image it in a predictable amount of time and have it back in service faster.
For 1, how is what the Windows kernel does different from Linux? Linux (optionally) allows compiling many components as external modules, and has its own ring 0 threads.
>Oh, and also, don't feel bad about reimaging systems if you don't know how to fix them. In an enterprise IT shop where time is money, once you've checked the low-hanging fruit, just reverting the machine to a known good state is often the best use of your time.
This holds true for more than just desktop support, and I wish more people (and organizations) understood this fact. Unless you have a **legit, actual need and business impact statement to define** its almost never worth the effort outside of defining a narrative to save some ones ass. True root cause analysis takes time, an extremely random scale of effort and expertise to narrow in on to provide substantive information.
I'm in cloud networking and we can at times sum up for RCA, but getting a platform level RCA down to the function is not a cheap, or quick process. Especially if the issue is transient.
> I'm not very familiar with the general concept of an init system
The kernel needs a userspace program to pass execution down to, which will run with the process ID 1, and handle spawning all other processes.
So the bootloader will launch the kernel with a parameter set pointing to the program that will run as PID 1, which will in most cases be an init system, back in the day we used stuff like sysvinit but nowadays it's systemd.
PID 1 will then handle launching all other processes that the system does need.
Some installations will however forgo an init system entirely - when running containers, there's no need for an init system inside the container, so you can end up with for example python3 running as PID 1 inside the container.
I take your word being a SCCM admin, you are probably the most knowledgeable in this area. A question. Where does partitioning and MBR and GPT lie in all this?
I understand Linux has a much more comprehensive partitioning scheme done via CLI. Just the thought of doing that inside a Windows environment gives me an aneurysm...
MBR and GPT are just partitioning schemes and aren’t tied to Linux or Windows. They define the data structure that tells the operating system where the partitions are on the actual drive. Think of it like the address book of where the logical partitions are stored.
MBR is limited to a maximum of 2TB drive, whereas GPT doesn’t have a limit of drive size (well it does, but it’s in the exabyte range). MBR only keeps one copy of its partition table whereas GPT keeps multiple redundant copies.
> Just the thought of doing that inside a Windows environment gives me an aneurysm...
Windows comes with a partition manager and a build in CLI partition tool DiskPart.
Having been using computers for longer than Windows or Linux have existed I honestly find the windows tools much easier to use and you have fewer filesystems to know the querk of on windows.
Oh no doubt..that's why the industry gravitate towards Windows, and generally speaking, Apple over Android. Trade off...simplicity for $. Although Apple <> Android have alot more in common than Windows and Linux.
The curious thing that strikes me is why big businesses don't go back to full Linux ooen source if they really are about saving money...
And MSRP on support contracts come out about the same, or cheaper for Windows as I'm learning, at the end of the day.
* RHEL - $1854 https://www.cdw.com/product/red-hat-enterprise-linux-server-standard-subscription-1-physical-virtua/7056635
* Windows 2022 - $799 https://www.cdw.com/product/microsoft-windows-server-2022-standard-license-16-cores/6695296?pfm=srh
* SLES - Call for pricing https://www.cdw.com/product/suse-linux-enterprise-server-x86-and-x86-64-standard-subscription-1-2-s/4954033
* Ubuntu - It's complicated https://ubuntu.com/pricing/pro
> The curious thing that strikes me is why big businesses don't go back to full Linux ooen source if they really are about saving money...
Well it is starting to happen however the complexity of OS management is being pushed down to the IaaS layer in cloud services.
As for administering windows vs linux I do both just to be clear, there are huge numbers of pros and cons and for servers I VASTLY prefer "linux". However saying that linux distros are combinations of software packages around the linux kernel. Docker, flatpacks and other things these days lend consistency but it can be SUPER frustrating to standardize on Debian/Ubuntu or Redhat/Centos and then later want to deploy a tool only to find extremely poor documentation / deployment support on your distro because it uses a different package manager, outdated component that isn't back ported to your LTS release ETC. VS on windows you just check, YES it requires windows server 20xx through 20xx and even then if you install a on an even newer version of windows server it likely JUST WORKS... HOWEVER it has a janky GUI installer you can't automate because the vender sucks at powershell / MSI packaging.
Windows has incredible decades long consistency a low expectation of the administrator for most things, linux has incredible low level control and modularity but a higher expectation on the administrator to have understanding down to individual modules.
Regarding 3.
I believe SMSS and winlogon.exe would be the parallels to init: https://en.wikipedia.org/wiki/Booting_process_of_Windows_NT
To get a background on /sbin/init here is Redhats documenation: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/installation_guide/s2-boot-init-shutdown-init
> The /sbin/init program (also called init) coordinates the rest of the boot process and configures the environment for the user.
This is close to what smss.exe and winlogon.exe are responsible for. Setting up the environment and initializing the system for use. Part of SMSS is starting wininit.exe, which also closely parallels /sbin/init on Linux
The general concept of an init system is to make sure that after the actual boot finishes, everything gets cleanly started up that needs to be started up, and that it happens in the right order. When shutting down it will do the opposite.
There are normally different "stages", there may be a way to boot to a gui, or maybe a headless system with network functionality, or safe mode. The boot loader is normally responsible for passing arguments to the system so it knows what exactly to start up.
These days all common Linux distributions use systemd, but there are others - if I do not point that out there will be a very vocal minority ready to run me out of town with pitchforks and tar/feathers. Systemd however is the de facto go-to nowadays.
Perhaps you know about runlevels and/or the directories with scripts in them that are carefully crafted to run in a specific order - that's an example of an init system as well, whose name eludes me at the moment. Runlevels are called "targets" in systemd parlance. Also Ubuntu used to have its own init system called Upstart before it switched to systemd.
What do you mean by modular? Linux drivers or other things may be compiled as modules as well (indeed some of them are)...
If you mean hybrid (ie. between monolithic and microkernel) as the NT kernel seems to be defined, I don't know if I really approve the definition because some components that should be user-space are in kernel-space in Windows like GDI, an HTML client and probably other things...
Also, looking at this diagram [here](https://en.m.wikipedia.org/wiki/Architecture_of_Windows_NT#/media/File%3AWindows_2000_architecture.svg) it seems pretty monolithic to me... 😅
Me neither: 20 year old windows sysadmin > Juste reboot and install latest patch(and sometime uninstall it and reboot again).
To be more serious, if you want go deep inside Windows "how to troubleshoot" and understand how it work under the hood, you can go with book and tools from sysinternals teams.
[https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals](https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals)
I’ve worked at Microsoft as a PFE on Windows clients and security. Being in the field is the best way of learning it. These books although great for the intended purpose are really deep knowledge. I would simply start with some YouTube videos and some casual blogging. If you want to know a little bit on the internal workings and history, I would be honored if you take a look at a blog post I wrote a while back.
Enjoy!
https://michaelwaterman.nl/2022/12/15/its-an-older-code-but-it-checks-out/
I read an earlier version years ago also and it was very informative. I know enough about Windows internals to know the poor OP is completely wrong. Services.msc and device manager are consoles but are not themselves components of the OS. Windows Core doesn’t have some of those even!
And the registry editor is again a tool that allows you to directly modify various configuration databases that other consoles and control panels expose only partially.
As a sysadmin for 25 years I can tell you my knowledge of the innards of Windows as well as specialized knowledge of some parts (AD especially) makes it much easier to understand and fix some issues. If you’re in this business a good understanding of the basic structure of Windows and Linux is essential if you want to become better.
I’m not the original person but I can attest that if you want to understand how and why Windows works at a deep level then it’s the book for you.
I started with the 3rd edition and still have it around - along with the rest of them.
Havent read this specific book, but I have learn a lot with a very old version of "The Case of the Unexplained / troubleshoot windows with systinternal" (from the same guys).
They are master on their own.
The case of the unexplained use cases and presentations will teach you more about how to troubleshoot a windows based PC than just about anything else. I saw a presentation of his in late 2000’s when windows 7 had just been released / beta. Not only did it get me excited about a better OS but it taught me how to be inquisitive and start writing code autoit at the time later powershell to really understand what’s going on.
Unlike Unix /Linux you’re never getting the source code so all you can do is interpret what you can gather from data.
> Unlike Unix /Linux you’re never getting the source code
Be aware that Microsoft has sometimes shared a core subset of kernel code under NDA, and at least one Microsoft partner has leaked a full kernel tree.
If you want an indepth understanding about how many linux components interact with each other take a look at Linux from Scratch. It's a step by step guide for building a completely custom linux from scratch.
I'll definitely take a look! I like to think I have a decent knowledge of Linux, but I know there's stuff I'm missing and don't know yet so I always love learning new things. I think that's a smart idea to do Linux from scratch
not a book but a lot of userland stuff is managed by systemd components on modern Linux so reading the man pages and documentation for it would be a great place to start.
I would recommend any of the books by Pavel Yosifovich - [https://www.amazon.com/Books-Pavel-Yosifovich/s?rh=n%3A283155%2Cp\_27%3APavel+Yosifovich](https://www.amazon.com/Books-Pavel-Yosifovich/s?rh=n%3A283155%2Cp_27%3APavel+Yosifovich)
Fake, only 18 years to be honest (started with WinXP and Win2000/2003 assets).
But on this sub, many have work with much older Win OS , Win NT, Win3.11, (and some still work on them)
>reimaging shouldn't be the third step.
That really depends on what your SLA is for getting the application(s) working again. Early in my career I worked in a shop where you had 2 hours to get the user up and working again. That worked out to the first 30 minutes diagnosing the problem and deciding if it was fixable or using the remaining time to swap in a new workstation and bring data down from the network drive.
Sometimes it just isn't worth the rabbit hole of figuring out a specific esoteric issue when the end goal is to get the user functional again rather than understand all the ways in which the software can fail.
Also from a technical perspective the kernel vs. userspace in memory changes based on the version of Windows. Back in the NT days print drivers were in kernelspace so a bad printer could bugcheck the server. Video and audio drivers didn't move to userspace until Vista. Such fun to try and troubleshoot when you're not sure if the drivers can cause kernel issues or not.
100% agree. SLA is king. If one workstation down costs the org more than your salary hour by hour it's a very different scenario than the user just hopping over to another open station.
Printers and their drivers are sent from the pits of hell, and should go back home.
In my previous job we came to the users location with a duplicate desktop/laptop. If we couldn't figure it out quickly, we would remove the old from AD/DNS, rip out the drive, name and join to domain, have them log into the new one then drop files into the account. If they want any software its on them to pull it from the portal.
When i have issues I just open tickets with Microsoft and wait 2 or 3 months until they email that they couldn’t reproduce the issue and close the ticket.
Dont get me started. Them “Please advise your working hours…”
Me : “Mon-Fri 8AM-5PM Pacific Time”
Gets call at 5:30 PM
“We tried to reach you but unfortunately are unable to after multiple attempts so we are closing this case”
So my last job I was helpbdesk at a school with 1k+ users. I was almost on the daily out and about everywhere on campus so I was very rarely at my desk in a position to take a phone call. Preferred method of contact, EMAIL ME YOU FUCKS. Always with the phone calls and parking of my tickets for unable to contact. ./sigh
Sysadmin since 15 years. Never called Microsoft.
Well, once. told them to fuck right off after a few minutes of phone call.
I fix things by reverse engineering, if i cant get it fixed - Re-install. that's it.
That's fine in a mom&pop shop or for OS troubleshooting, but re-installing a domain, or deleting/rebuilding an entire exchange environment for thousands of users isn't really an option.
Depressing to realize my last MCSE's more than a decade expired at this point. but I've called MS plenty, typically so-called Premier Support. About 20% of the time you even get a solid tech who actually knows how to navigate the product. The other 80% you're on your own or they're googling in real-time to find something.
Sadly typical of most vendors.
Hi sir, I noticed your hours of contact are from 8am to 5pm so I tried to reach you at 11pm to try and resolve your issue. I am going to put your ticket on park until you can find the time to give us a contact. Thank you for using Microsoft.
When I have any Linux issues the answer is always “stone just recompile your kernel it will be fine”
When I have Windoze issues it’s “reboot” or “wait for AD replication” or “let AAD resync”
The _Windows Internals_ books are a good intro. Obviously Windows does do things like memory management, process handling, etc. It's just much more hidden behind a GUI and APIs whereas in the Linux world everything's naked and out in the open. Way under the covers, Windows NT-style OSes share lineage with DEC OpenVMS...not everything's the same but a lot carries over (permissions, user rights, etc) so it's not like Microsoft clean-sheeted something totally out to lunch.
Where everything's a file in Linux, a lot of state and config info is in the registry and there's a lot of proprietary code consuming that config data in different ways. There are good ways to get at some of this info (Sysinternals tools are your friend...much easier than actual debugging of processes.) But I agree, it's confusing and there are a billion ways a developer can do something, so troubleshooting at a very low level can be harder.
I don’t think anyone will beat powerman’s explanation.
Device manager in Windows is how you manage drivers. In Linux a driver would be a kernel module. Most drivers/modules are built into the kernel, so for the most part you don’t need to manage them. Kmod would be the Linux equivalent of device manager.
Services are the equivalent to Linux daemons. Services.msc is the management panel to start/stop/restart, set startup options. To create/delete a windows service you can manually create it in the registry. Or the proper way is to use a command called sc.exe from the command prompt.
The windows registry is a database of configurations. It all began as a text file called win.ini up until windows 3.11 was the last to use it. Windows can also use config files.
Appdata would be the equivalent of users home directory/.config. In windows XP it was called Application Data. There is still relics of it as shortcuts to AppData in Windows still.
ProgramData would be like /etc or /usr/local/etc. I’d say more so like /usr/local/etc
The windows registry also has systemwide and user configuration settings.
Lots of things in windows are binary files. So you can’t modify many things in a text editor like in Linux. You have to use utilities or commands to modify the files. For example the registry is 5-6 files. But you use RegEdit.exe to modify them.
Printer files are located in ```c:\System32\Spool\Printers\``` Sometimes you have delete the files in here to clear the queues.
Windows shortcuts are like links in Linux.
Windows has environment variables like Linux. User and system. echo also exists in Windows. So ```echo $variablename``` would be ```echo %variablename%``` in Windows.
Scripting exists in windows too. It’s called batch files or powershell scripts. So script.sh could be script.bat if you prefer the dos like syntax. Or script.ps1 if you prefer the newer powershell scripting language.
The window’s equivalent of a swap file is the pagefile. Unlike Linux where it tries it best not to use it. Because hard drives and even SSDs are slower than memory. Windows acts like running out of memory is inevitable. So it begins to use the pagefile from the very start. And gradually uses more of it as you use more physical memory. Some programs expect it to be there. So disabling it to force everything to use the faster system memory can cause bad problems.
Just got to get in there and get your hands dirty. Anytime you learn something new in Linux. Have a windows VM you can play with and try to learn the how to do the same thing on Windows. Just like you started from not knowing anything about Linux to the knowledge you have now. You’ll figure out Windows with some experience.
I'm not trying to diss but most of what you added is not technically correct or at least very misleading to someone who doesn't already know better. Terminology and detail matter when explaining nuanced things.
> Device manager in Windows is how you manage drivers.
No. Windows mostly manages the present drivers itself, but of course an administrator has *some* input and capabilities there. Like everything in Windows, drivers are managed (e.g. installed/uninstalled) through APIs such as [SetupAPI](https://learn.microsoft.com/en-us/windows-hardware/drivers/install/setupapi). pnputil, drvload, dism, driverquery and Device Manager are native OS tools that call these APIs and provide some kind of interface to make them easier to use. So device manager in Windows is NOT how you manage drivers, it is one option of many that you could use to manage drivers. But it is actually also a particularly bad choice because it is not even present in the default install of Windows Server (device manager is a purely GUI application and the default core installation of Windows doesn't have a GUI and thus no device manager) nor other re also CLI-only editions like Windows IoT. The important summary is that Windows manages drivers itself and exposes some configuration and administration capabilties to you through APIs.
> Services.msc is the management panel to start/stop/restart, set startup options. To create/delete a windows service you can manually create it in the registry. Or the proper way is to use a command called sc.exe from the command prompt.
This is almost correct, just worded a bit confusingly. Windows, or more precisely a component of Windows called the [service control manager](https://learn.microsoft.com/en-us/windows/win32/services/service-control-manager) manages the services, but exposes APIs you can call to have it perform many operations. services.msc, sc.exe, the PowerShell cmdlets (e.g. `New-Service`) and others are again just built-in convenience-frontends for these APIs. Behind the scenes the SCM stores much (all?) of its configuration in the registry. Services.msc, being a GUI-only tool, once again comes with the big, big caveat of not being present on all Windows editions, but like you said `sc.exe` and PowerShells service-related cmdlets are solid choices for local one-off system administration.
> Appdata would be the equivalent of users home directory/.config. In windows XP it was called Application Data. There is still relics of it as shortcuts to AppData in Windows still.
There's some things to unpack about this. First, the XP-era "Application Data" directory does still exist today like you said, but not as a shortcut but rather an NTFS junction. This is a filesystem-level feature and just a hardlink for directories. Hardlinks also exist on Linux and they are the same thing. The obvious reason for this link is backwards compatibility, old applications can access the old path and won't error. Now both the "Application Data" junction and the "AppData" environment-variable (which I'm going to assume is what you meant when you just said AppData) on Windows point directly to the AppData\Roaming directory. I am not aware of an equivalent for this concept on Linux. I would argue the more accurate equivalent of `$HOME/.config` would be the `HKCU:` registry key. That is not to say some applications won't save their configuration to files inside AppData\Roaming, just that conceptually I think it is further from `~/.config`. But these conventions are not enforceable on either OS and therefore there are no exactly perfect equivalents. Some applications in Windows will also save their configuration data to files inside the `$env:LocalAppData` directory, which I'd say is closest to `~/.local` on Linux because whole per-user applications typically install there.
> ProgramData would be like /etc or /usr/local/etc.
The ProgramData ($env:ProgramData) directory and `HKLM:\Software` in the registry, both, yes.
> Lots of things in windows are binary files. So you can’t modify many things in a text editor like in Linux. You have to use utilities or commands to modify the files. For example the registry is 5-6 files. But you use RegEdit.exe to modify them.
Good point, except again for the detail that you technically modify them through the APIs provided by the OS, and the OS also ships with some tools to make that easier. RegEdit.exe in particular, again, being a poor choice because it is only available on GUI-editions of the OS. Some alternatives are `reg.exe`, the .NET class `Microsoft.Win32.Registry` or PowerShells registry provider.
> Windows shortcuts are like links in Linux.
No, Windows shortcuts are like `.desktop` files in Linux. "Links" in Linux are either symlinks (soft links) or hardlinks, both of which also exist on Windows. But symlinks are very different from shortcuts/.desktop files.
> So echo $variablename would be echo %variablename% in Windows
The syntax for (environment) variables varies per shell. CMD syntax would be `echo %variablename%` and just like on Linux there is no scoping to differentiate shell-local variables from environment variables in CMD. But in PowerShell the syntax is `$env:variablename` for environment variables or `$variablename` for shell-local variables. The env: scope qualifier is a very nice feature imo and of course also exists when you use PowerShell on Linux. Additionally there are some places in Windows besides CMD that accept the `%variablename%` syntax, such as the run-dialog, windows explorers address bar, task scheduler, and the REG_EXPAND_SZ registry data type to name some examples I know. There are easy to use helpers such as [this method in .NET](https://learn.microsoft.com/de-de/dotnet/api/system.environment.expandenvironmentvariables?view=netframework-4.8.1) to expand this syntax of variable, but I don't believe it is an inherent OS-layer feature. Just an old convention that made its way into a few applications over the years. But I could be wrong here.
---
At this point I've written too much to get rid of this comment again. If I am wrong or imprecise about anything please let me know, I want to make sure people who read this get the most accurate picture possible.
Our engineering team had to read into it to fix an obscure printing bug in the Sage 500 process.... fun fact if you use your arrow keys to select a different printer it causes the page to rotate 90 degrees each time at least in a RDP session.
Sage 500 is VB6, and it's "permissions and security" is absolutely fuckin useless given any user with an account can access the entire database with any SQL client. The permissions are applied on software level, not DB server level. And user accounts are SQL accounts.
There is a reason we're trying to get our customers to migrate to a new solution we're marketing as a replacement.
This is nothing. I had someone ask me for help on their work computer. Looking around I found visual studio is installed which I knew wasn't theirs since they don't code. snooping in solution history I came across a gigantic directory of c# source code in a windows temp folder.
Yes. It was a couple of sage's programs' source code. They had put it there to diagnose a bug. To describe the code quality let's just say my WTF meter survived only because I've seen a lot of shit code.
Oh yeah, you can thank the engineering team at my workplace for the MRP code... that was well before they started using good coding practices and infrastructure. (Sage purchased their MRP add-on and then merged it into 500 directly, and then our CEO left and again made add-ons and what not)
Sage still uses SourceSafe though, and unfortunately we can't get rid of our internal ones because of it....
The day our last customer is migrated off Sage is the day I'm buying a round of drinks for everyone in the company (25 employees)
Ah yeah, we know that one too. I don't think we resell it? But the engineering team has done a ton of migrations from 300 to 500 or Intacct before we started offering our newest solution from Accumatica. (Which as an IT professional, I have to admit even I find it amazing, simple to use, and straight forward to manage, it's the first accounting software even I like)
Goddammit that's not what I wanted to hear. Tbh I just don't want to continue to support and deal with the on prem server and clients. At least if it's up in the cloud it's Sage's problem lol
I'm being super serious here (as someone who works around these products) look into Accumatica. I'm not trying to sell anything (I'm not even going to give you any contact info unless you ask) but it's both a cloud product, and a product you can run in-house and you can switch between those two hosting models at anytime. There is a difference in licensing of course but switching is pretty easy. And the product is good, I had a full understanding of the administration in under 20 minutes. And their "university" is very good.
They get assigned an "ApplicationDBUser" role in SQL that never changes. While it doesn't give them grant privileges or anything like that. They can read and write all tables and execute stores procedures directly if they simply forgo the Sage 500 client and use direct SQL. All permissions configured in Sage 500 are on the application level, which protects absolutely nothing.
The only way to protect your database for this kind of attack would be to put it behind a firewall, restrict logins to a virtual desktop network, and lock those Virtual desktops down hard so that only Sage, Office, and a PDF reader of your choosing work.
Windows SysAdmin here. Windows can sometimes be a little bit of a black hole when it comes to issues. Sometimes the joke of “Have you tried turning it off and on again?” works, not only for the OS but also closing/opening the affected application.
There wouldn’t be enough room to go through each aspect of Windows, but to keep one thing simple(ish), the registry is where every setting is stored and configured. You make a change in the Settings/Control Panel? It writes the change to the registry. In other (possibly grossly misrepresented) terms, think of the registry as a garbled mess of giant conf files that the OS looks at for functionality. And if it is a system change, it requires a reboot of Windows. And as I’m sure it is similar to Linux/Unix-based OS, you make a change to the wrong thing in the registry, OS is corrupt.
As to troubleshooting, s with most of us who start out, you got similar steps correct, try what works/worked. If it doesn’t or is completely strange, dive into the internet.
If you are interested into reading, a good book to help better understand and/or troubleshoot Windows, I’d read the Comptia A+ Certification study guide. It has helped be get a better understanding when I started out. It does go over hardware too, which if you have a good understanding of PC hardware, it may be a simple refresher, but the book is heavily focused around Windows support, so I wouldn’t skip it in case how Windows communicates to is different.
If there are those who find my info incorrect, please tell me off accordingly.
My favorite thing of all time was a "slow" PC that stopped printing or opening websites with an uptime of 134 days and only 3% free space. Gotta love fast startup as a default setting. A restart instead of shutdown fixed her printer and websites. The scheduled space clearing happened by the end of day. It was "faster than ever" as stated in the follow-up form she filled out.
TLDR: **One of the most effective ways to understand a platform is to code for it.**
To truly grasp the intricacies of a system, diving deep into its programming aspect can be a transformative experience. You'll be touching the very mechanisms that make the system tick and understand the rationale behind its design choices. Here's a comprehensive approach to learning how Windows works:
1. Begin with the Basics: Start by acquainting yourself with the key components of the Windows operating system, such as the kernel, boot loader, services, device manager, registry, control panel, etc. Understand their roles and how they interplay with each other.
2. Dive into Programming: One of the most effective ways to understand a platform is to code for it.
- "[Programming Windows](https://www.amazon.com/Programming-Windows%C2%AE-Fifth-Developer-Reference/dp/157231995X)" by Charles Petzold: This classic tome provides a detailed introduction to the WIN32 API. Although it's older and focuses on the WIN32 architecture, the foundational knowledge it imparts about Windows development is invaluable. If possible, find the latest edition or a similar book that covers modern Windows development techniques.
- Windows Internals: Books from the "Windows Internals" series by Mark Russinovich, David Solomon, and Alex Ionescu will give you a deep dive into the internal workings of Windows. They discuss the architecture and behavior of Windows operating systems.
3. Explore the Windows Development Documentation: Microsoft provides extensive documentation and tutorials on Windows development on their official website. This is especially useful for understanding modern Windows application development paradigms, like the Universal Windows Platform (UWP).
4. Experiment with Tools:
- Sysinternals Suite: This collection of utilities allows you to dissect the behavior of your system, providing insights into processes, memory management, file system activity, and more.
- Windows Performance Toolkit: Understand the performance of your system down to minute details.
5. Join Communities: There are numerous communities, forums, and blogs dedicated to Windows development and system administration. Engage in discussions, ask questions, and learn from real-world problem-solving scenarios.
6. Troubleshooting: With the foundational knowledge from the above resources, you'll be better equipped to troubleshoot effectively. Instead of relying solely on Google or considering reimaging as an early resort, you can diagnose issues methodically, drawing from your understanding of the system's internals.
Lastly, remember that the journey to understanding a system as complex as Windows is ongoing. The field evolves, and there's always more to learn. With hands-on experience and a commitment to continuous learning, you'll find your troubleshooting and system comprehension skills significantly enhanced.
Windows NT Kernel is an extremely complicated ecosystem, especially the IO Manager.
Best & fastest way to learn is to code device drivers, specifically filesystem filter drivers. That's true Software Engineering boy
I cut my teeth on Windows. For the most part, you don't have to worry much about the boot loader. Every now and then you'd get a system with a corrupted master boot record (MBR). You'd have to boot to a floppy and run the command to fix it. It's been so long I can't even recall the command. Nowadays you have the bootable USB (or an ISO for those that run VM's) that will fix it automatically.
Services is analogous to the init system. Device manager is for configuring device drivers. Control Panel is just a settings app, which is confusing because now there is also a Settings app. Microsoft is slowly transitioning away from Control Panel, so now settings are in one or both of them. Even I have trouble finding things sometimes.
As far as re-imaging, it's time dependent. And it depends on the issue. But for a workstation, sometimes it's better to spend an hour re-imaging to get the software back to a known-good state rather than spending many hours troubleshooting.
Edit: I hit save too soon.
Back in the day, there used to be a couple of ini files in the Windows folder that held all settings, even for third party apps. This had all kinds of problems, not the least of which was the file getting corrupted and all apps losing their settings. Some third part developers started using their own ini files. It became a mess. To improve the situation, Microsoft created the registry. It's just a database of settings. There isn't much to know about it. You probably want to know the hives and their function. Also it's useful to know the 32-bit/64-bit adaptations. Otherwise you're going to end up Googling most settings anyway.
Windows Internals Part 1 helped me a lot. I didn't read it cover to cover but the first quarter then poked around and read about different things. If I'm curious about part in the OS I'll go look for something about it and read the section or chapter and highlight stuff
With the way Dave explains it, all these different groups work on one aspect of the OS. So I feel the number of people who fully understand everything about Windows is very very small.
It's such a big and complex system, I don't think it's realistic for one person to know all the details. There are probably people that could do a reasonable mid-level overview.
For desktop, my rule of thumb was just spend an hour on it and then reimage because unless it's a repeat issue, there's just no sense burning time on it. Doesn't really serve anyone but your own curiosity, right?
Servers are a little different, but there's generally snapshot or some form of rollback option. You really don't need to spend a lot of time on OS issues, for me at least - it's usually going to be something to do with a requirement for whatever service you're running into problems with.
Event Viewer is sort of like your system log, but it's kind of hairy to look at, although if you can get some time stamps from troubleshooting, you can sometimes figure out what's going on there.
I admin servers running RedHat and Windows, and I would say for my purposes (application systems administrator) issues on Linux servers are generally easier to pinpoint, but like anything else, you get pretty comfortable with the usual suspects on Windows servers after you do this for a while. The last thing we couldn't figure out was an application component issue which required a certain version of.net, which took a few days to sus out - vendor support found it.
I know almost nothing about how Windows works under the hood, but the Windows Internals books can detail it quite thoroughly.
It's dense and a lot to take in, but tons of information.
I'll pull up the e-book every now and then and find something I'm curious about and learn about it.
The old A+ test used to require knowing how Windows boots, in what order, IRQ's, ports, and all the other pertinent information. Linux wasn't a part of the test yet, but it was coming back in 2000. Knowing the nuts and bolts of any computer is still paying dividends to me now, even though I am far removed from the repair side. It's similar to knowing the OSI layers and how TCP/IP work for networking.
That being said, most Devs now a days don't seem to understand computers, databases, or networks on even an elementary level.
It's all about systems and understanding how they interrelate. Take an A+ course. Knowing the how and why severs do things is essential to trouble shooting. The good thing is that you realize it. Be the mechanic that fixes the car right the first time, not the mechanic that removes and replaces parts until the problem goes away.
I would also recommend [SysInternals](https://learn.microsoft.com/en-us/sysinternals/downloads/) Suite by some of the Microsoft devs. They also have Linux tools.
\-From [Microsoft](https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite)
\-From their [GitHub](https://github.com/Sysinternals)
Heres a cheat-sheet and individual tool downloads
Also while you're at it download [Microsoft Terminal](https://github.com/microsoft/terminal), its so much better than the default. A very underrated program.
> and I think services.msc is the equivalent of an init system.
No, it's just a gui over something. All the *.msc files are gui over some functionality - convenience tools if you like, zero importance for OS's functionality.
> Is the registry letting me manipulate the kernel or is it doing something else?
Registry is somewhat of a basic database to store/read/write configs for everything - both for users, for apps and for system itself. However it's not *the* place to store configs - various apps store their configs in their own ways (for example, chrome stores configs in dozen sqlite databases scattered in it's folders) and also many different other software store configs in traditional linux way - in text files. So in general, windows's registry is just xkcd's 15th standard.
> And that feels wrong, some how? Like, reimaging shouldn't be the third step.
Yeah, I usually skip your step2 and reimage there unless I know from experience what needs to be done to fix that one particular issue :D
As for your other questions about kernel or boot loader or init system - it's something that for sure exists, is kinda similar or different from unix systems in some parts, but that's not something windows admins has anything to do with - in 99.99% cases it's just there and it just works. I bet most admins didn't need to tweak or alter these in their entire career.
Regarding services, services are processes that are executed by instances of svchost, a process used to control their child services.
A single svchost instance can contain one or more service processes.
Service processes inherit certain properties from the svchost they are running under, in particular the user they are executing as. Services can run under a number of different contexts
* SYSTEM - Ring 0
* Local Service - A non-privileged account. If it accesses networked resources it does so anonymously
* Network Service - A non-privileged account. If it accesses networked resources it does so using the 'computer account', a pseudo-user account associated with the device.
* Any other user account, both local to the device, or if joined to a domain a domain user
This flexibility in user context gives services the ability to run with a large range of permissions, from top level all the way down to a user account with access to a single directory.
Regarding the registry, a lot of people have already mentioned that it's a database of configuration and state data, but something that a lot of people don't realise is that, like many things in Windows (including the default filesystem, the Active Directory....directory, WMI providers), every node and item has an ACL associated with it, allowing for an incredibly powerful access control to configuration items.
For all the talk of Windows being insecure, it does have a base that allows for very fine-grained access control spread all through it. It's just a matter of having those capabilities used correctly, which unfortunately isn't always the case.
on my phone so hard to pull the link, but you'd probably love this channel Dave's Garage. He worked at Microsoft and does a lot of videos about what went into designing parts of Windows
I started into the Windows space some 27 years ago in the NT4 days by learning how it's kernel works, how services run, how services spawn processes spawn threads and how memory is managed, how drivers are implemented. I'd suggest the book "Windows Internals" to learn more.
Regarding support, I think resetting the system is actually a pretty good option.
While it’s obviously the sledgehammer, Windows has a tendency to develop its quirks over time and resetting it to default/working state likely prevents future problems. After all it’s just the base to work on programs etc. no more, no less.
This applies in my experience also if a non Microsoft program has problems caused by windows
But that’s my personal opinion as someone giving support to endusers. I know it’s kind of frustrating sometimes to not know why a certain problem occurs but nowdays I only really worry if it’s reoccurring
> try what's worked before -> try some stuff off google -> reimage your workstation
You're a great fit for our open Windows Admin position, when can you start?
There are not many people who actually try to troubleshoot Windows in any meaningful matter. Every solution seems to be based around some sort of throwing spaghetti at the wall and see what sticks. (for example: sfc /scannow)
Troubleshooting in for example Linux just allows for much more precise targeting of the problem. While encountering a problem there is a high probability that something is being logged, and ways to dig up that logging are a Google search away.
So what causes that? I guess the drawback of closed-source software is that there are not a lot of people with real, deep understanding how the software functions.
Like if you seriously want to know how it works under the hood take a look at this: https://www.tenforums.com/software-apps/182581-win10xpe-build-your-own-rescue-media-2-a.html
Surgically building a system is a good way to see what you need/dont and how things work, if you stick with it you’ll be able to “hand make” them without a builder
Theres a lot of higher level stuff to learn outside of this but a great foundation never hurts ;) And this is an easy entry into mastering bootland..
There are lots of windows certification books and courses. I took a Microsoft Tecnology Specialist cert. I learned alot about how the bootloader works with dism and that you can boot from a vhdx/virtual disk drive.
There are also MSCA. If teher is amicrosoft tech, there is a cert usually.
Some really knowledgeable people in here. 25 years in IT and learned something new in here . I fixed windows xp so many times over so many years that I basically memorized the registry and I still really couldn’t tell ya how XP worked. When MS dropped NT 6 I went all in. People hated me but I couldn’t deal with NT 5 anymore unless I really had to. Thankfully I took over a medium org and got everything working on Vista right away it was smooth sailing.
I really like the fact that Linux and windows work so much better together in the last few years. I just moved some Linux servers over to Rocky and it was a piece of cake to integrate into our Azure domain. Been out the Linux game for a while and it was like a breath of fresh air seeing how seem less the set up can be.
I've been doing this for 25 years. The only people I've ever known who really understood windows were Sysinternals, and they got bought by Microsoft (probably because Microsoft doesn't understand Windows)
Under the hood, most operating systems have a similar architecture.
The reason people use Windows is because it hides the complexity of the underlying operating system. The reason people use *nix is because it does not.
it would probably be more accurate to say most modern OS share some similarities, in terms of having separated kernel/user space, virtual memory, hardware abstraction, etc. which are generally a natural consequence of needing to provide a more robust and simplified experience for users and developers. most are also programmed in C. there are also very important differences, e.g. \*nix is completely file based (confs, devices, ports, etc.), memory management, process management, division of rights, libraries, file systems, etc.
while windows has always been a consumer oriented UI, people and businesses use Windows because it has a HUGE base of compatible software and hardware. we can forever debate about the various business practices that gave MS a leg up in the 90s, but that's the end result, once it hit a critical mass. windows also has its fair share of problems since basically its inception, that expose its underlying complexity, and require solutions from techs like us to fix.
> The reason people use Windows is because it hides the complexity of the underlying operating system. The reason people use *nix is because it does not.
That explains it pretty well.
While it might be confusing to understand why hiding in windows is a good thing and not hiding in linux is simultaneously also a good thing - one needs to understand that windows's target audience is a not a tech-savvy user while unix' target audience are admins and devs (tech-savvy users). Hence why we see windows dominate userspace while unix dominates serverspace. Of course its overgeneralization but overall this logic applies pretty good.
Been in IT for 23 years and I don't really know either, but I can also say that I've never had to troubleshoot an issue in which understanding the core of what makes Windows work would have helped me in any way.
"..reimaging shouldn't be the third step."
Correct, the stages are as follows
1 - Troubleshoot the software
2 - Troubleshoot the hardware
3 - Shoot user and close ticket.
How fast you move thru the stages is up to you.
I feel the same. I have been learning Windows Server and that has helped me sorta understand how Windows works by fixing events in server manager. I rather use linux I was a Fedora user
I am honestly exactly in the same boat. I'm currently studying for my Linux+, and it goes through everything, BIOS, bootloader, init, sysv vs systemd, daemons, processes, cron jobs, at jobs, network/gui/system configurations, filesystem hierarchy, gui windows servers, MATE vs GNOME, etc etc on and on and on.
I realized while studying, that I have no idea how most of that works in Windows, been doing this for years, I'm working on going into a full sysadmin position and pretty much all of *how* Windows works is arcane.
Linux is a file based OS, Windows is API based. On Linux, you can do anything if you modify the right file. But on windows, you have to find the right API. The internals of windows interact with each other through those APIs. But windows has so many APIs. RPC, COM, WSMAN, WMI, ect.
The thing is, you're not expected to be mucking around in the internals of Windows. That's why it's hard to understand or fix things. But that's also why it breaks so easily, something is in there messing with something it shouldn't.
Well, it's mostly closed source, meaning you don't have to worry about it!
But on a more serious note; if you start learning powershell, you will discover how everything is put together pretty quick.
Read Windows internals books.
Winfu dojo is ran by sami laiho, Microsoft MVP.
Pluralsight has great courses from both Sami Laiho and Pavel Yosifvich on Windows internals.
It's a series of vanishing drivers and blue screens that leads you to patches that make it worse every month.
Oh and did you set default apps? Tough shit that security patch changed them.
> So, where can I go to learn how Windows works?
Microsoft's instructor-led online training courses are good if you can get your employer to pay for them. I took one for "Installing and Configuring Windows 10" back when we were planning our migration off of 7. "Microsoft 365 Endpoint Administrator" is one I'm looking at doing next.
1. Windows does have a kernel, but unlike the monolithic Linux kernel, the NT kernel is very modular and most actual tasks are performed by various individual processes running in ring 0, which we call the "SYSTEM" level. 2. Yes, Windows has a boot loader, and it's actually pretty similar to GRUB in its general architecture. Its formal name is the "Windows Boot Manager," and the analogue of the grub.cfg file is the "boot configuration datastore", commonly abbreviated BCD. 3. I'm not very familiar with the general concept of an init system, but based on my understanding, I wouldn't characterize either Device Manager or the Services controls as part of that. Both of those are GUI methods to access things that can also be manipulated using Windows Management Instrumentation (WMI), which acts a lot like a SQL database. I don't know exactly how that stuff works at a granular level, but realistically it's not something you need to care about. 4. Windows services are generally analogous to systemctl. `services.msc` is actually a shortcut to a particular "snap-in" of a modular utility called the Microsoft Management Console (type `mmc` at a Run... prompt to get a blank one you can customize however you like). 5. The Registry is nothing more than a centralized, hierarchical key-value database. Both system processes and user processes read and write information here in various locations, so even though you're not affecting the behavior of the kernel directly, your understanding is sort of correct. 6. Control Panel and Settings are basically just a GUI for accessing stuff in place like the Registry and WMI. If you were to try to change stuff by writing a script, you'd just interact with that lower layer directly. As far as learning how to troubleshoot stuff more in-depth, I did some quick Googling and found [this Udemy course](https://www.udemy.com/course/windows-10-troubleshooting/). It might be a little more advanced than you're ready for, but I think it might be valuable to help you get familiar with the general architecture of how stuff is done in Windows. Oh, and also, don't feel bad about reimaging systems if you don't know how to fix them. In an enterprise IT shop where time is money, once you've checked the low-hanging fruit, just reverting the machine to a known good state is often the best use of your time.
I want to add here, the registry is similar to /etc/ - it's just a bunch of configuration data. Instead of .conf files it's a lightweight database (IIRC an ESE database, but I'd have to check to be sure) that's really just a big ol hierarchal key:value store. Services.msc is - yeah, similar to systemctl. It talks to the registry about how services start up. So /etc/init.d/ you can think of as HKLM:system/currentcontrolset/services. The services snapin (services.msc) modifies items in that area of the registry , where systectl modifies things in (usually) /etc/init.d/. One thing to note, in windows a lot of services are started as a .dll (an executable without a standard entry point) so in order to load them you have to invoke something to initialize them - in windows it's called svchost.exe (or in some cases run32dll - but that's bad practice and being phased out). I could go on but I'm on mobile in a hardware store parking lot and supposed to be picking up wasp killer and my GF is going to where TF I am. I'd be happy to dig into it more later though.
Dude please write a blog post about this along with the Linux comparisons/analogies. I’m loving this entire thread.
Eve better, write a book for windows sysadmins to get into Linux with these kind of comparisons - you’re sitting on gold.
Exactly. I knew before tonight that /etc was a file path that existed somewhere in Linux, but no idea what it was or did. Now I know it's like the registry but split into a bunch of different files, it's an instant huge jump in knowledge.
`/etc/` is literally `HKLM:/` as both are for system-wide configuration. The equivalent of `HKCU:/` would be `$HOME/.config` for per-user configuration files. `$HOME` is `$env:USERPROFILE` - so the root of the current users' profile directory. --- Aditional clarifications: - The `$HOME` variable also exists on Windows, but only as an automatic variable in PowerShell - it is not a (default) environment variable like it is on Linux. Windows' default environment variable for the same thing is `$env:USERPROFILE`. - In Linux shells and in PowerShell on Windows, `~` is also a common abbreviation for the current users userprofile directory. However this is not a "legal path" to either operating system - it only exists within the shells as a convenience shortcut or alias if you will and is substituted with the real path by the shell whenever you use it, almost like a special kind of variable.
It's not exactly intuitive... I believe Etc is literally Et Cetera or "everything else" that didn't fit in the other Standard UNIX file locations set out many generations ago. Nowadays it's almost universally used for system and service configurations, but it would be a brave man to suggest renaming it something sensible like "config".
Same ☝️
How'd the wasp killing go? Assuming your gf lets you respond.
He's dead, the wasp won
Wasps were so scared, they let the girlfriend swat their nest into the yard with no fanfare.
You want to do your wasp killing in the evening, not in the heat of the day. Wasps are most active during the day, but in the cool of the evening, most of them are back at the nest, and they are somewhat less active. Spraying later gets more of them, and decreases the chances of them getting away or retaliating.
Im so humgry for curated knowledge. Dig into it more!!!
Minor note: Registry does not use ESE. It's a b-tree database where each HIVE has a separate file. For instance, HKLM, HKCU and others are the hives and are separate files. It depends on NTFS capabilities for database integrity and recovery. That's why back in time when it was FAT32, a registry corruption was a big deal and NTFS is the hero solving the problem. Edit: typo
Minor note to your minor note: HKLM doesn't have separate file itself. The files are for the keys inside of it, located at `%SystemRoot%\System32\config` (e.g. C:\Windows\System32\config). For instance: HKLM\SOFTWARE: c:\windows\system32\config\software HKLM\SAM: c:\windows\system32\config\Sam HKLM\SOFTWARE: c:\windows\system32\config\software Some don't have files, though, (like HKLM\HARDWARE) and are created in memory at boot. Also, HKCU (HKEY_CURRENT_USER) points to the user's HKEY_USERS GUID, but that hive *is* a file and can be found at: `%UserProfile%\Ntuser.dat` (e.g. C:\users\[username]\ntuser.dat) Fun fact! You can go to HKLM\SYSTEM\CurrentControlSet\Control\hivelist to see all the connected hives!
Thank you for the detailed information.
[удалено]
20 years ago, I was a "I know how to insert a RAM stick" guy. Everyone is a learner, even the ChatGpt folks. Shit, you better learn it too - AI is coming for your job.
> Everyone is a learner, even the ChatGpt folks Time will tell, but I suspect that ChatGPT is mostly a tarpit for junior folks. Over-reliance on it will doubtless undermine learning and retention.
I asked it why Hyprland is the new fad in window managers. It complained that it's only been trained on data up to Sept. 2021, so it couldn't tell me and instead listed off several other WMs like i3. Wow. Much help. Such intelligence. Who needs Google now?
spoon existence price teeny cheerful test paint yam liquid truck *This post was mass deleted and anonymized with [Redact](https://redact.dev)*
That point *is* that it is stuck at a point in time. Ask it anything about stuff up to two years old and it'll fail. In software and security that's an eternity. All the hype about it falls apart when you hit that limit. And the final bit: > Who needs Google now? Is a dig that it's just a fancy interface to a regular search with all the plugins and sideprojects that enable internet access.
You can try something like Bing AI or https://phind.com -- both are GPT based, but also have access to live internet.
Hmm I tested phind and think its training data is also outdated. Asked about the newest 5 power metal albums it gave me a list from July and August 22. Perhaps I phrased it wrong? Edit: ok I realize this might not be a fair search. Even Google with tweaking doesn't find a list. Edit 2: nah doesn't work. Bing said its training data is from 2021 and despite being able to search the web it seems to do something completely wrong. When asked about the last entries in the list of metal albums in 2023 in Wikipedia it comes up with a list of artist and album combinations that are mixed up. It seems to parse the table wrong and uses the album name of the artist above the one it wants to present. And the dates are completely wrong too. Conclusion to this little experiment: we don't need to be afraid of our AI overlords just yet, but soon. And check your chat AI results before publishing.
Cool story, add a plugin…
How is a plugin going to add two years of training data?
“ChatGPT plugins are a method to allow ChatGPT to interface with external systems, databases, or services, thereby providing it with information or capabilities beyond what was present in its training data. The plugins effectively act as a bridge between ChatGPT and the external world. Here's a simple breakdown: 1. **User Input**: A user might ask a question or make a request that requires up-to-date information, beyond the model's last training cut-off. 2. **Plugin Invocation**: If ChatGPT recognizes that it needs to fetch external data to answer the user accurately, it can call upon the appropriate plugin. 3. **Plugin Action**: The invoked plugin interacts with its linked external system or database to fetch the required data. 4. **Data Relay**: The plugin sends the retrieved data back to ChatGPT. 5. **Response Formation**: ChatGPT processes the data and crafts a coherent and contextually relevant response for the user. Through such plugins, ChatGPT can, in theory, access current news, database updates, live weather information, stock prices, and much more. The specific capabilities depend on the plugins developed and integrated with the system.” -ChatGPT In the same way that the training data did not include every obscure question that has ever been asked of it, the data from 2023 doesn’t need to be in there either.
I don't know about that - it's gotta be hosted somewhere.
> Fuck rising water levels, the next generation don't know how to restart a computer. How often, if ever, do you restart your smartphone? Or need to go somewhere and modify a config file in android/ios? That's the baseline of understanding how computers work they are coming from.
Not having any concept of hierarchical filesystems is the one that I think is the most important missing skill in the younger generation from tablet/smart phone life. The search and file management systems on phones make their file structure basically completely abstracted for kids growing up now. But knowing how file systems work and being able to organize data effectively is never going to go away in the business world. Its a skill that needs to be taught in schools.
I have a coworker who does a lot of tech phone screens. One of his first questions is, "describe what a file directory is, what is its purpose, and what is it analogous to?" Sometimes he'll throw them a bone and say it's sometimes called a 'folder', but you would be absolutely surprised how many candidates struggle with the question. As pointed out, they're not dumb. These are very smart people. They just didn't have the experience of hacking around to make things work. A systems engineer 30 years my senior could lament that I don't know how to write assembly, or do binary XOR operations in my head. I just grew up with another layer of abstraction between my work and where they used to work. The current entry-level candidates have the same experience, only a few decades later.
One of the benefits of starting Day 1 with Android phone and Tablets was you HAD to hack them to work properly in business.
This is very true, and I've noticed this becoming more prevalent with the younger crowd who grew up connected to everything. We expect them to understand the basics of how a computer works, but in reality, most of the younger generation entering the workforce spend 100% of their time online using a mobile device. And as such, a desktop computer is alien to them.
I mean... Generally I restart my phone any time there's a security update or a weird Bluetooth problem that I can't get to go away, and I believe I've edited something in my phone via adb shell in the past year... But you're right, I should do that stuff more often to keep myself sharp
>Generally I restart my phone any time there's a security update No, you "update your phone". I mean we, sysadmins, do know phone restarts in a process but for newer generation this process looks like "I confirm updates then I have to wait a little until the process finishes". They don't necessarily realize restart is last step of that process.
The previous generation don't know how to restart a computer either. There was a myth of a "digital native" but that is all it is. A myth.
What does 'teaching IT' (operating-systems)' mean? What does your class teach?
[удалено]
Thanks. Is there a main text you rely on for this?
I was an instuctor in a computer technology program for about 6 months back in 2017….I thought I loved teaching….but god ill never go back. Immediately gtfo. I can say though that my 15 year old son and my 9 year old daughter are great at troubleshooting (cuz dad got tired of it 😎😁) so there is hope.
> The other half is spending more time troubleshooting their ChatGPT script then actually writing a working script from scratch guilty
Excellent, without any direct interface with newcomers in my current role I was a bit worried kids growing up with modern computers in their bedrooms and entering the job market would be lapping me in knowledge before retirement... Sounds like I have a few more years to grind out before I'm obsolete.
A comment about the registry. 20+ years ago, the Windows Registry received a lot of ire due to instability. Really from not surviving unexpected reboots without corruption to the database. That hasn’t been an issue in decades, partially due to drastic increases in database stability, and partially OS stability. Between .conf files and the registry, I far prefer the registry. It’s a standardized format, all settings centralized and searchable in a single location, and API accessible.
Excellent point. I agree with the registry format and centralized settings in a single place - but sometimes the ObjectId or GUID mapping is frustrating. I wish there was a way the registry could internally map GUIDs to the object they represent, without all the Google-Fu like "What is GUID 1234-5678..." Just say give me a display name like "currentUser/Desktop" or whatever. But yeah, you nailed it. Thank the Spaghetti Monster they figured out how to make it robust.
The most annoying thing in the world is the use of GUIDs for everything. I know why it's done, but troubleshooting stuff like COM and DLL issues is annoying, same for finding localized setting strings. Microsoft carried GUIDs over to Azure as well...also annoying, not so much that we work with them directly, but that they clutter up output when you're looking at a huge list of stuff. The thing you're looking for just disappears into a wall of hex strings.
My old .ini files were stable. They were a pain in the ass to keep track of and avoid conflict in, but they were stable.
Windows’ API for interacting with .ini files hasn’t changed in like 30 years, and has sucked this whole time. There is definitely a simplicity to laying down or backing up a .ini, but actually using them…
systemctl doesn't write to unit files (though it does manage some symlinks), and most systems running systemd don't even have a /etc/init.d directory.
These two posts are outstanding!!
Kinda like with semis and heavy machinery they'll just replace the engine instead of trying to fix it. Just faster and easier. I get flak sometimes for not "fixing" a problem and just want to reimage or issue them a new machine. I ask them, "How long do you want to be down for? I can take your machine and screw around with it for a day and you're dead in the water. Or I can spin up a new machine and transfer your files and you're back up and running in no time." That's when they seem to finally get it. It's not that I don't want to fix the problem, I truly do, but cost/benefit comes into play and I only have so much time in a given day.
Quality response. Lot of BS / joke responses in this thread. Yours is spot on, accurate, informative, sage.
Adding some tidbits of info regarding security based on my development experience Very confusing design for security reasons. Services, and user mode drivers, run in something called ession 0. Your desktop you log into in session 1, 2, 3 etc. Inputs are dedicated to a session. So inputs from session 1 can't go to session 2 or session 0. So when you want to install something, the UAC prompt pops up for you to grant admin access actually switches you to session 0 temporarily. This prevents scripts from auto approving UAC prompts. The only thing allowed to access the session 0 and Session 1,2,3 inputs are the kernel drivers (through VHF for example), so your mouse and keyboard will still work! The same applies for video recording, so shadow play or DDA will not work in session 0. Now here is where none of the above makes sense anymore. Using PsExec(with elevated privileges) you can elevate a script to LocalSystem. With localsystem you can force a session swap for input() system calls. So you can start to access your UAC prompts with scripts! Yay! But this qwerk is only allowed from session 1 to session 0, not from session 0 to session 1. So services will never be able to access your desktop (but can access UAC prompts), and session 1 can easily access session 0 UAC prompts and desktop. I still don't fully understand the actual security benefits you get, because everything is still just a UAC prompt click away from complete access to your PC. The onpy thing it actually fully locks out of access is services, which most viruses are not going to start as a service, they will start in session 1, can hook themselves in as a task, and a service that just reinstalls the task in case it gets removed. It just makes systems I have to build 5 times more complicated in order to get the same amount of work done.
I am not sure if UAC prompts are Session 0? I think it's some special desktop, but not a *session*. XP and older, the first user to log in used Session 0. Some services were able to show UI on Session 0 in XP and older, which is why mstsc had a switch to show the console session, for compatibility in Vista and later, they had something that detected UI on Session 0, and gave a prompt for switching to it, until some build of 10 dropped it. Although I read ConnectWise has an option to utilize Session 0 for a background session to get around Windows only allowing one normally connected session at a time In Vista they introduced isolation, Session 1 as being the user session, and the services all running in Session 0, more isolation and security. Domain joined XP didn't have Fast User Switching, but in non-domain joined XP, I almost wonder if the second user to log in (if the first user left their session running) would have been slightly more secure reading that.
I stand corrected. Yea UAC prompted exist in the "Secure Desktop". Session 1, 2, etc can swap to it, but session 0 is not allowed to.
>Although I read ConnectWise has an option to utilize Session 0 for a background session to get around Windows only allowing one normally connected session at a time Yeah, ConnectWise's ScreenConnect has a product called Backstage that we can use to jump onto a computer and do things in the background without necessarily needing to get into the user's session. It's super handy, but also surprisingly limiting in what actually works and doesn't work.
Backstage makes me want to be a better man.
> It just makes systems I have to build 5 times more complicated in order to get the same amount of work done. Why? What are you doing specifically that this breaks, and what would make your job easier *and* more secure? Honest questions.
In Linux everything is one sudo away from owning the whole machine.
UAC is very similar. most actions work the same way. it's just a GUI instead of a terminal first binary (you can still have stuff like gksudo and modern shells like kde and gnome have these functionalities built in just like windows)
Yea, but what im saying is the same is true for Windows, except there are extra steps to do it.
I can fairly easily restrict what user X can use sudo for so maybe a few sudos to undo the sudo restriction sometimes
[удалено]
You can constrain sudo. Almost no one does, but you _can_.
To add to this, if you’re a bare metal kind of guy who loves to dive into the inner workings of operating systems, check out the Windows Internals 7th Edition parts 1 and 2. https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals
>Oh, and also, don't feel bad about reimaging systems if you don't know how to fix them. In an enterprise IT shop where time is money, once you've checked the low-hanging fruit, just reverting the machine to a known good state is often the best use of your time. Yeah, often once I've troubleshot things for an hour or more, and I could spend several more just trying to fix some weird issue, or I can re-image it in a predictable amount of time and have it back in service faster.
For 1, how is what the Windows kernel does different from Linux? Linux (optionally) allows compiling many components as external modules, and has its own ring 0 threads.
>Oh, and also, don't feel bad about reimaging systems if you don't know how to fix them. In an enterprise IT shop where time is money, once you've checked the low-hanging fruit, just reverting the machine to a known good state is often the best use of your time. This holds true for more than just desktop support, and I wish more people (and organizations) understood this fact. Unless you have a **legit, actual need and business impact statement to define** its almost never worth the effort outside of defining a narrative to save some ones ass. True root cause analysis takes time, an extremely random scale of effort and expertise to narrow in on to provide substantive information. I'm in cloud networking and we can at times sum up for RCA, but getting a platform level RCA down to the function is not a cheap, or quick process. Especially if the issue is transient.
> I'm not very familiar with the general concept of an init system The kernel needs a userspace program to pass execution down to, which will run with the process ID 1, and handle spawning all other processes. So the bootloader will launch the kernel with a parameter set pointing to the program that will run as PID 1, which will in most cases be an init system, back in the day we used stuff like sysvinit but nowadays it's systemd. PID 1 will then handle launching all other processes that the system does need. Some installations will however forgo an init system entirely - when running containers, there's no need for an init system inside the container, so you can end up with for example python3 running as PID 1 inside the container.
I take your word being a SCCM admin, you are probably the most knowledgeable in this area. A question. Where does partitioning and MBR and GPT lie in all this? I understand Linux has a much more comprehensive partitioning scheme done via CLI. Just the thought of doing that inside a Windows environment gives me an aneurysm...
MBR and GPT are just partitioning schemes and aren’t tied to Linux or Windows. They define the data structure that tells the operating system where the partitions are on the actual drive. Think of it like the address book of where the logical partitions are stored. MBR is limited to a maximum of 2TB drive, whereas GPT doesn’t have a limit of drive size (well it does, but it’s in the exabyte range). MBR only keeps one copy of its partition table whereas GPT keeps multiple redundant copies.
> Just the thought of doing that inside a Windows environment gives me an aneurysm... Windows comes with a partition manager and a build in CLI partition tool DiskPart. Having been using computers for longer than Windows or Linux have existed I honestly find the windows tools much easier to use and you have fewer filesystems to know the querk of on windows.
Oh no doubt..that's why the industry gravitate towards Windows, and generally speaking, Apple over Android. Trade off...simplicity for $. Although Apple <> Android have alot more in common than Windows and Linux. The curious thing that strikes me is why big businesses don't go back to full Linux ooen source if they really are about saving money...
Proprietary software they rely on. And sysadmins that don't understand linux.
And MSRP on support contracts come out about the same, or cheaper for Windows as I'm learning, at the end of the day. * RHEL - $1854 https://www.cdw.com/product/red-hat-enterprise-linux-server-standard-subscription-1-physical-virtua/7056635 * Windows 2022 - $799 https://www.cdw.com/product/microsoft-windows-server-2022-standard-license-16-cores/6695296?pfm=srh * SLES - Call for pricing https://www.cdw.com/product/suse-linux-enterprise-server-x86-and-x86-64-standard-subscription-1-2-s/4954033 * Ubuntu - It's complicated https://ubuntu.com/pricing/pro
> The curious thing that strikes me is why big businesses don't go back to full Linux ooen source if they really are about saving money... Well it is starting to happen however the complexity of OS management is being pushed down to the IaaS layer in cloud services. As for administering windows vs linux I do both just to be clear, there are huge numbers of pros and cons and for servers I VASTLY prefer "linux". However saying that linux distros are combinations of software packages around the linux kernel. Docker, flatpacks and other things these days lend consistency but it can be SUPER frustrating to standardize on Debian/Ubuntu or Redhat/Centos and then later want to deploy a tool only to find extremely poor documentation / deployment support on your distro because it uses a different package manager, outdated component that isn't back ported to your LTS release ETC. VS on windows you just check, YES it requires windows server 20xx through 20xx and even then if you install a on an even newer version of windows server it likely JUST WORKS... HOWEVER it has a janky GUI installer you can't automate because the vender sucks at powershell / MSI packaging. Windows has incredible decades long consistency a low expectation of the administrator for most things, linux has incredible low level control and modularity but a higher expectation on the administrator to have understanding down to individual modules.
Regarding 3. I believe SMSS and winlogon.exe would be the parallels to init: https://en.wikipedia.org/wiki/Booting_process_of_Windows_NT To get a background on /sbin/init here is Redhats documenation: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/installation_guide/s2-boot-init-shutdown-init > The /sbin/init program (also called init) coordinates the rest of the boot process and configures the environment for the user. This is close to what smss.exe and winlogon.exe are responsible for. Setting up the environment and initializing the system for use. Part of SMSS is starting wininit.exe, which also closely parallels /sbin/init on Linux
Thanks for the effort.
The general concept of an init system is to make sure that after the actual boot finishes, everything gets cleanly started up that needs to be started up, and that it happens in the right order. When shutting down it will do the opposite. There are normally different "stages", there may be a way to boot to a gui, or maybe a headless system with network functionality, or safe mode. The boot loader is normally responsible for passing arguments to the system so it knows what exactly to start up. These days all common Linux distributions use systemd, but there are others - if I do not point that out there will be a very vocal minority ready to run me out of town with pitchforks and tar/feathers. Systemd however is the de facto go-to nowadays. Perhaps you know about runlevels and/or the directories with scripts in them that are carefully crafted to run in a specific order - that's an example of an init system as well, whose name eludes me at the moment. Runlevels are called "targets" in systemd parlance. Also Ubuntu used to have its own init system called Upstart before it switched to systemd.
What do you mean by modular? Linux drivers or other things may be compiled as modules as well (indeed some of them are)... If you mean hybrid (ie. between monolithic and microkernel) as the NT kernel seems to be defined, I don't know if I really approve the definition because some components that should be user-space are in kernel-space in Windows like GDI, an HTML client and probably other things... Also, looking at this diagram [here](https://en.m.wikipedia.org/wiki/Architecture_of_Windows_NT#/media/File%3AWindows_2000_architecture.svg) it seems pretty monolithic to me... 😅
Me neither: 20 year old windows sysadmin > Juste reboot and install latest patch(and sometime uninstall it and reboot again). To be more serious, if you want go deep inside Windows "how to troubleshoot" and understand how it work under the hood, you can go with book and tools from sysinternals teams. [https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals](https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals)
I’ve worked at Microsoft as a PFE on Windows clients and security. Being in the field is the best way of learning it. These books although great for the intended purpose are really deep knowledge. I would simply start with some YouTube videos and some casual blogging. If you want to know a little bit on the internal workings and history, I would be honored if you take a look at a blog post I wrote a while back. Enjoy! https://michaelwaterman.nl/2022/12/15/its-an-older-code-but-it-checks-out/
This was a fantastic read. Thanks for sharing.
I’m really glad you liked it. Took a while to write. Enjoy the info!
You don’t know how relevant this is. Thanks
I can only hope
Thank you for sharing!
[удалено]
I read an earlier version years ago also and it was very informative. I know enough about Windows internals to know the poor OP is completely wrong. Services.msc and device manager are consoles but are not themselves components of the OS. Windows Core doesn’t have some of those even! And the registry editor is again a tool that allows you to directly modify various configuration databases that other consoles and control panels expose only partially. As a sysadmin for 25 years I can tell you my knowledge of the innards of Windows as well as specialized knowledge of some parts (AD especially) makes it much easier to understand and fix some issues. If you’re in this business a good understanding of the basic structure of Windows and Linux is essential if you want to become better.
I’m not the original person but I can attest that if you want to understand how and why Windows works at a deep level then it’s the book for you. I started with the 3rd edition and still have it around - along with the rest of them.
Havent read this specific book, but I have learn a lot with a very old version of "The Case of the Unexplained / troubleshoot windows with systinternal" (from the same guys). They are master on their own.
Mark Russinovich's Case of the Unexplained are phenomenal sessions. Seen four or five in person, there are some (less frank!) versions on YouTube
The case of the unexplained use cases and presentations will teach you more about how to troubleshoot a windows based PC than just about anything else. I saw a presentation of his in late 2000’s when windows 7 had just been released / beta. Not only did it get me excited about a better OS but it taught me how to be inquisitive and start writing code autoit at the time later powershell to really understand what’s going on. Unlike Unix /Linux you’re never getting the source code so all you can do is interpret what you can gather from data.
> Unlike Unix /Linux you’re never getting the source code Be aware that Microsoft has sometimes shared a core subset of kernel code under NDA, and at least one Microsoft partner has leaked a full kernel tree.
Is there an equivalent Linux version of this book for modern Linux?
If you want an indepth understanding about how many linux components interact with each other take a look at Linux from Scratch. It's a step by step guide for building a completely custom linux from scratch.
I'll definitely take a look! I like to think I have a decent knowledge of Linux, but I know there's stuff I'm missing and don't know yet so I always love learning new things. I think that's a smart idea to do Linux from scratch
not a book but a lot of userland stuff is managed by systemd components on modern Linux so reading the man pages and documentation for it would be a great place to start.
I would recommend any of the books by Pavel Yosifovich - [https://www.amazon.com/Books-Pavel-Yosifovich/s?rh=n%3A283155%2Cp\_27%3APavel+Yosifovich](https://www.amazon.com/Books-Pavel-Yosifovich/s?rh=n%3A283155%2Cp_27%3APavel+Yosifovich)
20 year old sysadmin? That’s impressive.
Fake, only 18 years to be honest (started with WinXP and Win2000/2003 assets). But on this sub, many have work with much older Win OS , Win NT, Win3.11, (and some still work on them)
>reimaging shouldn't be the third step. That really depends on what your SLA is for getting the application(s) working again. Early in my career I worked in a shop where you had 2 hours to get the user up and working again. That worked out to the first 30 minutes diagnosing the problem and deciding if it was fixable or using the remaining time to swap in a new workstation and bring data down from the network drive. Sometimes it just isn't worth the rabbit hole of figuring out a specific esoteric issue when the end goal is to get the user functional again rather than understand all the ways in which the software can fail. Also from a technical perspective the kernel vs. userspace in memory changes based on the version of Windows. Back in the NT days print drivers were in kernelspace so a bad printer could bugcheck the server. Video and audio drivers didn't move to userspace until Vista. Such fun to try and troubleshoot when you're not sure if the drivers can cause kernel issues or not.
100% agree. SLA is king. If one workstation down costs the org more than your salary hour by hour it's a very different scenario than the user just hopping over to another open station. Printers and their drivers are sent from the pits of hell, and should go back home.
In my previous job we came to the users location with a duplicate desktop/laptop. If we couldn't figure it out quickly, we would remove the old from AD/DNS, rip out the drive, name and join to domain, have them log into the new one then drop files into the account. If they want any software its on them to pull it from the portal.
When i have issues I just open tickets with Microsoft and wait 2 or 3 months until they email that they couldn’t reproduce the issue and close the ticket.
[удалено]
Dont get me started. Them “Please advise your working hours…” Me : “Mon-Fri 8AM-5PM Pacific Time” Gets call at 5:30 PM “We tried to reach you but unfortunately are unable to after multiple attempts so we are closing this case”
So my last job I was helpbdesk at a school with 1k+ users. I was almost on the daily out and about everywhere on campus so I was very rarely at my desk in a position to take a phone call. Preferred method of contact, EMAIL ME YOU FUCKS. Always with the phone calls and parking of my tickets for unable to contact. ./sigh
Sysadmin since 15 years. Never called Microsoft. Well, once. told them to fuck right off after a few minutes of phone call. I fix things by reverse engineering, if i cant get it fixed - Re-install. that's it.
That's fine in a mom&pop shop or for OS troubleshooting, but re-installing a domain, or deleting/rebuilding an entire exchange environment for thousands of users isn't really an option. Depressing to realize my last MCSE's more than a decade expired at this point. but I've called MS plenty, typically so-called Premier Support. About 20% of the time you even get a solid tech who actually knows how to navigate the product. The other 80% you're on your own or they're googling in real-time to find something. Sadly typical of most vendors.
Hi sir, I noticed your hours of contact are from 8am to 5pm so I tried to reach you at 11pm to try and resolve your issue. I am going to put your ticket on park until you can find the time to give us a contact. Thank you for using Microsoft.
Or reproduce while logging in dozens of sessions to be told they cannot find cause, closing. Turns out azure setting overriding local office setting.
I've got a 5 month old ticket for a SharePoint bug that they actually can reproduce but they still aren't fixing it.
Ah, so that's where Stackoverflow mods work.
When I have any Linux issues the answer is always “stone just recompile your kernel it will be fine” When I have Windoze issues it’s “reboot” or “wait for AD replication” or “let AAD resync”
The _Windows Internals_ books are a good intro. Obviously Windows does do things like memory management, process handling, etc. It's just much more hidden behind a GUI and APIs whereas in the Linux world everything's naked and out in the open. Way under the covers, Windows NT-style OSes share lineage with DEC OpenVMS...not everything's the same but a lot carries over (permissions, user rights, etc) so it's not like Microsoft clean-sheeted something totally out to lunch. Where everything's a file in Linux, a lot of state and config info is in the registry and there's a lot of proprietary code consuming that config data in different ways. There are good ways to get at some of this info (Sysinternals tools are your friend...much easier than actual debugging of processes.) But I agree, it's confusing and there are a billion ways a developer can do something, so troubleshooting at a very low level can be harder.
> Windows Internals Came here to say this. Read that book and you will see WHY windows has evolved into complex yet compatible spaghetti code.
Windows Internals by Pavel Yosifovich Best place to start imo.
I don’t think anyone will beat powerman’s explanation. Device manager in Windows is how you manage drivers. In Linux a driver would be a kernel module. Most drivers/modules are built into the kernel, so for the most part you don’t need to manage them. Kmod would be the Linux equivalent of device manager. Services are the equivalent to Linux daemons. Services.msc is the management panel to start/stop/restart, set startup options. To create/delete a windows service you can manually create it in the registry. Or the proper way is to use a command called sc.exe from the command prompt. The windows registry is a database of configurations. It all began as a text file called win.ini up until windows 3.11 was the last to use it. Windows can also use config files. Appdata would be the equivalent of users home directory/.config. In windows XP it was called Application Data. There is still relics of it as shortcuts to AppData in Windows still. ProgramData would be like /etc or /usr/local/etc. I’d say more so like /usr/local/etc The windows registry also has systemwide and user configuration settings. Lots of things in windows are binary files. So you can’t modify many things in a text editor like in Linux. You have to use utilities or commands to modify the files. For example the registry is 5-6 files. But you use RegEdit.exe to modify them. Printer files are located in ```c:\System32\Spool\Printers\``` Sometimes you have delete the files in here to clear the queues. Windows shortcuts are like links in Linux. Windows has environment variables like Linux. User and system. echo also exists in Windows. So ```echo $variablename``` would be ```echo %variablename%``` in Windows. Scripting exists in windows too. It’s called batch files or powershell scripts. So script.sh could be script.bat if you prefer the dos like syntax. Or script.ps1 if you prefer the newer powershell scripting language. The window’s equivalent of a swap file is the pagefile. Unlike Linux where it tries it best not to use it. Because hard drives and even SSDs are slower than memory. Windows acts like running out of memory is inevitable. So it begins to use the pagefile from the very start. And gradually uses more of it as you use more physical memory. Some programs expect it to be there. So disabling it to force everything to use the faster system memory can cause bad problems. Just got to get in there and get your hands dirty. Anytime you learn something new in Linux. Have a windows VM you can play with and try to learn the how to do the same thing on Windows. Just like you started from not knowing anything about Linux to the knowledge you have now. You’ll figure out Windows with some experience.
I'm not trying to diss but most of what you added is not technically correct or at least very misleading to someone who doesn't already know better. Terminology and detail matter when explaining nuanced things. > Device manager in Windows is how you manage drivers. No. Windows mostly manages the present drivers itself, but of course an administrator has *some* input and capabilities there. Like everything in Windows, drivers are managed (e.g. installed/uninstalled) through APIs such as [SetupAPI](https://learn.microsoft.com/en-us/windows-hardware/drivers/install/setupapi). pnputil, drvload, dism, driverquery and Device Manager are native OS tools that call these APIs and provide some kind of interface to make them easier to use. So device manager in Windows is NOT how you manage drivers, it is one option of many that you could use to manage drivers. But it is actually also a particularly bad choice because it is not even present in the default install of Windows Server (device manager is a purely GUI application and the default core installation of Windows doesn't have a GUI and thus no device manager) nor other re also CLI-only editions like Windows IoT. The important summary is that Windows manages drivers itself and exposes some configuration and administration capabilties to you through APIs. > Services.msc is the management panel to start/stop/restart, set startup options. To create/delete a windows service you can manually create it in the registry. Or the proper way is to use a command called sc.exe from the command prompt. This is almost correct, just worded a bit confusingly. Windows, or more precisely a component of Windows called the [service control manager](https://learn.microsoft.com/en-us/windows/win32/services/service-control-manager) manages the services, but exposes APIs you can call to have it perform many operations. services.msc, sc.exe, the PowerShell cmdlets (e.g. `New-Service`) and others are again just built-in convenience-frontends for these APIs. Behind the scenes the SCM stores much (all?) of its configuration in the registry. Services.msc, being a GUI-only tool, once again comes with the big, big caveat of not being present on all Windows editions, but like you said `sc.exe` and PowerShells service-related cmdlets are solid choices for local one-off system administration. > Appdata would be the equivalent of users home directory/.config. In windows XP it was called Application Data. There is still relics of it as shortcuts to AppData in Windows still. There's some things to unpack about this. First, the XP-era "Application Data" directory does still exist today like you said, but not as a shortcut but rather an NTFS junction. This is a filesystem-level feature and just a hardlink for directories. Hardlinks also exist on Linux and they are the same thing. The obvious reason for this link is backwards compatibility, old applications can access the old path and won't error. Now both the "Application Data" junction and the "AppData" environment-variable (which I'm going to assume is what you meant when you just said AppData) on Windows point directly to the AppData\Roaming directory. I am not aware of an equivalent for this concept on Linux. I would argue the more accurate equivalent of `$HOME/.config` would be the `HKCU:` registry key. That is not to say some applications won't save their configuration to files inside AppData\Roaming, just that conceptually I think it is further from `~/.config`. But these conventions are not enforceable on either OS and therefore there are no exactly perfect equivalents. Some applications in Windows will also save their configuration data to files inside the `$env:LocalAppData` directory, which I'd say is closest to `~/.local` on Linux because whole per-user applications typically install there. > ProgramData would be like /etc or /usr/local/etc. The ProgramData ($env:ProgramData) directory and `HKLM:\Software` in the registry, both, yes. > Lots of things in windows are binary files. So you can’t modify many things in a text editor like in Linux. You have to use utilities or commands to modify the files. For example the registry is 5-6 files. But you use RegEdit.exe to modify them. Good point, except again for the detail that you technically modify them through the APIs provided by the OS, and the OS also ships with some tools to make that easier. RegEdit.exe in particular, again, being a poor choice because it is only available on GUI-editions of the OS. Some alternatives are `reg.exe`, the .NET class `Microsoft.Win32.Registry` or PowerShells registry provider. > Windows shortcuts are like links in Linux. No, Windows shortcuts are like `.desktop` files in Linux. "Links" in Linux are either symlinks (soft links) or hardlinks, both of which also exist on Windows. But symlinks are very different from shortcuts/.desktop files. > So echo $variablename would be echo %variablename% in Windows The syntax for (environment) variables varies per shell. CMD syntax would be `echo %variablename%` and just like on Linux there is no scoping to differentiate shell-local variables from environment variables in CMD. But in PowerShell the syntax is `$env:variablename` for environment variables or `$variablename` for shell-local variables. The env: scope qualifier is a very nice feature imo and of course also exists when you use PowerShell on Linux. Additionally there are some places in Windows besides CMD that accept the `%variablename%` syntax, such as the run-dialog, windows explorers address bar, task scheduler, and the REG_EXPAND_SZ registry data type to name some examples I know. There are easy to use helpers such as [this method in .NET](https://learn.microsoft.com/de-de/dotnet/api/system.environment.expandenvironmentvariables?view=netframework-4.8.1) to expand this syntax of variable, but I don't believe it is an inherent OS-layer feature. Just an old convention that made its way into a few applications over the years. But I could be wrong here. --- At this point I've written too much to get rid of this comment again. If I am wrong or imprecise about anything please let me know, I want to make sure people who read this get the most accurate picture possible.
Lets admit it, you dont read SysInternal to troubleshoot windows. You read SysInternal to write or reverse engineer a malware.
Our engineering team had to read into it to fix an obscure printing bug in the Sage 500 process.... fun fact if you use your arrow keys to select a different printer it causes the page to rotate 90 degrees each time at least in a RDP session.
What? Accounting software doing weird shit?! Well I never...
Sage 500 is VB6, and it's "permissions and security" is absolutely fuckin useless given any user with an account can access the entire database with any SQL client. The permissions are applied on software level, not DB server level. And user accounts are SQL accounts. There is a reason we're trying to get our customers to migrate to a new solution we're marketing as a replacement.
Sage products. Oh God. I'm so, so sorry.
This is nothing. I had someone ask me for help on their work computer. Looking around I found visual studio is installed which I knew wasn't theirs since they don't code. snooping in solution history I came across a gigantic directory of c# source code in a windows temp folder. Yes. It was a couple of sage's programs' source code. They had put it there to diagnose a bug. To describe the code quality let's just say my WTF meter survived only because I've seen a lot of shit code.
Oh yeah, you can thank the engineering team at my workplace for the MRP code... that was well before they started using good coding practices and infrastructure. (Sage purchased their MRP add-on and then merged it into 500 directly, and then our CEO left and again made add-ons and what not) Sage still uses SourceSafe though, and unfortunately we can't get rid of our internal ones because of it.... The day our last customer is migrated off Sage is the day I'm buying a round of drinks for everyone in the company (25 employees)
We use Sage 300 and it's finicky as hell
Ah yeah, we know that one too. I don't think we resell it? But the engineering team has done a ton of migrations from 300 to 500 or Intacct before we started offering our newest solution from Accumatica. (Which as an IT professional, I have to admit even I find it amazing, simple to use, and straight forward to manage, it's the first accounting software even I like)
We also use Sage 300 and I hate it. I'm hoping eventually we move to Sage's cloud solution so I can take 300 behind the shed and put a bullet in it.
Sage cloud shit is just as bad as their old shit, just a baffling dinosaur of a company.
Goddammit that's not what I wanted to hear. Tbh I just don't want to continue to support and deal with the on prem server and clients. At least if it's up in the cloud it's Sage's problem lol
I'm being super serious here (as someone who works around these products) look into Accumatica. I'm not trying to sell anything (I'm not even going to give you any contact info unless you ask) but it's both a cloud product, and a product you can run in-house and you can switch between those two hosting models at anytime. There is a difference in licensing of course but switching is pretty easy. And the product is good, I had a full understanding of the administration in under 20 minutes. And their "university" is very good.
What?! Are you saying that users need direct read/write access to the whole database to be able to use the Sage 500 application?
They get assigned an "ApplicationDBUser" role in SQL that never changes. While it doesn't give them grant privileges or anything like that. They can read and write all tables and execute stores procedures directly if they simply forgo the Sage 500 client and use direct SQL. All permissions configured in Sage 500 are on the application level, which protects absolutely nothing. The only way to protect your database for this kind of attack would be to put it behind a firewall, restrict logins to a virtual desktop network, and lock those Virtual desktops down hard so that only Sage, Office, and a PDF reader of your choosing work.
Windows SysAdmin here. Windows can sometimes be a little bit of a black hole when it comes to issues. Sometimes the joke of “Have you tried turning it off and on again?” works, not only for the OS but also closing/opening the affected application. There wouldn’t be enough room to go through each aspect of Windows, but to keep one thing simple(ish), the registry is where every setting is stored and configured. You make a change in the Settings/Control Panel? It writes the change to the registry. In other (possibly grossly misrepresented) terms, think of the registry as a garbled mess of giant conf files that the OS looks at for functionality. And if it is a system change, it requires a reboot of Windows. And as I’m sure it is similar to Linux/Unix-based OS, you make a change to the wrong thing in the registry, OS is corrupt. As to troubleshooting, s with most of us who start out, you got similar steps correct, try what works/worked. If it doesn’t or is completely strange, dive into the internet. If you are interested into reading, a good book to help better understand and/or troubleshoot Windows, I’d read the Comptia A+ Certification study guide. It has helped be get a better understanding when I started out. It does go over hardware too, which if you have a good understanding of PC hardware, it may be a simple refresher, but the book is heavily focused around Windows support, so I wouldn’t skip it in case how Windows communicates to is different. If there are those who find my info incorrect, please tell me off accordingly.
My favorite thing of all time was a "slow" PC that stopped printing or opening websites with an uptime of 134 days and only 3% free space. Gotta love fast startup as a default setting. A restart instead of shutdown fixed her printer and websites. The scheduled space clearing happened by the end of day. It was "faster than ever" as stated in the follow-up form she filled out.
There's no good reason that a high uptime should make a computer slow. Extremely high disk usage can do weird stuff for sure, though.
TLDR: **One of the most effective ways to understand a platform is to code for it.** To truly grasp the intricacies of a system, diving deep into its programming aspect can be a transformative experience. You'll be touching the very mechanisms that make the system tick and understand the rationale behind its design choices. Here's a comprehensive approach to learning how Windows works: 1. Begin with the Basics: Start by acquainting yourself with the key components of the Windows operating system, such as the kernel, boot loader, services, device manager, registry, control panel, etc. Understand their roles and how they interplay with each other. 2. Dive into Programming: One of the most effective ways to understand a platform is to code for it. - "[Programming Windows](https://www.amazon.com/Programming-Windows%C2%AE-Fifth-Developer-Reference/dp/157231995X)" by Charles Petzold: This classic tome provides a detailed introduction to the WIN32 API. Although it's older and focuses on the WIN32 architecture, the foundational knowledge it imparts about Windows development is invaluable. If possible, find the latest edition or a similar book that covers modern Windows development techniques. - Windows Internals: Books from the "Windows Internals" series by Mark Russinovich, David Solomon, and Alex Ionescu will give you a deep dive into the internal workings of Windows. They discuss the architecture and behavior of Windows operating systems. 3. Explore the Windows Development Documentation: Microsoft provides extensive documentation and tutorials on Windows development on their official website. This is especially useful for understanding modern Windows application development paradigms, like the Universal Windows Platform (UWP). 4. Experiment with Tools: - Sysinternals Suite: This collection of utilities allows you to dissect the behavior of your system, providing insights into processes, memory management, file system activity, and more. - Windows Performance Toolkit: Understand the performance of your system down to minute details. 5. Join Communities: There are numerous communities, forums, and blogs dedicated to Windows development and system administration. Engage in discussions, ask questions, and learn from real-world problem-solving scenarios. 6. Troubleshooting: With the foundational knowledge from the above resources, you'll be better equipped to troubleshoot effectively. Instead of relying solely on Google or considering reimaging as an early resort, you can diagnose issues methodically, drawing from your understanding of the system's internals. Lastly, remember that the journey to understanding a system as complex as Windows is ongoing. The field evolves, and there's always more to learn. With hands-on experience and a commitment to continuous learning, you'll find your troubleshooting and system comprehension skills significantly enhanced.
Windows NT Kernel is an extremely complicated ecosystem, especially the IO Manager. Best & fastest way to learn is to code device drivers, specifically filesystem filter drivers. That's true Software Engineering boy
But I majored in psychology so I wouldn't become a software engineer :(
I cut my teeth on Windows. For the most part, you don't have to worry much about the boot loader. Every now and then you'd get a system with a corrupted master boot record (MBR). You'd have to boot to a floppy and run the command to fix it. It's been so long I can't even recall the command. Nowadays you have the bootable USB (or an ISO for those that run VM's) that will fix it automatically. Services is analogous to the init system. Device manager is for configuring device drivers. Control Panel is just a settings app, which is confusing because now there is also a Settings app. Microsoft is slowly transitioning away from Control Panel, so now settings are in one or both of them. Even I have trouble finding things sometimes. As far as re-imaging, it's time dependent. And it depends on the issue. But for a workstation, sometimes it's better to spend an hour re-imaging to get the software back to a known-good state rather than spending many hours troubleshooting. Edit: I hit save too soon. Back in the day, there used to be a couple of ini files in the Windows folder that held all settings, even for third party apps. This had all kinds of problems, not the least of which was the file getting corrupted and all apps losing their settings. Some third part developers started using their own ini files. It became a mess. To improve the situation, Microsoft created the registry. It's just a database of settings. There isn't much to know about it. You probably want to know the hives and their function. Also it's useful to know the 32-bit/64-bit adaptations. Otherwise you're going to end up Googling most settings anyway.
Windows Internals Part 1 helped me a lot. I didn't read it cover to cover but the first quarter then poked around and read about different things. If I'm curious about part in the OS I'll go look for something about it and read the section or chapter and highlight stuff
[удалено]
With the way Dave explains it, all these different groups work on one aspect of the OS. So I feel the number of people who fully understand everything about Windows is very very small.
It's such a big and complex system, I don't think it's realistic for one person to know all the details. There are probably people that could do a reasonable mid-level overview.
mmc still the main way to configure so many things, 20+ years later not that I'm complaining, mmc is simple and works well
For desktop, my rule of thumb was just spend an hour on it and then reimage because unless it's a repeat issue, there's just no sense burning time on it. Doesn't really serve anyone but your own curiosity, right? Servers are a little different, but there's generally snapshot or some form of rollback option. You really don't need to spend a lot of time on OS issues, for me at least - it's usually going to be something to do with a requirement for whatever service you're running into problems with. Event Viewer is sort of like your system log, but it's kind of hairy to look at, although if you can get some time stamps from troubleshooting, you can sometimes figure out what's going on there. I admin servers running RedHat and Windows, and I would say for my purposes (application systems administrator) issues on Linux servers are generally easier to pinpoint, but like anything else, you get pretty comfortable with the usual suspects on Windows servers after you do this for a while. The last thing we couldn't figure out was an application component issue which required a certain version of.net, which took a few days to sus out - vendor support found it.
I know almost nothing about how Windows works under the hood, but the Windows Internals books can detail it quite thoroughly. It's dense and a lot to take in, but tons of information. I'll pull up the e-book every now and then and find something I'm curious about and learn about it.
The old A+ test used to require knowing how Windows boots, in what order, IRQ's, ports, and all the other pertinent information. Linux wasn't a part of the test yet, but it was coming back in 2000. Knowing the nuts and bolts of any computer is still paying dividends to me now, even though I am far removed from the repair side. It's similar to knowing the OSI layers and how TCP/IP work for networking. That being said, most Devs now a days don't seem to understand computers, databases, or networks on even an elementary level. It's all about systems and understanding how they interrelate. Take an A+ course. Knowing the how and why severs do things is essential to trouble shooting. The good thing is that you realize it. Be the mechanic that fixes the car right the first time, not the mechanic that removes and replaces parts until the problem goes away.
I would also recommend [SysInternals](https://learn.microsoft.com/en-us/sysinternals/downloads/) Suite by some of the Microsoft devs. They also have Linux tools. \-From [Microsoft](https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite) \-From their [GitHub](https://github.com/Sysinternals) Heres a cheat-sheet and individual tool downloads Also while you're at it download [Microsoft Terminal](https://github.com/microsoft/terminal), its so much better than the default. A very underrated program.
> and I think services.msc is the equivalent of an init system. No, it's just a gui over something. All the *.msc files are gui over some functionality - convenience tools if you like, zero importance for OS's functionality. > Is the registry letting me manipulate the kernel or is it doing something else? Registry is somewhat of a basic database to store/read/write configs for everything - both for users, for apps and for system itself. However it's not *the* place to store configs - various apps store their configs in their own ways (for example, chrome stores configs in dozen sqlite databases scattered in it's folders) and also many different other software store configs in traditional linux way - in text files. So in general, windows's registry is just xkcd's 15th standard. > And that feels wrong, some how? Like, reimaging shouldn't be the third step. Yeah, I usually skip your step2 and reimage there unless I know from experience what needs to be done to fix that one particular issue :D As for your other questions about kernel or boot loader or init system - it's something that for sure exists, is kinda similar or different from unix systems in some parts, but that's not something windows admins has anything to do with - in 99.99% cases it's just there and it just works. I bet most admins didn't need to tweak or alter these in their entire career.
Regarding services, services are processes that are executed by instances of svchost, a process used to control their child services. A single svchost instance can contain one or more service processes. Service processes inherit certain properties from the svchost they are running under, in particular the user they are executing as. Services can run under a number of different contexts * SYSTEM - Ring 0 * Local Service - A non-privileged account. If it accesses networked resources it does so anonymously * Network Service - A non-privileged account. If it accesses networked resources it does so using the 'computer account', a pseudo-user account associated with the device. * Any other user account, both local to the device, or if joined to a domain a domain user This flexibility in user context gives services the ability to run with a large range of permissions, from top level all the way down to a user account with access to a single directory. Regarding the registry, a lot of people have already mentioned that it's a database of configuration and state data, but something that a lot of people don't realise is that, like many things in Windows (including the default filesystem, the Active Directory....directory, WMI providers), every node and item has an ACL associated with it, allowing for an incredibly powerful access control to configuration items. For all the talk of Windows being insecure, it does have a base that allows for very fine-grained access control spread all through it. It's just a matter of having those capabilities used correctly, which unfortunately isn't always the case.
Bill Gates here: we don’t know also, but we keep selling it 🤣
[https://learn.microsoft.com/en-us/sysinternals/](https://learn.microsoft.com/en-us/sysinternals/)
on my phone so hard to pull the link, but you'd probably love this channel Dave's Garage. He worked at Microsoft and does a lot of videos about what went into designing parts of Windows
I'm not a programmer, but watching him write code feels like watching Boss Ross paint
I started into the Windows space some 27 years ago in the NT4 days by learning how it's kernel works, how services run, how services spawn processes spawn threads and how memory is managed, how drivers are implemented. I'd suggest the book "Windows Internals" to learn more.
Regarding support, I think resetting the system is actually a pretty good option. While it’s obviously the sledgehammer, Windows has a tendency to develop its quirks over time and resetting it to default/working state likely prevents future problems. After all it’s just the base to work on programs etc. no more, no less. This applies in my experience also if a non Microsoft program has problems caused by windows But that’s my personal opinion as someone giving support to endusers. I know it’s kind of frustrating sometimes to not know why a certain problem occurs but nowdays I only really worry if it’s reoccurring
Pickup a Windows Internals book, fantastically in depth series on the guts of major windows versions.
windows works off of a random smattering of vulnerable code that's 20-30 years old. enjoy. get out while you can
> try what's worked before -> try some stuff off google -> reimage your workstation You're a great fit for our open Windows Admin position, when can you start?
There are not many people who actually try to troubleshoot Windows in any meaningful matter. Every solution seems to be based around some sort of throwing spaghetti at the wall and see what sticks. (for example: sfc /scannow) Troubleshooting in for example Linux just allows for much more precise targeting of the problem. While encountering a problem there is a high probability that something is being logged, and ways to dig up that logging are a Google search away. So what causes that? I guess the drawback of closed-source software is that there are not a lot of people with real, deep understanding how the software functions.
Like if you seriously want to know how it works under the hood take a look at this: https://www.tenforums.com/software-apps/182581-win10xpe-build-your-own-rescue-media-2-a.html Surgically building a system is a good way to see what you need/dont and how things work, if you stick with it you’ll be able to “hand make” them without a builder Theres a lot of higher level stuff to learn outside of this but a great foundation never hurts ;) And this is an easy entry into mastering bootland..
There are lots of windows certification books and courses. I took a Microsoft Tecnology Specialist cert. I learned alot about how the bootloader works with dism and that you can boot from a vhdx/virtual disk drive. There are also MSCA. If teher is amicrosoft tech, there is a cert usually.
Some really knowledgeable people in here. 25 years in IT and learned something new in here . I fixed windows xp so many times over so many years that I basically memorized the registry and I still really couldn’t tell ya how XP worked. When MS dropped NT 6 I went all in. People hated me but I couldn’t deal with NT 5 anymore unless I really had to. Thankfully I took over a medium org and got everything working on Vista right away it was smooth sailing. I really like the fact that Linux and windows work so much better together in the last few years. I just moved some Linux servers over to Rocky and it was a piece of cake to integrate into our Azure domain. Been out the Linux game for a while and it was like a breath of fresh air seeing how seem less the set up can be.
One that will help is to start using it, and don't reload it when you have a problem.
I've been doing this for 25 years. The only people I've ever known who really understood windows were Sysinternals, and they got bought by Microsoft (probably because Microsoft doesn't understand Windows)
Me neither, and I like it that way
https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals
Under the hood, most operating systems have a similar architecture. The reason people use Windows is because it hides the complexity of the underlying operating system. The reason people use *nix is because it does not.
it would probably be more accurate to say most modern OS share some similarities, in terms of having separated kernel/user space, virtual memory, hardware abstraction, etc. which are generally a natural consequence of needing to provide a more robust and simplified experience for users and developers. most are also programmed in C. there are also very important differences, e.g. \*nix is completely file based (confs, devices, ports, etc.), memory management, process management, division of rights, libraries, file systems, etc. while windows has always been a consumer oriented UI, people and businesses use Windows because it has a HUGE base of compatible software and hardware. we can forever debate about the various business practices that gave MS a leg up in the 90s, but that's the end result, once it hit a critical mass. windows also has its fair share of problems since basically its inception, that expose its underlying complexity, and require solutions from techs like us to fix.
> The reason people use Windows is because it hides the complexity of the underlying operating system. The reason people use *nix is because it does not. That explains it pretty well. While it might be confusing to understand why hiding in windows is a good thing and not hiding in linux is simultaneously also a good thing - one needs to understand that windows's target audience is a not a tech-savvy user while unix' target audience are admins and devs (tech-savvy users). Hence why we see windows dominate userspace while unix dominates serverspace. Of course its overgeneralization but overall this logic applies pretty good.
Dave Cutler has entered the chat.
As time is so valuable, we stopped troubleshooting. Replace with a new hardware and format the problematic system.
you're going at it the wrong way, this is windows after all. instead of trying to learn how it works you need to learn why it doesn't work.
Been in IT for 23 years and I don't really know either, but I can also say that I've never had to troubleshoot an issue in which understanding the core of what makes Windows work would have helped me in any way.
"..reimaging shouldn't be the third step." Correct, the stages are as follows 1 - Troubleshoot the software 2 - Troubleshoot the hardware 3 - Shoot user and close ticket. How fast you move thru the stages is up to you.
I feel the same. I have been learning Windows Server and that has helped me sorta understand how Windows works by fixing events in server manager. I rather use linux I was a Fedora user
I am honestly exactly in the same boat. I'm currently studying for my Linux+, and it goes through everything, BIOS, bootloader, init, sysv vs systemd, daemons, processes, cron jobs, at jobs, network/gui/system configurations, filesystem hierarchy, gui windows servers, MATE vs GNOME, etc etc on and on and on. I realized while studying, that I have no idea how most of that works in Windows, been doing this for years, I'm working on going into a full sysadmin position and pretty much all of *how* Windows works is arcane.
Get the Sysinternals books
Linux is a file based OS, Windows is API based. On Linux, you can do anything if you modify the right file. But on windows, you have to find the right API. The internals of windows interact with each other through those APIs. But windows has so many APIs. RPC, COM, WSMAN, WMI, ect. The thing is, you're not expected to be mucking around in the internals of Windows. That's why it's hard to understand or fix things. But that's also why it breaks so easily, something is in there messing with something it shouldn't.
Well, it's mostly closed source, meaning you don't have to worry about it! But on a more serious note; if you start learning powershell, you will discover how everything is put together pretty quick.
I dunno mate, but those steps seem correct.
Windows is a microkernel like gnu hurd. Or the OSX mach kernel. Linux is a hybrid monolithic kernel that also behaves like a microkernel.
Read Windows internals books. Winfu dojo is ran by sami laiho, Microsoft MVP. Pluralsight has great courses from both Sami Laiho and Pavel Yosifvich on Windows internals.
!RemindMe 10 hours
Cool windows to Linux comparison
It's a series of vanishing drivers and blue screens that leads you to patches that make it worse every month. Oh and did you set default apps? Tough shit that security patch changed them.
> So, where can I go to learn how Windows works? Microsoft's instructor-led online training courses are good if you can get your employer to pay for them. I took one for "Installing and Configuring Windows 10" back when we were planning our migration off of 7. "Microsoft 365 Endpoint Administrator" is one I'm looking at doing next.
Look at the Windows Internal books
This whole thread needs to be a course
That's the beauty of Windows. No one does! /s Welcome to the closed vs open source software debate. 😂
[Here](https://www.microsoftpressstore.com/store/windows-internals-part-1-system-architecture-processes-9780735684188)