Chapter 12: Windows Under the Hood

40 flashcards · Other · by Ian Christensen

1. What is a Registry?

   Registry The configuration database in Windows starting with Windows 95. The Registry contains settings for the hardware, system software and applications in the PC. It comprises the SYSTEM.DAT and USER.DAT files, and there are separate Registry entries for the 32-bit and 64-bit versions of Windows. A PC with many applications can easily have a hundred thousand or more entries in the Registry. In the earlier Windows 3.x versions, the Registry database held a few settings, and all others were st…

2. What is a Windows Registry?

   Windows Registry Starting with Windows 95, the Registry is a hierarchical database that holds configuration data about the hardware environment of the PC, Windows itself and installed applications. The Registry can be edited directly, but that is usually done only for non-published tweaks or as a last resort. Routine access to configuration settings is done via the Windows control panels and Properties menus. See Win Control panels and Win Properties. Registry Details To get into the Registry,…

3. What is Regedit?

   The registration editor in Windows starting with Windows 95. Regedit enables users to modify Registry entries, which is not a common task but sometimes necessary.

4. What program is used to work with registries on Windows?

   regedit.exe, Regedit, or Registry Editor

5. What is HKEY?

   The "Handles to the Keys" (HKEYs) are the portals to all the configuration settings in a Windows computer.

6. What is HKEY_CLASSES_ROOT?

   Contains file associations and OLE information. It shows exactly the same thing as the folder HKEY_LOCAL_MACHINE\Software\Classes.

7. What is HKEY_CURRENT_USER?

   The portion of HKEY_USERS that pertains to the current user. It contains the colors, fonts and attributes for the desktop environment as well as any network connections. If the current user is the only user of the system, HKEY_CURRENT_USER and HKEY_USERS are the same.

8. What is HKEY_USERS?

   Contains the above information for all users of the system.

9. What is HKEY_LOCAL_MACHINE?

   Holds a large number of settings for the hardware, system software and applications. Install programs create their own subkeys and values within this key. Older applications may use the INI files that were introduced in Windows 3.x, rather than the Registry.

10. What is HKEY_CURRENT_CONFIGURATION?

    Contains settings for the current display resolution and printers.

11. What is HKEY_DYN_DATA?

    Holds performance statistics that can be viewed with System Monitor (SYSMON.EXE). (Windows 95/98 Only)

12. What does HKCR stand for?

    HKEY_CLASSES_ROOT

13. What does HKCU stand for?

    HKEY_CURRENT_USER

14. What does HKLM stand for?

    HKEY_LOCAL_MACHINE

15. What does HKU stand for?

    HKEY_USERS

16. What does HKCC stand for?

    HKEY_CURRENT_CONFIGURATION

17. What are the five root keys in the Windows Registry?

    HKEY_CLASSES_ROOT HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS HKEY_CURRENT_CONFIGURATION HKEY_DYN_DATA (Windows 95/98 Only)

18. What is a process?

    Software running in the computer. When a computer is booted, numerous processes are started. Some are parts of the operating system, while others are applications that have been designated to run at startup. In a Windows computer, pressing Ctrl-Alt-Del launches the Task Manager, which displays all running processes. In the Mac, the Activity Monitor in the Applications/Utilities folder shows the processes.

19. What are the two discrete types of processes?

    Applications Services

20. What is a Windows Service?

    Software that runs in the background without an interface.

21. What is a PID?

    Process IDentifier is a temporary number assigned by the operating system to a process or service.

22. What is DLL?

    Dynamic Link Library is an executable program module in Windows that performs one or more functions at runtime. There are a huge number of DLLs that make up the Windows OS. A DLL is not launched by the user; it is called for by an executable program or by another DLL. Only one instance of the DLL is required in memory as its routines can be shared by all running applications.

23. What application allows a user to view process dependency trees/hierarchies?

    Process Explorer

24. What application allows a user to access services?

    Services

25. What are two hotkey shortcuts to Task Manager?

    CTRL+ALT+DEL CTRL+SHIFT+ESC

26. What application can be used on Windows to access details about the computer?

    System Information or msinfo32.exe

27. What application can be used to

    System Configuration or msconfig.exe

28. What is Active Directory Repair?

    Using the Network boot option when the computer is part of an Active Directory domain.

29. What is a Safe Boot?

    The troubleshooting mode of an operating system. By pressing a particular key after the computer is turned on, it allows the system to boot with only essential components such as the OS kernel and mouse, keyboard and basic display drivers. All applications normally set to automatically launch when the computer is booted are bypassed. As long as there is no corruption of the OS on the hard disk, when the computer cannot boot due to software or hardware conflicts, it can generally boot into safe…

30. What is DEP?

    Data Execution Prevention (DEP) is a system-level memory protection feature that is built into the operating system starting with Windows XP and Windows Server 2003. DEP enables the system to mark one or more pages of memory as non-executable. Marking memory regions as non-executable means that code cannot be run from that region of memory, which makes it harder for the exploitation of buffer overruns. DEP prevents code from being run from data pages such as the default heap, stacks, and memory…

31. What is MMC?

    Microsoft Management Console A Windows feature that provides a common environment for running management software from Microsoft and third parties. Any type of administration service such as network management, antivirus management, disk management and authentication can be created as a Microsoft Management Console (MMC) component called a "snap-in" module. A snap-in, which uses the .MSC file extension, provides one management function, and multiple snap-ins are used to create a management appl…

32. What is an Audit Policy?

33. What is ODBC?

34. What is SQL?

35. What is the COM+ Model?

    COM Component Object Model is a Microsoft architecture for building software modules (objects) that are executed in Windows. Parts of Windows itself and Microsoft's own applications are built as COM objects. Beginning with Windows 95 and Windows NT, COM provides the interfaces between objects, and Distributed COM (DCOM) allows them to run remotely. COM+ Enhancements to the Microsoft Component Object Model (COM) that enable programmers to develop COM objects more easily. For example, COM+ allows…

36. What is UNC?

    Universal Naming Convention

37. What is Shared Resources?

38. How is Shared Resources different than NTFS Permissions?

39. What is the standard UNC?

    \\Device\User

40. What are the features offered by Local Security Policy's "Password Policy"?

    Enforce password history Maximum password age Minimum password age Minimum password length Password must meet complexity requirements Store passwords using reversible encryption