Windows Internals
All levels

Level 1

System support processes & services

The privileged processes that aren't apps and aren't the kernel: Winlogon, the Service Control Manager, and the svchost hosts that run most of Windows.

  1. 1Services & background infrastructure
  2. 2The Service Control Manager
  3. 3Service hosts (svchost.exe)
  4. 4Authentication & logon
  5. 5Winlogon, LogonUI, and session sign-in
L0 Applications, the loader & the Win32 environmentL2 Security & authentication