Google IT support — Operating Systems (Windows)

1. Navigating the system

To navigate files and directories in operating systems you can use GUI or command-line interface (through shell). These files and directories are organized in a hierarchical directory tree (main directory branches off and holds other directories and files).

1.1. Basics

Most common commands:

Wildcards (symbols used to represent one or more characters):

PowerShell shortcuts:

shortcutdescription
Ctrl + C / Vcopy/paste
Ctrl + Lclear terminal screen
Ctrl + Ckill current process
Tabtab completion

 

1.2. File and text manipulation

Windows has a service called the Windows Search Service, which indexes files on a computer and compiles a list of their names and properties. This is a resource intensive process, so by default it's enabled only for files in user home directory in Windows 10, and disabled on Windows Servers. For the same reason you can't search data within files by default (to enable: Indexing Options → Advanced → File Types → Index Properties and File Contents [X]).

Search via PowerShell:

1.3. I/O streams and the pipeline

2. Users and permissions

2.1. Users and groups

Users and groups can be managed in Local Users and Groups tab of Computer Management tool or through PowerShell:

  1. Computer Management tool:

    • Task Scheduler (schedule programs and tasks to run at certain times)
    • Event Viewer (view system logs)
    • Shared folders (manage folders that can be shared between users)
    • Local Users and Groups (user and group management)
    • Performance (monitor resources of a machine)
    • Device Manager (i.e., network cards, sound cards, monitors, etc.)
    • Disk Management (storage management)
    • Services and Applications (manage programs and services available on the system)

  1. PowerShell:

2.2. Permissions

Files and folder permissions are assigned using ACLs (access control lists):

PermissionDescription
Read
  • files: see that file exists and read its contents
  • folders: read the files and folders in a folder
Read and execute
  • files: read files and execute (if possible)
  • folders: read and execute files in folder
  • includes read permission
List folder contents
  • folders: read and execute files in folder
  • alias for read and execute on a folder
Write
  • files: make changes
  • folders: create subfolders and write files in the folder
Modify
  • includes read, execute and write permissions
Full Control
  • includes modify permission
  • gives ability to take ownership of a file and change its ACLs

DACLs can be viewed and modified via GUI or through PowerShell:

  1. GUI:

    • via Properties → Security: top box for list of users and groups, bottom box for list of permissions
    • deny option doesn't allow to have certain permissions (takes precedence over allow option)

  2. PowerShell:

3. Package and software management

3.1. Software packages

Developers package software using software compiling tools. In Windows, software is usually packaged as .exe files (executable files). They contain instructions for a computer to perform, computer code and other files that program might use.

Packages usually rely on other pieces of code in order to work. In Windows these dependencies are dynamic-link libraries, or DLLs.

3.2. Package managers

In addition to SxS system Windows Package Manager can be used to install and maintain the libraries and other dependencies. A package manager makes sure that the process of software installation, removal, update, and dependency management is as easy and automatic as possible.

Most Windows software is distributed in closed source packages (i.e., source code is hidden), but there are tools to check out installer actions (e.g., process monitoring from sysinterals toolkit or orca from Windows SDK).

3.3. Archives

Archive is one or more files compressed into a single file.

3.4. Mobile app packages

Mobile applications usually can be downloaded only from a trusted source (like an app store). App store is a central managed marketplace for app developers to publish and sell mobile apps, i.e., the app store acts as package manager, and the app store service acts as a package repository.

3.5. Devices and drivers

Driver is software that helps hardware device interact with an OS.

In Windows devices and their drivers are managed through the Device Manager (access through devmgmt.msc or RMB on This PC → Manage → Device Manager).

3.6. OS updates

Installing latest system updates is a good practice to keep OS secure and get the newest features. In Windows this process is managed by the Windows Update Client, which always runs in the background.

4. File systems

4.1. Review of file systems

A file system is used to keep track of files and file storage on a disk. The major operating systems have their own unique file systems:

4.2. Partitions

A storage disk can be divided into partitions (pieces of the disk that can be managed independently). Partitions essentially act as separate sub-disks, but they all use the same physical disk.

Partition table is a component of a disk that tells the OS how the disk is partitioned (which are the boot partitions, space allocated for partitions, etc.)

There are two main partition table schemes which decide how to structure the information on partitions:

  1. MBR (master boot record)

    • mostly used in Windows, slowly being replaced by GPT
    • max volume size is 2 TB
    • max four primary partitions on a disk (can add more with extended and logical partitions)

  2. GPT (GUID partition table)

    • max volume size is 8 ZB
    • max 128 partitions on a disk (i.e., all partitions are primary)
    • UEFI booting is supported only for GPT devices

4.3. Disk partitioning, formatting and mounting

In Windows, disk partitioning and filesystem formatting can be done through the Disk Management utility (GUI) or with the Diskpart tool (CLI):

  1. Disk Management

    1. create a partition from an unallocated space on a disk

    2. format a volume on this partition by choosing:

      • volume label and used filesystem
      • allocation unit size (size of the data blocks that will be used on a partition)
      • quick/full format
      • file and folder compression on/off (enabling compression will take some resources from CPU)

  2. Diskpart

After a filesystem has been formatted it needs to be mounted to a drive (to make it accessible). Windows does this automatically.

4.4. Virtual memory

Virtual memory allows OS provide the available physical memory (RAM) to the running applications. It creates a mapping between virtual and physical addresses. Virtual memory allows programs:

When a particular page of data (data block) isn't being used by an application, it gets evicted (copied out of memory onto the hard drive). This way memory resources are used most efficiently, and if a program needs a page that's not accessed a lot, the OS can still get to it in swap.

In Windows virtual memory and pages are managed by the Memory Manager. Pages are stored in a hidden file pagefile.sys on the root partition of a volume. Default settings (size, number and location of page files) can be changed from a control panel (control panel → system and security settings → system → advanced system settings → advanced → settings (performance) → advanced).

4.5. Files and metadata

NTFS file system uses MFT (master file table) to store and represent files and their metadata on a volume.

4.6. Disk usage

In Windows, monitoring of disk usage can be done with the Disk Management tool or with the disk usage utility (from sysinternals).

4.7. File system repair

Data corruption could happen for lots of reasons:

NTFS file system has features that minimize the danger of data corruption, as well as, features that recover data when it gets damaged:

5. Process management

5.1. Processes

Program is an application that a user can run.

Process is a program that's executing (i.e., user can have many processes of the same program running at the same time, e.g., browser tabs of a web browser).

5.2. Process monitoring

In Windows process monitoring can be handled with the Task Manager (taskmgr.exe), which can be accessed with:

5.3. Process management

In Windows, in addition to Task Manager there is also a more powerful process management tool: Process Explorer. It doesn't come preinstalled with Windows, but can be downloaded from Microsoft website. It allows to:

Process management:

  1. Kill Process
  2. Kill Process Tree (kill the process and all of its descendants)
  3. Restart (as a child of procexp.exe)
  4. Suspend (to continue it later)
  5. Resume (for suspended processes)

Sometimes user might want to interrupt a process before it fully completes. Signals are used for that purpose, they can be generated through other processes and software, or with keyboard shortcuts. Most common signal in Windows is SIGINT (signal interrupt), which can be generated with a Ctrl + C shortcut. There are other signals, but there isn't an easy way to issue them in Windows.

5.4. Resource monitoring

In Windows, user can monitor system resources with the Resource Monitoring tool. It can be accessed through PowerShell with Get-Process command.

6. Operating systems in practice

6.1. Remote connection

There are several protocols for remote connection in Windows:

  1. SSH (secure shell)

    • SSH client needs to be installed on a user computer, and SSH server on a host machine (populars programs: OpenSSH and PuTTy)

    • SSH server doesn't need to be a physical machine, it can be just a software, that's running as a background process

    • openSSH: ssh <user>@<host>

      • user has to have an account on a host machine
      • can access host using an IP address or a host name
      • can specify a port with -p <port> (22 by default for SSH)

    • PuTTy: using GUI or with putty.exe -ssh <user>@<host> <port> in PowerShell

    • when user connects to a remote machine for the first time, they will be asked to verify the authenticity of a host, and after confirmation host will be added to the list of known hosts

    • SSH authentication keys can be used instead of passwords (more secure)

  2. RDP (remote desktop protocol)

    • enable remote connections on host machine: This PC → Properties → Remote Settings → enable remote connections
    • mstsc.exe (Microsoft terminal services client) is used to create RDP connections (can be used through GUI or PowerShell)
    • there are also Linux and Mac clients (RealVNC, Microsoft RDP)
    • can specify the list of users who can access the host machine

  3. VPN (virtual private network)

6.2. Remote file transfer

  1. SSH tunnels

    • with PuTTy secure copy client: pscp.exe <path1> <user>@<host>:<path2>
    • might be time consuming for transfering files to multiple machines

  2. Shared folders

    • built-in mechanism in Windows
    • can be configured in folder properties
    • after folder is marked as shared, user needs to map it as a network drive
    • net share in PowerShell to show a list of shared folders on a computer

6.3. Logs

In most systems, there is a service that runs in the background and constantly writes events to logs. In Windows, the logged events are stored in the Event Viewer (eventvwr.msc).

6.4. OS deployment

Installing an OS on a large number of machines using traditional methods (e.g., with a USB stick) can be very time consuming, so different methods are used instead:

  1. Disk cloning

  2. Network initiated deployment

    • request the images directly from the network
    • there are ways to use custom images too