Windows 2000 Architecture Above the Kernel

The Microsoft Windows 2000 operating system relies on a layered, modular architecture divided between kernel mode and user mode. While the microkernel handles low-level hardware synchronization, thread scheduling, and interrupt handling, a complex array of components sits above it to provide operating system services, system security, hardware communication, and application environments. This article explores the architecture stack directly above the core kernel, detailing the NT Executive in kernel mode and the user-mode subsystems, system processes, and application layers.

1. The Kernel-Mode Executive (NT Executive)

Directly above the microkernel, but still running in privileged kernel mode (Ring 0), sits the Windows 2000 Executive. Encapsulated primarily within ntoskrnl.exe, the Executive provides the core operating system services that manage processes, memory, hardware I/O, and inter-process communication:

  • Object Manager: Manages Windows 2000 objects (such as files, threads, and synchronization primitives) to provide a unified namespace, track resource usage, and enforce access control.
  • Process and Thread Manager: Creates, terminates, and monitors the life cycle of processes and execution threads, working in tandem with the underlying kernel scheduler.
  • Virtual Memory Manager (VMM): Implements a flat 32-bit virtual address space (up to 4 GB, typically split into 2 GB for user mode and 2 GB for kernel mode), managing page faults, paging files, and working sets.
  • Security Reference Monitor (SRM): Enforces security policies, validates access tokens against security descriptors on target objects, and generates security audit messages.
  • I/O Manager: Coordinates all system input and output. It manages hardware device drivers, intermediate filter drivers, network redirectors, and file systems, utilizing an asynchronous packet-driven model based on I/O Request Packets (IRPs). It also includes the Cache Manager for optimized disk caching.
  • Local Procedure Call (LPC) Facility: Acts as a high-speed, local message-passing mechanism between user-mode processes and environment subsystems on the same machine.
  • Window Manager and GDI (win32k.sys): Handles the graphical user interface (GUI), window displays, and rendering primitives. In Windows 2000, these functions reside inside kernel mode to minimize user/kernel transition overhead.

2. User-Mode Environment Subsystems

Above the kernel mode boundary sits user mode (Ring 3), where applications and non-privileged operating system components run in isolated address spaces. The primary interface for applications is provided by environment subsystems:

  • Win32 Subsystem: The primary and mandatory subsystem for Windows 2000. It consists of the Client/Server Runtime Subsystem (csrss.exe) and subsystem DLLs (kernel32.dll, user32.dll, gdi32.dll, advapi32.dll). It manages Win32 application execution, console windows, and process creation.
  • POSIX Subsystem: A secondary subsystem (psxss.exe) providing compliance with the POSIX.1 standard, allowing compliant UNIX-style applications to run.
  • OS/2 Subsystem: Provided limited legacy support for 16-bit character-based OS/2 1.x applications.

3. User-Mode System Support Processes

Windows 2000 features several persistent, native system processes that start during system boot to maintain system integrity and user interaction:

  • Session Manager Subsystem (smss.exe): The first user-mode process created during boot, responsible for creating system environment variables, launching win32k.sys and csrss.exe, and starting winlogon.exe.
  • Winlogon (winlogon.exe): Manages user logons and logoffs, captures the secure attention sequence (Ctrl+Alt+Del), and coordinates with the Graphical Identification and Authentication (GINA) module.
  • Local Security Authority Subsystem Service (lsass.exe): Handles local security policies, user authentication via security packages (such as Kerberos and NTLM), and generates user access tokens.
  • Service Control Manager (services.exe): Manages background services, device driver start states, and background tasks.

4. User Applications and Emulation Environments

At the top of the Windows 2000 architecture stack sit user applications:

  • Win32 Applications: Standard 32-bit graphical and console programs compiled for Windows.
  • Windows on Windows (WOW) & NTVDM: The NT Virtual DOS Machine (ntvdm.exe) and WOW layer allow legacy MS-DOS and 16-bit Windows (Windows 3.x) applications to execute safely within protected user-mode virtual machines without crashing the rest of the system.