# Windows Architecture

> Explore the core foundations of the Windows OS. Understand User vs. Kernel mode, the boot process, and the critical system processes that keep Windows running.

Canonical: https://codelivly.com/rooms/windows-architecture
Last updated: 2026-07-02

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 7 |
| Estimated time | 30 min |
| XP | 200 |

Dive into the foundational architecture of the Windows operating system. The Windows Architecture module breaks down the core concepts of Windows internals, starting with the critical separation between User Mode and Kernel Mode.

You will trace the exact sequence of the Windows boot process from power-on to the login screen. Finally, you will identify and analyze the essential background processes (like lsass.exe, svchost.exe, and csrss.exe) that attackers frequently target, dump, or spoof during a 
compromise. By the end of this module, you will understand how Windows operates under the hood and why its architecture is the primary target for advanced malware.

## Lessons

1. User Mode vs. Kernel Mode (30 min)
2. The Windows Boot Process (30 min)
3. Core Windows Processes (30 min)
4. NTFS Architecture & The Master File Table (30 min)
5. Alternate Data Streams (ADS) & Hidden Data (30 min)
6. File Permissions, ACLs, and Ownership (30 min)
7. Volume Shadow Copies & File Recovery (30 min)

## Related

- [Learning path: Windows Fundamentals](https://codelivly.com/learning-paths/windows-fundamentals)
- [All rooms](https://codelivly.com/rooms)