Case Study: Windows 2000 Part I Will Richards CPSC 550 Spring 2001

Windows 2000 Part I History Overview Design Micro Kernel Plug and Play (PnP) NT File System (NTFS)

History 1981 MS-DOS Windows MS-Windows 3.11 (Windows for Workgroups) 1993 Windows NT 1995 Windows Windows NT Windows Windows 2000

Overview Windows 2000 Professional –Replaces NT Workstation – Can Handle 2 CPU’s and 4 Gig of ram –Requires 1 Gig of disk space Windows 2000 Server –Replaces the NT Server –Can Handle 4 CPU’s and 4 Gig of Memory

Overview 2 Windows 2000 Advanced Server –Provides support for distributed computing, clusters and load balancing –Can Handle 8 CPU’s and up to 8 Gig of Ram Windows 2000 Datacenter Server –Can Handle 32 CPU’s and up to 64 Gig of Ram

Design Goals Kernel API: –minimize the need for parameters and flags when programming. Better documentation and support Better Handling of errors Posix and C2 Compliance

Formal Design Simple, well documented, using common coding standards Major portions designed as subsystems Subsystem design allows additional subsystems Every subsystem coded for security features Validation of arguments by subsystem called

Kernel Mode Overview System uses a layered format Kernel Layers –The Executive – Device Drivers –Hardware Abstraction Layer (HAL)

System Layers User Mode Applications Setup PnP manager Executive PnP manager Kernel Mode Device Drivers HAL Object Manager Process and Thread Manager See page 296 fig 12.3 of the text

The Executive Object Manager Process and Thread Manager Security Reference Monitor Local Procedure Call (LPC) Facility Virtual Memory Manager I/O Manager

The Executive 2 Systems within the Executive are responsible for error handling All arguments passed in a system call are checked by the called system Calls made by other kernel processes are assumed correct Calls made from outside the Kernel are thoroughly checked Exceptions raised when needed

Plug and Play New to NT and thus Win2K Improved over Win 9x User knows at installation, if drivers are certified by Microsoft for use. Increased reliability of the system Responsible for Win2k reaching 99.99% reliability

NT File System (NTFS) Supports all MS file formats including: FAT (floppies), FAT-32 (Win 98), CDFS (CD-ROMs), and UDF (DVD’s) Provides a means to interchange files between different systems Uses ACL, Reparse Points and Storage Management

Access Control Lists (ACL) NTFS employs ACL to maintain a database of security protection for the files. ACL is maintained locally on each shared volume Similar to Unix permissions settings. Also controls User disk space quotas

Storage Management Single Instance storage –Identifies duplicate data streams and replaces them with a reference to a single instance. Reducing disk space usage. Remote Storage –Similar to a caching scheme –Allows user to see remotely stored data as though it was stored locally. – Invisible to the user –When the data is in use, it is pulled from remote storage and stored locally in a cache –When the data has not been actively used, it is placed back in remote storage.

Reparse Points Allows the system to determine how to handle a file at the time is it being accessed Contained in the files reference. Indicates the file type. (Win9X, NTFS, third party etc) Indicates actual location Allows Win2K to operate w/ third party file system filters, allowing customized storage management