Windows OS — Complete Admin Guide

Editions Overview

Upgrade path: Home → Pro via Settings > Activation (product key). Pro → Enterprise requires volume licensing. LTSC is a separate SKU, not an upgrade target from Pro/Enterprise.

Architecture Overview

Windows runs a hybrid kernel architecture combining a microkernel-style design with monolithic performance optimizations.

• ntoskrnl.exe — The Windows kernel. Handles memory management, process/thread scheduling, I/O, and the executive subsystem (Object Manager, Process Manager, I/O Manager, Security Reference Monitor).
• HAL (Hardware Abstraction Layer) — hal.dll. Abstracts hardware differences (interrupt controllers, timers, bus interfaces) so the kernel stays hardware-agnostic across x86/ARM.
• Win32 subsystem (csrss.exe + win32k.sys) — Client/Server Runtime SubSystem. Manages console windows, process and thread lifecycle for Win32 applications. win32k.sys runs in kernel mode for GDI/User operations.
• LSASS (lsass.exe) — Local Security Authority Subsystem. Handles authentication, token generation, password policy enforcement, and Kerberos/NTLM. Primary target for credential dumping (Mimikatz, procdump). Protected by Credential Guard on Enterprise.
• services.exe — Service Control Manager. Starts, stops, and manages Windows services. Parent process of most svchost.exe instances.
• winlogon.exe — Manages user logon/logoff and the Secure Attention Sequence (Ctrl+Alt+Del). Loads user profile, invokes credential providers, and calls LSASS for authentication.
• explorer.exe — The Windows shell running in user space. Manages the desktop, taskbar, Start menu, and File Explorer. Killing and restarting it refreshes the shell without rebooting.

Admin Tools Cheatsheet

Security Features

• Windows Defender (Microsoft Defender Antivirus) — Real-time AV/anti-malware. Managed via the Windows Security app or PowerShell (Set-MpPreference, Get-MpComputerStatus). Integrates with Defender for Endpoint for EDR telemetry.
• Windows Firewall — Host-based stateful firewall with three profiles: Domain, Private, and Public. Manage rules via wf.msc or New-NetFirewallRule in PowerShell. Block by default inbound on all profiles.
• BitLocker — Full disk encryption (FDE) using AES-XTS 256-bit. Requires TPM 2.0 (or USB startup key as fallback). Managed via manage-bde CLI or Enable-BitLocker PowerShell. Recovery keys must be backed up to AD, Azure AD, or file — losing the key = losing the data.
• Credential Guard — Uses Virtualization-Based Security (VBS/VSM) to run LSASS in an isolated secure VM (LSAIso). Prevents Pass-the-Hash and Mimikatz-style LSASS memory reads. Requires Enterprise + UEFI + TPM 2.0 + Hyper-V.
• Windows Defender Application Guard (WDAG) — Opens untrusted websites and Office files in a Hyper-V isolated container. Browser-level sandboxing for Edge. Enterprise feature requiring Hyper-V.
• Secure Boot — UEFI firmware validates the digital signature of the bootloader before loading. Prevents bootkit and pre-OS rootkit persistence.
• TPM 2.0 — Trusted Platform Module. Hardware chip for key storage, measured boot attestation, and BitLocker key sealing. Required for Windows 11 installation. Check: tpm.msc.
• SmartScreen — Checks application downloads and websites against Microsoft's reputation cloud. Configured via Group Policy or Windows Security settings. Blocks untrusted executables at download.
• Attack Surface Reduction (ASR) rules — Defender for Endpoint behavioral rules blocking specific attack techniques: Office macros spawning child processes, credential theft from LSASS, malicious use of Office OLE, script obfuscation. Managed via Set-MpPreference -AttackSurfaceReductionRules_Ids and -AttackSurfaceReductionRules_Actions.
• Controlled Folder Access — Ransomware protection that blocks unauthorized processes from writing to protected folders (Documents, Desktop, Pictures, etc.). Enable: Set-MpPreference -EnableControlledFolderAccess Enabled. Whitelist trusted apps with Add-MpPreference -ControlledFolderAccessAllowedApplications.

Key PowerShell Commands

# Services
Get-Service                                          # List all services and status
Get-Service -Name "wuauserv"                         # Check Windows Update service
Start-Service -Name "wuauserv"
Stop-Service -Name "wuauserv"

# Processes
Get-Process                                          # List running processes
Get-Process -Name "lsass" | Select *                 # Detailed process info

# Networking
Get-NetAdapter                                       # List network adapters and status
Get-NetIPAddress                                     # Show IP addresses per adapter
Test-NetConnection -ComputerName 8.8.8.8 -Port 443  # TCP connectivity and latency test
Get-NetTCPConnection -State Listen                   # Show listening ports

# Event logs
Get-WinEvent -LogName Security -MaxEvents 50         # Read Security event log
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 100  # Failed logins

# Users and groups
Get-LocalUser                                        # List local user accounts
Get-LocalGroupMember -Group "Administrators"         # List local admins

# Remote execution
Invoke-Command -ComputerName SERVER01 -ScriptBlock { Get-Service }

# Patch status
Get-HotFix | Sort InstalledOn -Descending | Select -First 10  # Latest patches

Common IT Admin Tasks

REM Reset local admin password
net user Administrator NewP@ssword123

REM Join domain (PowerShell)
Add-Computer -DomainName corp.local -Credential corp\admin -Restart

REM Enable Remote Desktop
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall set rule group="Remote Desktop" new enable=Yes

REM Check open ports and find owning process
netstat -ano
netstat -ano | findstr :443
tasklist /fi "PID eq 1234"

REM DNS and network cache
ipconfig /flushdns
ipconfig /registerdns
arp -d *

REM Schedule disk check on next reboot
chkdsk C: /f /r

REM System File Checker — repairs corrupt Windows system files in-place
sfc /scannow

REM DISM — repair Windows image from Windows Update (use when SFC fails)
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

REM Shadow copies
vssadmin list shadows
vssadmin list shadowstorage

Boot Process

UEFI/BIOS POST
  └── UEFI firmware reads EFI System Partition (FAT32, /EFI/Microsoft/Boot/)
        └── bootmgfw.efi — Boot Manager (reads BCD store, presents boot menu)
              └── winload.efi — loads kernel, HAL, and boot drivers into memory
                    └── ntoskrnl.exe + hal.dll initialized (kernel and HAL start)
                          └── Session 0 — system services launch:
                              smss.exe → wininit.exe → lsass.exe, services.exe, lsm.exe
                                └── winlogon.exe — user session initialization
                                      └── LogonUI + credential provider → user authenticates
                                            └── userinit.exe → explorer.exe (user shell)

Key note: Secure Boot validates signatures at each step UEFI → bootmgr → winload. TPM measures the boot chain and seals BitLocker keys to the expected measurement — any modification unseals (or locks out) the drive.

Important File Locations