Windows Interview Questions

[nithyasubramanian]

Windows Interview Questions

1) Describe and explain about values in Microsoft windows operating system?
At the bottom of the hierarchy are the entries, called values, which contain the information. Each value has three parts a name, a type, and the data. The name is just a Unicode string, often default if the directory contains only one value. The type is one of 11 standard types. The most common ones are Unicode string, a list of Unicode strings, a 32 bit integer, an arbitrary length binary number, and a symbolic link to a directory or entry elsewhere in the registry.

2) Explain about SAM in Windows?
SAM is generally called as Security account manager. The SAM subkey contains the user names, groups, passwords, and other account and security information needed for logging in. The SECURITY sub key contains general security policy information, such as minimum length for passwords, how many failed login attempts are tolerated, etc.

3) Explain about two major pieces in windows operating structure?
Windows 200o consists of two major pieces: the operating system itself, which runs in kernel model, and the environment subsystems, which runs in user mode. The kernel is a traditional kernel in the sense that it handles process management, memory management, file systems, and so on. The environment subsystems are somewhat unusual in that they are separate processes that help user programs carry out certain system functions.

4) Explain about HAL
HAL is a thin layer below the Kernel. The job of the hardware abstraction layer is to present the rest of the operating system with abstract hardware devices. These devices are presented in the form of machine-independent services that the rest of the operating systems and the drivers can use. By using the HAL services and not addressing the hardware directly, drivers and the kernel require fewer changes when being ported to new hardware.

5) Explain about control objects?
Control objects are those objects that control the system, including primitive process objects, interrupt objects, and two somewhat strange objects called DPC and APC. A DPC object is used to split off the non time critical part of an interrupt service procedure from the time critical part.

6) What are dispatcher objects?
The other kind of kernel objects are dispatcher objects. These include semaphores, mutexes, events, waitable timers, and other objects where threads can wait on. The reason that these have to be handled in the kernel is that they are intimately interwined with thread scheduling, which is a kernel task.

7) Explain cache manager?
The cache manager keeps the most recently used disk blocks in memory to speed up access to them in the event that they are needed again. Its job is to figure out what which blocks are probably going to be needed again and which ones are not. It is possible to configure Windows 2000 with multiple file systems, in which case the cache manager works for all of them, so each one does not have to do its own cache management. When a block is needed, the cache manager is asked to supply it.

Explain about device drivers?
Each device driver can control one or more I/O devices, but a device driver can also do things not related to a specific device, such as encrypting a data stream or even just providing access to kernel data structures. Device drivers are not part of the ntoskrnl.exe library. The advantage of this approach is that once a driver has been installed on a system, it is added to a list in the registry and is loaded dynamically when the system boots.

9) Explain about objects in Microsoft windows 2000?
Objects have a structure. Each object contains a header with certain information common to all objects of all types. The fields in this header include the objects name, the object directory in which it lives in objects space, security information and a list of process with open handles to the object. Each object header also contains a quota charge field, which is the charge levied against a process for opening an object.

10) What are sockets?
Sockets are like pipes, except that they normally connect processes on different machines. One process writes to a socket and another one on a remote machine read from it. Sockets can also be used to connect processes on the same machine, but since they entail more overhead than pipes, they are generally only used in a networking context.

11) What is a semaphore?
A semaphore is created using the CreateSemaphore API function, which can initialize it to a given value and define a maximum value as well. Semaphores are kernel objects and thus have security descriptors and handles. The handle for a semaphore can be duplicated using DuplicateHandle and passed to another process so that multiple processes can synchronize on the same semaphore.

12) Explain about winlogon.exe?
Winlogon.exe is also responsible for all user logins. The actual login dialog is handled by a separate program in msgina.dll to make it possible for third parties to replace the standard login with face print identification or something else other the name and password. After a successful login, winlogon.exe gets the user`s profile from the registry and from it determines which shell to run.

13) What is the function of Mapped page writer and modified page writer?
These functions periodically check to determine clean pages. If there are not, they take pages from the top of the modified list, write them back to disk, and then move them to the standby list. The former handles writes to mapped files and the latter handles writes to the paging files. The result of these writes is to transform dirty pages into clean pages.

14) What are the six states which the power manager can put the computer into?
The I/O manager is also closely associated with the power manager. The power manager can put the computer into any of the six states, they are
1)Fully operational
2)CPU power reduced, RAM and cache on, instant wake up
3)CPU and RAM on, CPU cache off, continue from PC.
4)CPU and cache off; RAM on;, restart from fixed address.
5)Hibernate: CPU, cache, and RAM off; restart from saved disk files.
6)OFF: Everything off; full reboot required.

15) Explain windows support for dynamic disks?
An interesting feature of windows 2000 is its support for dynamic disks. These disks may span multiple partitions and even multiple disks and may be reconfigured on the fly, without even having to reboot. In this way, logical volumes are no longer constrained to a single partition or even a single disk so that a single file system may span multiple drives in a transparent way

16) Explain about NTFS volume.
Each NTFS volume contains files, directories, bitmaps, and other data structures. Each volume is organized as a linear sequence of blocks, with the block size being fixed for each volume and ranging from 512 bytes to 64 KB, depending on the volume size. Most NTFS disks use 4-KB blocks as a compromise between large blocks and small blocks.

17) Explain the working of compression?
NTFS writes a file marked for compression to disk; it examines the first blocks in the file, irrespective of how many runs they occupy. It then runs a compression algorithm on them. If the resulting data can be stored in 15 or fewer blocks, the compressed data are written to the disk, preferably in one run. If the compressed data still take 16 blocks, the 16 blocks are written in uncompressed form. Then blocks 16-31 are examined to see if they can be compressed to 15 blocks or less.