2.0 Windows Architecture — Layer 0 for Operators

BLUF: A Windows box is a boot chain into a kernel, a small set of critical system processes, a token-based privilege model, NTFS + registry as durable state, and (often) a domain identity layered on top of the local SAM. Map that stack before Action Items.

Reading order: this file → hub → 2.1a → 2.1b.

Mental model

UEFI / Secure Boot → bootmgr → winload → ntoskrnl
        → SMSS → CSRSS / Wininit → services.exe (SCM)
        → Winlogon / LogonUI → user session / Explorer

1. Boot → GUI

Firmware and Windows Boot Manager

UEFI firmware finds the Windows Boot Manager (bootmgfw.efi on the ESP). Secure Boot (when enabled) constrains unsigned boot components. BitLocker may prompt or unlock volumes before the OS is fully up.

winload → kernel → session manager

winload loads ntoskrnl.exe and boot-start drivers, then hands off to the kernel. SMSS (smss.exe, Session Manager) starts the subsystem processes and initiates session creation.

Wininit, CSRSS, SCM, Winlogon

Approximate bring-up (operator view, not a formal state machine):

1. SMSS starts CSRSS (Win32 subsystem) and Wininit
2. Wininit starts services.exe (Service Control Manager) and LSASS
3. Winlogon + LogonUI handle interactive logon
4. User logon → userinit → usually Explorer (shell)

# Post-boot situational checks (authorized host)
systeminfo | findstr /B /C:"OS" /C:"System Boot" /C:"Domain" /C:"System Type"
bcdedit /enum 2>$null | Select-Object -First 20
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber, CsDomain, CsPartOfDomain

2. Privilege model

Windows separates user mode and kernel mode (rings). Authorization for almost everything you care about post-foothold is carried by an access token attached to a process/thread.

whoami /all
whoami /priv
Get-TokenInformation 2>$null   # if helper present; else whoami /all

Deep dive: potatoes / token abuse → 2.1a AI2.

3. Process and thread model

Processes are created via the Win32/NtCreateUserProcess path (operators usually say CreateProcess). Each process has:

• A primary token
• Threads (each may impersonate a different token)
• A user-mode PEB and per-thread TEB (know they exist; deep RE is out of scope here)
• Handles to objects (files, keys, sections, …)

Session 0 isolation: services run in session 0; interactive users land in session 1+. That is why “pop a GUI from a service” is a different problem than a desktop implant.

Get-Process | Select-Object -First 25 Name, Id, SessionId, Company
Get-CimInstance Win32_Process |
  Select-Object -First 15 Name, ProcessId, ParentProcessId, SessionId

4. Critical processes (why each matters)

Get-Process smss,csrss,wininit,services,lsass,winlogon,explorer -ErrorAction SilentlyContinue |
  Format-Table Name, Id, SessionId -AutoSize
Get-Service | Where-Object Status -eq 'Running' | Select-Object -First 20 Name, DisplayName, StartType

5. Memory (concept)

Virtual address spaces, kernel vs user ranges, and a pagefile (and often hibernation file) back physical RAM pressure.

LSASS holds authentication material for the local security authority (password-derived secrets, tickets, etc. depending on OS/config/Credential Guard). Treat that as architecture knowledge here. Any dump/parse procedure is an authorized deep-dive action with telemetry cost — see 2.1a AI3.

Get-CimInstance Win32_OperatingSystem |
  Select-Object TotalVisibleMemorySize, FreePhysicalMemory
Get-CimInstance Win32_PageFileUsage | Format-List
# Credential Guard / related features (presence check only)
Get-CimInstance Win32_DeviceGuard -ErrorAction SilentlyContinue |
  Select-Object SecurityServicesRunning

6. Disk and NTFS

Firmware disk → GPT (or legacy MBR) → partition → NTFS volume
Optional: BitLocker → unlocked volume → filesystem

Get-Volume | Format-Table DriveLetter, FileSystem, FileSystemLabel, HealthStatus, SizeRemaining
Get-Partition | Format-Table DiskNumber, PartitionNumber, DriveLetter, Type, Size
Get-BitLockerVolume -ErrorAction SilentlyContinue |
  Select-Object MountPoint, VolumeStatus, ProtectionStatus
vssadmin list shadows 2>$null | Select-Object -First 20
# ADS discovery example (lab): Get-Item -Path file -Stream *

7. Registry as config filesystem

Hives are on-disk databases mounted at well-known roots:

Service definitions live under HKLM\SYSTEM\CurrentControlSet\Services\…. Classic autostart includes Run keys under HKLM/HKCU — details and abuse → 2.1a AI4.

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
  Select-Object ProductName, DisplayVersion, CurrentBuild
reg query HKLM\SYSTEM\CurrentControlSet\Services /f Type /t REG_DWORD 2>$null | Select-Object -First 5
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

8. Identity on a box

whoami
$env:USERDOMAIN; $env:COMPUTERNAME
(Get-CimInstance Win32_ComputerSystem).PartOfDomain
Get-LocalUser -ErrorAction SilentlyContinue | Format-Table Name, Enabled, LastLogon
nltest /dsgetdc: 2>$null

Domain attack paths → 2.1b. Local SAM/LSA harvesting procedures → 2.1a AI3.

9. Observe map (Layer 0 cheat sheet)

Get-WinEvent -ListLog * -ErrorAction SilentlyContinue |
  Where-Object RecordCount -gt 0 |
  Select-Object -First 15 LogName, RecordCount

Foundation → deep dive handoff

Part of Red Teaming 101 · Pillar 2.