Windows and Windows Server: versions, editions and architecture

1. Clients and servers #

Two families, one kernel.

Windows client and Windows Server #

Windows comes in two families that share the same NT kernel: Windows client (Windows 11) for workstations, and Windows Server for servers. Windows Server adds roles (Active Directory, DNS, DHCP, file server, Hyper-V, IIS…) and features (backup, clustering…), and is usually managed remotely.

Good to know: End-of-support dates are published on Microsoft’s “Lifecycle” page: check them before planning a migration. An unsupported server no longer receives security fixes.

Editions and installation options #

At installation, Windows Server offers Server Core (no graphical interface, managed with PowerShell or remotely) or Desktop Experience. Server Core is recommended for production: fewer components, therefore fewer updates, reboots and attack surface. The sconfig tool configures it on first boot (name, network, domain, updates).

2. System architecture #

What happens under the interface.

User mode and kernel mode #

Applications and most services run in user mode, isolated from each other. They use the Win32 API to ask the kernel (ntoskrnl.exe) to access files, memory or the network. Drivers run in kernel mode: a faulty driver causes a blue screen (bug check), whereas a faulty application only closes.

The registry #

The registry is Windows’ hierarchical configuration database. It is organized in hives: HKLM (machine: SYSTEM, SOFTWARE, SAM, SECURITY, stored in C:\Windows\System32\config) and HKCU (logged-on user, the NTUSER.DAT file of their profile). Services, drivers, policies and software store their settings there.

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
    Select-Object ProductName, DisplayVersion, CurrentBuild
Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services | Select-Object -First 5
reg export HKLM\SOFTWARE\MonAppli C:\sauvegarde\monappli.reg   # sauvegarder une clé avant de la modifier

Common mistake: Editing the registry by hand without a backup. A wrong value in HKLM\SYSTEM can prevent boot. Prefer Group Policy or dedicated cmdlets, and always export the key before a change.

The boot process #

With UEFI and Secure Boot, the firmware only starts signed loaders. The boot manager reads the BCD database (Boot Configuration Data), viewed with bcdedit. When something goes wrong, the WinRE recovery environment gives access to a command prompt, restore and safe mode.

3. Administration tools #

Graphical, command line or remote.

Overview #

Good practice: Manage from a dedicated admin workstation with RSAT and Windows Admin Center, rather than opening Remote Desktop sessions on every server: it is faster, traceable and safer.

Commands to know #

To follow the course, build a lab: a Windows Server 2025 virtual machine (free 180-day evaluation) on Hyper-V, VirtualBox or in the cloud, and a Windows 11 workstation.