Chapter 04

False

True

False

True

True

C

C

A

D

C

A

C

A

B

C

A

C

B

D

C

C

A,C,D

B,C

B,C,D

A,B,D

Not Responding

ReadyBoost

memory leak

Reliability Monitor

sidebar

Task Manager

Service

Computer Management

Event Viewer

Registry

Windows Experience Index

Windows 7/Vista ReadyBoost

kernel

Task Scheduler

Vista sidebar

A shell is the portion of an OS that relates to the user and to applications. The shell provides tools such as Windows Explorer or the Windows desktop as a way for the user to do such things as select music to burn to a CD or launch an application. For applications, the shell provides commands and procedures that applications can call on to do such things as print a document, read from a storage device, or display a photograph on-screen. The shell is made up of several subsystems that all operate in user mode, which means these subsystems have only limited access to system information and can access hardware only through other OS services. One of these subsystems, the Win32 security subsystem, provides logon to the system and other security functions, including privileges for file access.

Each application running on your computer is assigned a priority level, which determines its position in the queue for CPU resources. You can use Task Manager to change the priority level for an application that is already loaded. If an application performs slowly, increase its priority. You should only do this with very important applications, because giving an application higher priority than certain background system processes can sometimes interfere with the operating system.

1. In Task Manager, click the Applications tab. Right-click the application and select Go To Process from the shortcut menu. The Processes tab is selected and the process that runs the application is selected. 2. Right-click the selected process. From the shortcut menu that appears, set the new priority to AboveNormal. If that doesn't give satisfactory performance, then try High.

- The kernel, or core, of the OS is responsible for interacting with hardware. Because the kernel operates in kernel mode, it has more power to communicate with hardware devices than the shell has. Applications operating under the OS cannot get to hardware devices without the shell passing those requests to the kernel. This separation of tasks provides for a more stable system and helps to prevent a wayward application from destabilizing the system. - The kernel has two main components: 1) the HAL (hardware abstraction layer), which is the layer closest to the hardware, and 2) the executive services interface, which is a group of services that operate in kernel mode between the user mode subsystems and the HAL. Executive services contained in the ntoskrnl.exe program file manage memory, I/O devices, file systems, some security, and other key components directly or by way of device drivers. When Windows is first installed, it builds the HAL based on the type of CPU installed. The HAL cannot be moved from one computer to another, which is one reason you cannot copy a Windows installation from one computer to another.

- Use System Protection to create a restore point. A restore point keeps information about the registry. You can restore the system to a restore point to undo registry changes, as long as the registry is basically intact and not too corrupted. - Back up a single registry key just before you edit the key. This method, called exporting a key, should always be used before you edit the registry. - Make an extra copy of the C:WindowsSystem32config folder. This backup will help if the registry gets totally trashed. You can boot from the Windows setup DVD and use the Windows 7/Vista Recovery Environment or the XP Recovery Console to restore the folder from your extra copy. - For Windows XP, back up the system state. Use Ntbackup in Windows XP to back up the system state, which also makes an extra copy of the registry hives. Windows XP stores the backup of the registry hives in the C:Windowsrepair folder.

Changes made to the registry take effect immediately. Therefore, take extra care when editing the registry. If you make a mistake and don't know how to correct a problem you create, then double-click the exported key to recover. When you double-click an exported key, the registry is updated with the values stored in this key.

To disable the Aero interface, do the following:1. Right-click the desktop and select Personalize from the shortcut menu. The Personalization window opens. 2. Scroll down to and click Windows 7 Basic and close the window.

A process is a program that is running under the authority of the shell, together with the system resources assigned to it. System resources might include other programs it has started and memory addresses to hold its data. When the process makes a request for resources, this request is made to the Win32 subsystem and is called a thread. A thread is a single task, such as the task of printing a file that the process requests from the kernel.

When applications install, they often schedule tasks to check for and download their program updates, and malware sometimes hides as a scheduled task. Scheduled tasks might be unnecessary and can slow a system down. The best way to uninstall a scheduled task is to uninstall the software that is responsible for the task. Open the Task Scheduler window and search through tasks looking for those you think are unnecessary or causing trouble. Research the software the task works with and then you might decide to uninstall the software or disable the task.

Try to identify when the slow performance problem began, and then use the Windows 7 or Vista Reliability Monitor to find out what changes were made to the system around that time and what other problems occurred. If you don't know when the problem started, skim through the line graph at the top of the Reliability Monitor window and look for drops in the graph. Also look for critical events indicated by a red x.