Windows NT Architecture Explained: Kernel, Executive, and Subsystems

Every Windows process you launch, from notepad.exe to sqlservr.exe, passes through a layered design that Microsoft introduced with Windows NT 3.1 and still ships in Windows 11 and Windows Server 2025. Understanding where ntoskrnl.exe, hal.dll, win32k.sys, and ntdll.dll sit in that stack tells you why a driver crash produces a 0x0000007E blue screen while a crashed app only closes a window. This guide maps each layer, shows how to inspect it with built-in tools, and covers the failure modes administrators hit most.

Quick Takeaways

• NT is a hybrid kernel design: a small microkernel core (ntoskrnl.exe) plus a large Executive that runs in the same Ring 0 address space.
• User mode (Ring 3) holds environment subsystems, services, and apps. Kernel mode (Ring 0) holds the Executive, Kernel, drivers, and HAL.
• Applications never call kernel code directly. They call documented APIs (kernel32.dll), which call ntdll.dll, which issues a system call (syscall/sysenter) into the Executive.
• Modern Windows adds Virtualization-Based Security (VBS) and Hyper-V beneath the kernel, so NT itself now runs as a guest of the hypervisor on VBS-enabled systems.

Windows NT Architecture at a Glance

NT separates user mode from kernel mode. The CPU enforces the split through privilege rings. Code in kernel mode has unrestricted access to hardware and memory. Code in user mode does not.

Both the Executive and the Kernel live inside the single image ntoskrnl.exe, located at C:\Windows\System32\ntoskrnl.exe.

Prerequisites for Following Along

You need:

• Windows 10, Windows 11, or Windows Server 2016 or later.
• An elevated PowerShell or Command Prompt session.
• Optional: Sysinternals Suite (Process Explorer, Process Monitor, LiveKd) and the WinDbg debugger from the Microsoft Store.

Verify your build and kernel version first:

# Show OS build and kernel version
[System.Environment]::OSVersion.Version

# Detailed OS and hardware abstraction info
Get-ComputerInfo -Property WindowsProductName, OsBuildNumber, OsHardwareAbstractionLayer

Get-ComputerInfo reads values from WMI and the registry. The OsHardwareAbstractionLayer property returns the HAL version string, confirming hal.dll is loaded.

User Mode vs. Kernel Mode

How the Privilege Split Works

On x64 CPUs, Windows uses Ring 0 for kernel mode and Ring 3 for user mode. Rings 1 and 2 go unused. Each user process gets a private virtual address space. All kernel-mode code shares one address space, which is why a single bad driver can corrupt the entire system.

What Happens When an App Calls the OS

Calling CreateFile in a C++ program follows this path:

1. The app calls CreateFileW in kernel32.dll (or kernelbase.dll on modern builds).
2. That function calls NtCreateFile in ntdll.dll.
3. ntdll.dll loads a system service number into the EAX register and executes the syscall instruction.
4. The CPU switches to Ring 0 and jumps to the System Service Dispatch Table (SSDT) handler in ntoskrnl.exe.
5. The I/O Manager builds an I/O Request Packet (IRP) and routes it to the file system driver.
6. The result returns up the same chain, and the CPU drops back to Ring 3.

You can watch this boundary with Process Monitor. Each row is a user-mode call that crossed into the Executive.

The Hardware Abstraction Layer (HAL)

hal.dll hides differences in interrupt controllers, timers, and bus architectures from the rest of the kernel. The Kernel and drivers call HAL routines instead of touching chipset registers directly.

Typical HAL duties:

• Interrupt routing (APIC, IOAPIC)
• High-resolution timers (HPET, TSC, invariant TSC)
• DMA setup
• Multiprocessor synchronization primitives

Since Windows Vista, Windows ships a single HAL per architecture and selects behavior at boot. Older versions required choosing among halacpi.dll, halmacpi.dll, and others.

Check the platform timer in use:

bcdedit /enum {current}

Look for the useplatformclock and useplatformtick values. Their presence changes timer source selection and can affect latency on virtual machines.

The Windows Kernel (Microkernel Layer)

The Kernel is the lowest-level component inside ntoskrnl.exe. It does not implement policy. It provides mechanisms the Executive builds on.

Core Responsibilities

• Thread scheduling: A preemptive, priority-based scheduler with 32 priority levels (0 to 31). Levels 16 to 31 are real-time. Levels 1 to 15 are dynamic.
• Interrupt and exception dispatch: Maps hardware interrupts to Interrupt Request Levels (IRQLs).
• Synchronization: Spinlocks, mutexes, events, and semaphores (dispatcher objects).
• Multiprocessor support: Per-CPU run queues and affinity management.

IRQL: Why Drivers Crash the System

The kernel assigns each execution context an IRQL. Code at DISPATCH_LEVEL or above cannot touch pageable memory, because the Memory Manager cannot service a page fault at that level. Violating this rule produces the stop code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL), one of the most common BSODs.

Inspect scheduler state from user mode:

# List processes with base priority and thread count
Get-Process | Sort-Object -Property Threads -Descending |
  Select-Object -First 10 Name, Id, BasePriority, @{n='Threads';e={$_.Threads.Count}}

BasePriority shows the scheduler class each process starts with. Threads.Count shows how many schedulable entities it owns.

The Windows Executive

The Executive is the upper layer of ntoskrnl.exe. It implements the services applications actually consume. Each component exposes functions prefixed with a two-letter code (Ob, Mm, Io, Se, and so on).

The Object Manager in Practice

Everything in NT is an object. Tools like WinObj (Sysinternals) show the object namespace under \. Open it and browse \Device, \BaseNamedObjects, and \KnownDlls.

Query a process’s open handles:

# List handle counts per process (requires elevation for system processes)
Get-Process | Sort-Object HandleCount -Descending |
  Select-Object -First 10 Name, Id, HandleCount

A process with an ever-growing HandleCount has a handle leak, a common cause of ERROR_NO_SYSTEM_RESOURCES.

Memory Manager Essentials

The Memory Manager gives each process a flat virtual address space (128 TB user space on x64). It tracks working sets, paged pool, and nonpaged pool.

# Show pool and commit statistics via performance counters
Get-Counter '\Memory\Pool Nonpaged Bytes','\Memory\Pool Paged Bytes','\Memory\Committed Bytes'

A steadily rising Pool Nonpaged Bytes value points to a driver leak. Use poolmon.exe (from the WDK) to find the pool tag responsible.

Environment Subsystems and Native API

NT was designed to run applications written for different operating systems. Environment subsystems translate foreign API calls into native NT calls.

Native API (ntdll.dll)

ntdll.dll exports the Native API: NtCreateFile, NtAllocateVirtualMemory, NtQuerySystemInformation, and hundreds more. Microsoft does not document most of these for application use, and they can change between builds. Stick to Win32 APIs in production code.

List the system calls an image imports:

dumpbin /exports C:\Windows\System32\ntdll.dll | findstr /i "NtCreate"

dumpbin ships with Visual Studio. The /exports flag lists exported symbols. findstr /i filters case-insensitively.

Key User-Mode System Processes

Killing csrss.exe or smss.exe triggers an immediate bugcheck: 0x000000F4 (CRITICAL_OBJECT_TERMINATION). The kernel treats them as critical processes.

The Windows Boot Sequence

Knowing the order of load helps isolate boot failures.

1. Firmware (UEFI) initializes hardware and loads bootmgfw.efi.
2. Windows Boot Manager reads the BCD store and loads winload.efi.
3. winload.efi loads ntoskrnl.exe, hal.dll, the SYSTEM registry hive, and boot-start drivers.
4. ntoskrnl.exe initializes the Executive, then starts smss.exe.
5. smss.exe launches csrss.exe and wininit.exe.
6. wininit.exe starts services.exe and lsass.exe.
7. winlogon.exe presents the logon UI.

Inspect the boot configuration:

bcdedit /enum all

Hybrid Kernel vs. Other Kernel Designs

NT uses microkernel concepts (message passing, a small core of primitives) but keeps performance-critical services in Ring 0, hence “hybrid.”

Virtualization-Based Security and the Modern NT Stack

On Windows 10, Windows 11, and Windows Server 2016 and later with VBS enabled, the Hyper-V hypervisor boots first and splits the system into Virtual Trust Levels (VTLs):

• VTL0: Normal Windows, including the standard kernel and user mode.
• VTL1: Secure Kernel (securekernel.exe) and Isolated User Mode processes such as LsaIso.exe (Credential Guard).

Even a compromised VTL0 kernel cannot read VTL1 memory. Hypervisor-Protected Code Integrity (HVCI) also runs in VTL1 and blocks unsigned kernel code.

Check VBS status:

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object VirtualizationBasedSecurityStatus, SecurityServicesRunning

A VirtualizationBasedSecurityStatus of 2 means VBS is running. In SecurityServicesRunning, 1 is Credential Guard and 2 is HVCI.

Step-by-Step: Inspecting the NT Stack with WinDbg

Live kernel inspection reveals the components described above.

Step 1: Enable Local Kernel Debugging

bcdedit /debug on

Reboot. /debug on enables the kernel debugger interface. Note that this may conflict with Secure Boot and VBS.

Step 2: Attach WinDbg

Launch WinDbg as Administrator. Choose File > Attach to kernel > Local.

Step 3: Run Core Commands

lm m nt          $$ Show ntoskrnl module info
!process 0 0     $$ List all processes
!object \Device  $$ Dump the object directory
!irql            $$ Show current IRQL

lm m nt lists modules matching nt. !process 0 0 prints every EPROCESS structure with minimal detail. !object walks the Object Manager namespace.

Step 4: Turn Debugging Off

bcdedit /debug off

Practical Troubleshooting & Real-World Scenarios

Scenario 1: Diagnosing a Driver-Caused BSOD

Symptom: Random blue screens with DRIVER_IRQL_NOT_LESS_OR_EQUAL (0x000000D1).

1. Enable complete or kernel dumps: System Properties > Advanced > Startup and Recovery.
2. Open C:\Windows\MEMORY.DMP (or C:\Windows\Minidump\*.dmp) in WinDbg.
3. Run !analyze -v.
4. Read the MODULE_NAME and IMAGE_NAME fields. They name the faulting .sys file.
5. Update or roll back that driver.

Enable Driver Verifier to catch offenders early:

verifier /standard /driver suspect.sys

Warning: Driver Verifier can render a system unbootable. Use Safe Mode to run verifier /reset if needed.

Scenario 2: Repairing Corrupted System Files

Symptom: Boot loops, 0xc000014c (corrupt BCD), or 0xc0000098 (ntoskrnl.exe missing or damaged).

From the Windows Recovery Environment (WinRE) command prompt:

bootrec /rebuildbcd
bootrec /fixmbr
bootrec /fixboot
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
DISM /Image:C:\ /Cleanup-Image /RestoreHealth

• bootrec /rebuildbcd scans for Windows installations and rebuilds the BCD.
• sfc /scannow verifies protected system files against the component store.
• DISM /RestoreHealth repairs the component store itself.

Scenario 3: Chasing a Nonpaged Pool Leak

Symptom: RAM usage climbs, the system slows, and Event ID 2019 (Srv) appears.

1. Run poolmon.exe and press P to sort by pool type, then B to sort by bytes.
2. Note the tag with the fastest-growing Bytes column.
3. Map the tag to a driver:

findstr /m /l /s Tag_Here C:\Windows\System32\drivers\*.sys

4. Update or remove the owning driver.

Scenario 4: Handle Leaks in a Service

# Sample handle count every 5 seconds for a target process
1..12 | ForEach-Object {
  (Get-Process -Name "myservice").HandleCount
  Start-Sleep -Seconds 5
}

A monotonic increase confirms a leak. Capture a dump with Task Manager > Create dump file and analyze with !handle 0 f in WinDbg.

Performance and Hardening Notes for Administrators

• Disable unused services through services.msc or Set-Service -Name <svc> -StartupType Disabled.
• Keep HVCI on for servers that support it. Check driver compatibility first with Core Isolation > Memory Integrity in Windows Security.
• Monitor kernel counters: \Processor(_Total)\% Privileged Time above 30% sustained often indicates driver or filter overhead.
• Audit loaded drivers:

Get-CimInstance Win32_SystemDriver | Where-Object State -eq 'Running' |
  Select-Object Name, PathName | Sort-Object Name

This lists all running kernel drivers with their file paths, useful for spotting unsigned or unexpected .sys files.

FAQ

What is the difference between the Windows kernel and the Executive?

The Kernel handles low-level tasks: thread scheduling, interrupt dispatch, and synchronization. The Executive sits above it and implements high-level services such as the Object Manager, Memory Manager, and I/O Manager. Both reside in ntoskrnl.exe and run in Ring 0.

Is the Windows NT kernel monolithic or a microkernel?

Neither. It is a hybrid kernel. NT’s design borrows microkernel ideas like modular components and message passing, but it runs the Executive, drivers, and file systems in kernel mode for performance.

What does ntoskrnl.exe do?

ntoskrnl.exe is the core kernel image. It contains both the Kernel and the Executive. The boot loader (winload.efi) loads it first, and it then initializes memory, processes, security, and I/O before starting smss.exe.

Does Windows 11 still use the NT kernel?

Yes. Windows 10, Windows 11, and current Windows Server releases all run on the NT kernel. The internal version number stays at 10.0. Microsoft adds features such as VBS and Secure Kernel on top of the same core design.