Role of Object Manager in Windows 2000
The Windows 2000 Object Manager is a core component of the operating system's Executive subsystem responsible for creating, managing, tracking, and securing system resources. This article outlines how the Object Manager coordinates resources by standardizing system entities into unified objects, maintaining a global hierarchical namespace, managing object handles, enforcing access control, and tracking object lifecycles through reference counting.
Unified Resource Representation
In Microsoft Windows 2000, internal system resources—such as files, physical devices, threads, processes, synchronization primitives (events, mutexes, semaphores), and shared memory sections—are encapsulated as objects. The Object Manager provides a consistent, uniform interface for these disparate entities. Rather than requiring distinct management mechanisms for each resource type, the operating system uses the Object Manager to oversee common object headers that define standard attributes, including object names, directory locations, security descriptors, and quota charges.
Hierarchical Namespace Management
The Object Manager maintains a global, hierarchical namespace that
functions similarly to a file system directory structure. Visible
primarily to the kernel and Win32 subsystems via tools like WinObj, this
namespace organizes system resources under root directories such as
\Device, \DosDevices, \Driver,
and \BaseNamedObjects. This structure allows applications
and system services to discover and share named resources across process
boundaries in an orderly, collision-resistant manner.
Handle Creation and Translation
User-mode processes cannot directly manipulate kernel objects. Instead, the Object Manager mediates resource access using an indirect referencing mechanism called handles. When a process opens or creates a resource, the Object Manager verifies the operation and generates a handle, storing an entry in that process's private handle table. Subsequent operations on that resource use the handle, which the Object Manager translates back to the underlying kernel object pointer. This architecture isolates kernel memory from user-mode tampering and confines resource access strictly to the creating or inheriting process.
Security and Access Synchronization
Resource security in Windows 2000 is closely tied to the Object Manager. Every object can possess a Security Descriptor containing an access control list (ACL). When a process attempts to open an object handle, the Object Manager consults the Security Reference Monitor (SRM) to compare the caller's access token against the object's discretionary access control list (DACL). Once access is granted, the permitted access rights are encoded directly into the handle, eliminating the need to perform costly security checks during routine, read-write operations.
Lifetime Tracking and Reference Counting
The Object Manager coordinates resource allocation and deallocation through dual reference counting:
- Handle Count: Tracks the total number of open handles to an object across all active processes.
- Pointer Count: Tracks internal kernel references, including pointers held by system components and driver routines, in addition to the handle count.
A resource remains allocated in system memory as long as its pointer count remains greater than zero. When a process closes a handle, the Object Manager decrements the handle count. Once the handle count reaches zero, the object's name is removed from the global namespace to prevent new handles from opening. When all internal kernel components release their pointers and the pointer count hits zero, the Object Manager deallocates the object's memory, preventing resource leaks and premature deletions.