Skip to main content

What is ntoskrnl.exe?

Ntoskrnl.exe (Windows boot up kernel) is a vital component utilized in the boot process for NT based Microsoft operating systems. It is also responsible for a host of system services such as process and memory management, security management, object management, hardware virtualization and so on. It holds several sub systems: Cache Manager, I/O Manager, Configuration Manager, Local Procedure Call, Memory Manager, Process Structure,Object Manager and Security Reference Monitor. Collectively, they form part of Executive services and System Services. As a result of such critical responsibilities, ntoskrnl.exe is a fundamental constituent of the Windows operating system.
Ntoskrnl.exe in the Kernel mode

In NT based Windows operating systems, ntoskrnl.exe is part of the Kernel mode. The kernel mode has complete access to the hardware and software components of the system. It acts as an intermediary between user mode services and applications and system critical modules. User mode services and applications have to utilize the kernel mode to indirectly communicate with the system critical modules, if they need to perform any important operation. Kernel mode contains the executive services, kernel, kernel drivers, and a Hardware Abstraction Layer (HAL).
Windows Executive services

The Windows Executives services are held in the NTOSKRNL.EXE file. Its responsibilities related to I/O (Input/Output), Object Management, Security and Process Management are administered by a number of loosely grouped sub-systems. They are as follows:
Object Manager

It is the sub-system that all other executive sub-systems must go through in order to have access to Windows resources. This operational style ensures that the resource management task for all the other executive subsystems is taken care of by the Object Manager, and there is no replication of tasks.
Configuration Manager

This sub-system executes the Windows registry.

Cache Controller

The Cache Controller provides a common cache for normal file I/O, by synchronizing with the Memory Manager, I/O Manager, and I/O drivers.

Local Procedure Call

LPC ports are used by Executive sub-systems to contact user sub-systems, by user sub-systems to communicate with their clients and as the starting point for the local transmission of Microsoft Remote Procedure Call (MRPC).

Memory Manager

The Memory Manager handles virtual memory, memory protection, and the paging of memory that passes in and out from physical memory to secondary storage, and applies a general allocator of physical memory.

I/O Manager

The I/O Manager authorizes devices to communicate with user mode sub-systems. It interprets user mode read and write commands into read and write IRPs, which it then passes on to device drivers.
Power Manager

The Power Manager takes care of power events such as power-off, stand-by, hibernate and so on. It also alerts drivers affected by a power event with special power IRPs.
PnP Manager

The PnP Manager manages Plug and Play. It provides support for device recognition and installation at boot time.

Process Structure

The Process Structure takes care of process and thread formation and termination. It applies the concept of Job, which is a collection of processes that can be stopped as a whole or put under shared restrictions.

Security Reference Monitor

The Security Reference Monitor is the main control for implementing the security guidelines of the security integral sub-system. It controls the access of resources or objects by the means of access control lists.

Popular posts from this blog


The BCD registry file controls which operating system installation starts and how long the boot manager waits before starting Windows. Basically, it’s like the Boot.ini file in earlier versions of Windows. If you need to edit it, the easiest way is to use the Startup And Recovery tool from within Vista. Just follow these steps: 1. Click Start. Right-click Computer, and then click Properties. 2. Click Advanced System Settings. 3. On the Advanced tab, under Startup and Recovery, click Settings. 4. Click the Default Operating System list, and edit other startup settings. Then, click OK. Same as Windows XP, right? But you’re probably not here because you couldn’t find that dialog box. You’re probably here because Windows Vista won’t start. In that case, you shouldn’t even worry about editing the BCD. Just run Startup Repair, and let the tool do what it’s supposed to. If you’re an advanced user, like an IT guy, you might want to edit the BCD file yourself. You can do this

DNS Scavenging.

                        DNS Scavenging is a great answer to a problem that has been nagging everyone since RFC 2136 came out way back in 1997.  Despite many clever methods of ensuring that clients and DHCP servers that perform dynamic updates clean up after themselves sometimes DNS can get messy.  Remember that old test server that you built two years ago that caught fire before it could be used?  Probably not.  DNS still remembers it though.  There are two big issues with DNS scavenging that seem to come up a lot: "I'm hitting this 'scavenge now' button like a snare drum and nothing is happening.  Why?" or "I woke up this morning, my DNS zones are nearly empty and Active Directory is sitting in a corner rocking back and forth crying.  What happened?" This post should help us figure out when the first issue will happen and completely avoid the second.  We'll go through how scavenging is setup then I'll give you my best practices.  Scavenging s

AD LDS – Syncronizing AD LDS with Active Directory

First, we will install the AD LDS Instance: 1. Create and AD LDS instance by clicking Start -> Administrative Tools -> Active Directory Lightweight Directory Services Setup Wizard. The Setup Wizard appears. 2. Click Next . The Setup Options dialog box appears. For the sake of this guide, a unique instance will be the primary focus. I will have a separate post regarding AD LDS replication at some point in the near future. 3. Select A unique instance . 4. Click Next and the Instance Name dialog box appears. The instance name will help you identify and differentiate it from other instances that you may have installed on the same end point. The instance name will be listed in the data directory for the instance as well as in the Add or Remove Programs snap-in. 5. Enter a unique instance name, for example IDG. 6. Click Next to display the Ports configuration dialog box. 7. Leave ports at their default values unless you have conflicts with the default values. 8. Click N