Lesson 2: Windows 2000 Architecture Overview

Windows 2000 is a modular operating system—a collection of small, self-contained software components that work together to perform operating system tasks. Each component provides a set of functions that act as an interface to the rest of the system.

---

After this lesson, you will be able to

• Identify the layers and layer components in the Windows 2000 operating system architecture

Estimated lesson time: 15 minutes

---

Windows 2000 Layers, Subsystems, and Managers

The Windows 2000 architecture contains two major layers: user mode and kernel mode, as illustrated below. This lesson provides an overview of the Windows 2000 architecture layers and their respective components.

Windows 2000 architecture layers

User Mode

Windows 2000 has two different types of user mode components: environment subsystems and integral subsystems.

Environment Subsystems

One of the features of Windows 2000 is the ability to run applications written for different operating systems. Windows 2000 accomplishes this through the use of environment subsystems. Environment subsystems emulate different operating systems by presenting the application programming interfaces (APIs) that the applications expect to be available. The environment subsystems accept the API calls made by the application, convert the API calls into a format understood by Windows 2000, and then pass the converted API to the Executive Services for processing.

The following table lists the environment subsystems included with Windows 2000.

Environment Subsystems Included with Windows 2000

Environment subsystem	Function
Windows 2000 32-bit Windows-based subsystem (Win32)	Responsible for controlling Win32-based applications, as well as for providing an environment for Win16 and Microsoft MS-DOS-based applications. Controls all screen-oriented input/output (I/O) between subsystems. This ensures a consistent user interface, regardless of the application a user runs.
OS/2 subsystem	Provides a set of APIs for 16-bit, character mode OS/2 applications.
Portable Operating System Interface for UNIX (POSIX) subsystem	Provides APIs for POSIX-based applications.

The environment subsystems and the applications that run within them are subject to the following limitations and restrictions:

• They have no direct access to hardware.
• They have no direct access to device drivers.
• They have no access to the certain Clipboard API operations.
• They have no access to certain Microsoft CD-ROM Extensions (MSCDEX).
• They have no access to task-switching APIs.
• They are limited to an assigned address space.
• They are forced to use hard disk space as virtual random access memory (RAM) whenever the system needs memory.
• They run at a lower priority level than kernel mode processes.
• Because they run at a lower priority level than the kernel mode processes, they have less access to central processing unit (CPU) cycles than processes that run in kernel mode.

Integral Subsystems

Many different integral subsystems perform essential operating system functions. In the previous figure, there is a generic subsystem on the far right of the figure labeled integral subsystem. This integral subsystem represents any of the various integral subsystems. To introduce you to some of the more important integral subsystems, the following table lists some examples.

Windows 2000 Integral Subsystems

Integral subsystem	Function
Security subsystem	Tracks rights and permissions associated with user accounts. Tracks which system resources are audited. Accepts user logon requests. Initiates logon authentication.
Workstation service	Networking integral subsystem that provides an API to access the network redirector. Allows a user running Windows 2000 to access the network.
Server service	Networking integral subsystem that provides an API to access the network server. Allows a computer running Windows 2000 to provide network resources

Kernel Mode

The kernel mode layer has access to system data and hardware. Kernel mode provides direct access to memory and executes in an isolated memory area. Kernel mode consists of four components: Windows 2000 Executive, Device Drivers, the Microkernel, and the Hardware Abstraction Layer (HAL).

Windows 2000 Executive

This component performs most of the I/O and object management, including security. It does not perform screen and keyboard I/O; the Microsoft Win32 subsystem performs these functions. The Windows 2000 Executive contains the Windows 2000 kernel mode components. Each of these components provides the following two distinct sets of services and routines:

• System services are available to both the user mode subsystems and to other Executive components.
• Internal routines are available only to other components within the Executive.

The Executive consists of the kernel mode components listed in the following table.

Windows 2000 Executive Components

Component	Function
I/O Manager	Manages input from and the delivery of output to different devices. The components that make up the I/O Manager include the following: File systems accept the oriented I/O requests and translate these requests into device-specific calls. The network redirector and the network server are both implemented as file system drivers. Device drivers are low-level drivers that directly manipulate hardware to accept input or to write output. Cache Manager improves disk I/O by storing disk reads in system memory. Cache Manager also improves write performance by caching write requests and writes to disk in the background.
Security Reference Monitor	Enforces security policies on the local computer.
Interprocess Communication (IPC) Manager	Manages communications between clients and servers, for example, between an environment subsystem (which would be acting like a client requesting information) and an Executive Services component (which would be acting like a server and satisfying the request for information). The IPC Manager consists of the following two components: Local procedure call (LPC) facility manages communications when clients and servers exist on the same computer. Remote procedure call (RPC) facility manages communications when clients and servers exist on separate computers.
Virtual Memory Manager (VMM)	Implements and controls virtual memory, a memory management system that provides and protects the private address space for each process. The VMM also controls demand paging. Demand paging allows the use of disk space as a storage area to move code and data in and out of physical RAM.
Process Manager	Creates and terminates processes and threads. (A process is a program or part of a program. A thread is a specific set of commands within a program.)
Plug and Play	Maintains central control of the Plug and Play process. Communicates with device drivers, directing the drivers to add and start devices.
Power Manager	Controls power management APIs, coordinates power events, and generates power management requests.
Window Manager and Graphical Device Interface (GDI)	These two components, implemented as a single device driver named Win32k.sys, manage the display system. They perform the following functions: Window Manager controls window displays and manages screen output. This component is also responsible for receiving input from devices such as the keyboard and the mouse and then passing the input messages to applications. GDI contains the functions that are required for drawing and manipulating graphics.
Object Manager	Creates, manages, and deletes objects that represent operating system resources, such as processes, threads, and data structures.

Device Drivers

This component translates driver calls into hardware manipulation.

Microkernel

This component manages the microprocessor only. The kernel coordinates all I/O functions and synchronizes the activities of the Executive Services.

Hardware Abstraction Layer (HAL)

This component virtualizes, or hides, the hardware interface details, making Windows 2000 more portable across different hardware architectures. The HAL contains the hardware-specific code that handles I/O interfaces, interrupt controllers, and multiprocessor communication mechanisms. This layer allows Windows 2000 to run on both Intel-based and Alpha-based systems without having to maintain two separate versions of Windows 2000 Executive.

Lesson Summary

This lesson introduced you to the Windows 2000 architecture. The Windows 2000 architecture contains two major layers: user mode and kernel mode. User mode has two different types of components: environment subsystems, which allow Windows 2000 to run applications written for different operating systems, and integral subsystems, which perform essential operating system functions. The kernel mode layer has access to system data and hardware, provides direct access to memory, and executes in an isolated memory area.