Windows internals for admins

Start DC01, sign in and open PowerShell as administrator. Everything here only reads, until the Break It section.

1See which processes run in session 0

Run this:

Get-Process -Name lsass, services, wininit, explorer | Select-Object Name, Id, SessionId

You should see something like this:

Name       Id SessionId
----       -- ---------
explorer 4812         1
lsass     712         0
services  696         0
wininit   584         0

explorer is your desktop, so it runs in your session (1). The system processes run in session 0, which nobody signs in to. That’s why a service can never pop up a window on your desktop.

✅ Checkpoint: lsass, services and wininit show SessionId 0; explorer shows your session number.

2Read a service’s account, path and start mode

Run this:

Get-CimInstance Win32_Service -Filter "Name='Spooler' OR Name='Dnscache' OR Name='W32Time'" |
    Select-Object Name, StartMode, State, StartName, ProcessId

You should see something like this:

Name     StartMode State   StartName                    ProcessId
----     --------- -----   ---------                    ---------
Dnscache Auto      Running NT AUTHORITY\NetworkService       1544
Spooler  Auto      Running LocalSystem                       2716
W32Time  Auto      Running NT AUTHORITY\LocalService         1208

Get-Service doesn’t show the account; Win32_Service does, in StartName. Three services, three different accounts. The print spooler runs as LocalSystem, which is why print spooler bugs have been some of the most serious Windows security holes.

✅ Checkpoint: You can see the account each service runs as.

3Find which services share a svchost

Run this:

Get-CimInstance Win32_Service -Filter "State='Running'" |
    Where-Object PathName -like '*svchost*' |
    Group-Object ProcessId |
    Where-Object Count -gt 1 |
    Select-Object Name, Count, @{n='Services';e={$_.Group.Name -join ', '}} -First 3

You should see something like this:

Name Count Services
---- ----- --------
1052     3 BFE, mpssvc, PolicyAgent
1404     3 Dnscache, LanmanWorkstation, NlaSvc
2208     2 CryptSvc, WinRM

Each line is one svchost process (by PID) hosting several services. Kill that process, and every service in the list stops with it. Remember this the next time someone says “just end the svchost that’s using CPU”.

✅ Checkpoint: You found at least one svchost hosting more than one service.

4Check service dependencies

Run these one at a time:

Get-Service -Name LanmanWorkstation -DependentServices | Select-Object Name, Status
Get-Service -Name Netlogon -RequiredServices | Select-Object Name, Status

You should see something like this:

Name           Status
----           ------
SessionEnv Running
Netlogon   Stopped

Name              Status
----              ------
LanmanWorkstation Running

DependentServices are the services that need this one; stopping it stops them too.

RequiredServices are the ones it needs. Netlogon, the service that keeps a computer’s trust with the domain, depends on the Workstation service. It’s stopped for now because DC01 isn’t in a domain yet; that changes in Lesson 11.

✅ Checkpoint: You can name a service that depends on LanmanWorkstation.

5Find the same settings in the registry

Run this:

Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\Spooler | Select-Object Start, ImagePath, ObjectName, DependOnService

You should see something like this:

Start ImagePath                           ObjectName  DependOnService
----- ---------                           ----------  ---------------
    2 %SystemRoot%\System32\spoolsv.exe LocalSystem {RPCSS, http}

HKLM: is a PowerShell drive for the registry, so you browse it like a folder. Start 2 means Automatic (3 Manual, 4 Disabled). Everything services.msc shows comes from this key, which is how you can check or fix a service on a server where the console won’t open.

✅ Checkpoint: The registry shows Start 2 and ImagePath spoolsv.exe for the Spooler.

6Read the boot configuration and boot events

Run these one at a time:

bcdedit /enum '{current}'
Get-WinEvent -FilterHashtable @{LogName='System'; Id=12,13,6005,6006} -MaxEvents 4 | Select-Object TimeCreated, Id, ProviderName

You should see something like this:

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows Server
locale                  en-US
recoverysequence        {8a1f3e52-6c0b-11f0-9a4e-c2e4a1b7d3f0}
displaymessageoverride  Recovery
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
nx                      OptOut

TimeCreated            Id ProviderName
-----------            -- ------------
19-10-2026 19:05:12  6005 EventLog
19-10-2026 19:05:04    12 Microsoft-Windows-Kernel-General
19-10-2026 19:04:40  6006 EventLog
19-10-2026 19:04:39    13 Microsoft-Windows-Kernel-General

The BCD entry tells Boot Manager which loader to run (winload.exe here, winload.efi on UEFI) and where Windows lives. In the events, 13 and 6006 are the last shutdown, 12 and 6005 the next start. The gap between them is how long the server was down: a quick way to confirm “it restarted at 19:04”.

✅ Checkpoint: You can see the winload path in the BCD and a 13/12 pair for the last restart.

7Find the event log files

Run this:

Get-ChildItem C:\Windows\System32\winevt\Logs -Filter *.evtx |
    Sort-Object Length -Descending |
    Select-Object -First 5 Name, @{n='MB';e={[math]::Round($_.Length/1MB,1)}}

You should see something like this:

Name                                                MB
----                                                --
Security.evtx                                     20.1
System.evtx                                        4.1
Application.evtx                                   2.1
Microsoft-Windows-PowerShell%4Operational.evtx    15.1
Windows PowerShell.evtx                            1.1

Every log is a .evtx file here, with a maximum size. When it’s full, the oldest events are overwritten, so on busy servers the Security log may only cover a few days. Lesson 43 shows how to keep logs longer.

✅ Checkpoint: You can see the Security, System and Application log files and their sizes.