Windows sysinternals

Windows 7
461
VMMap (continued)
View A Running Process tab,
213
VMs, attaching to VHDs, 336
volume clusters, graphical view
of, 342
volume management utilities,
335–350
volume permissions, 340
Volume Properties dialog box,
343
Volume Snapshot, 335
VolumeID, 350
changing, 350
Write permissions for, 350
volumes
effective permissions on, 269
flushing to disk, 339–340
graphical display of, 341–344
W
wait time of services, 198
wallpaper, system information
displayed as, 309–318
Web, running utilities from, 10
WebClient service, starting, 10
Whois, 353
Whois lookups, 352
WinDbg.exe, 421
dump files, viewing in,
236–237
locations of, 251
WinDiff, 399
window manager, 35
window messages, 34–36
window messaging architecture,
35
window stations, 32–33
desktops, 33–34
identifying, 34
relationship with sessions and
desktops, 30–31
window submenu, 51
windows
desktops, connection
between, 318
ownership, determining,
66–67
Windows Attachment Execution
Service, alternate data
stream, 8–9
Windows desktop objects,
318–319
Windows event logs, displaying
records, 192–196
Windows Explorer, autostart
entries, 155–157
Windows Firewall, DebugView
exception in, 248
Windows Hardware Abstraction
Layer (HAL), compatibility
issues, 336
Windows Internals: Including
Windows Server 2008 and
Windows Vista, Fifth Edition
(Russinovich and Solomon),
15, 43, 360, 370, 374
Windows Management
Instrumentation (WMI) job
object, 21
Windows native-mode
executables, autostarting,
160
Windows Object Manager, 370
Windows operating system
administrative rights, 15–20
Autostart Extensibility Points,
145
call stacks, 24–30
core concepts, 15–36
desktops, 33–34
fake system components,
431–433
jobs, 21
kernel-mode core, 23
Last Known Good option, 128
load order of drivers and
services, 373–374
object types, 23–24
offline instances, ASEPs of, 152
processes, 21–22
processor access modes,
22–23
Safe Mode with Command
Prompt, starting in, 430
signature catalog database,
264
64-bit versions, 155
terminal services sessions,
31–32
threads, 21–22
utilities for, 3. See
also Sysinternals utilities
window messages, 34–36
window stations, 32–33
Windows Powercfg.exe tool, 375
Windows PowerShell, redirected
console output and, 178
Windows Preinstallation
Environment (WinPE), 385
Windows process, components
of, 21
Windows Server 2003
administrative rights, running
programs with, 16–18
GINA DLL interface, 163
Run As command, 278
Run As dialog box, 149
VHDs, creating on, 336
Windows Server 2008, process
reflection feature, 233
Windows services. See
also services
autostarting, 158–159
dependencies of, 159
description of, 158
disabling or deleting, 158–159
effective permissions on, 270
listing, 197–202
monitoring, 296
multiple services, hosting, 158
Parameters key, 159
path to, 158–159
in processes, 86–87
processes containing, 44
startup of, 158–159
Windows 7
administrative rights, running
programs with, 18–20
AppLocker feature, 410
compatibility issues,
troubleshooting, 410–415
Desktop Gadgets, 165
IT Pro–oriented
enhancements, 410
Logical Prefetcher, 404
process reflection feature, 233
ReadyBoost, 408
www.it-ebooks.info