NT Internals Tips and Trivia

  Copyright © 1996-1997 Mark Russinovich

  Last Updated November 5, 1997

  Miscellaneous NT Information

   Introduction This page is an ever-expanding collection of NT information that we
                accumulate over time. You'll find practical tips as well useless
                trivia, with new items added at the top of the page.

          Fault One of the differences I highlighted in my November 1996 Windows NT
   Tolerance on Magazine article, "Inside the Difference Between Windows NT
   Workstation? Workstation and Windows NT Server," was that fault tolerant disk
                configurations are only available on Server. This is because the
                Windows NT disk administrative program, Windisk.exe, checks to see
                if its running on a Workstation, and if so, does not display its
                Fault Tolerance menu, which contains the entries that are used to
                create mirrors and parity striped sets.

                It turns out that whoever wrote the Workstation Resource Kit
                program FTEDIT was unaware of Microsoft's official policy on fault
                tolerance and Workstation: it appears you can use this utility to
                create mirrors and striped sets with parity on Workstations.

                Update: several people have complained that this doesn't work,
                which isn't surprising since I left out an important step: the
                Fault-tolerant disk driver must be enabled. If you have an existing
                volume-set then it is already is, but if you don't, use a Registry
                editor to set the value of:

                HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\FtDisk\Start

                to 0. The next time you boot your workstation, the fault-tolerant
                drives you have created will be functional.

     The Native NT's native API are services that are core operating system
           API  services available to device drivers and user-mode applications.
                The Win32 subsystem relies heavily on this API, as do many
                Microsoft Windows NT Resource Kit utilities. There are over 200
                system calls in NT's native API and only 21 of them are documented
                by Microsoft.

    Idle Trivia Did you know that unlike all the other threads in an NT system, the
                idle-thread executes at an IRQL (interrupt request level) of
                DISPATCH_LEVEL (rather than PASSIVE_LEVEL)? See Advanced DPCs for
                more information.

                On uniprocessor x86 systems the idle-thread actually performs a HLT
                (Halt) instruction, which effectively turns the CPU off to
                everything except for hardware interrupts.

   Never-ending In NT, as with most time-sharing operating systems, threads run in
      Quantum?  turns called quantums. Normally, a thread executes until its
                quantum runs out. The next time it is scheduled it starts with a
                full quantum. However, in NT a thread also gets its quantum
                refreshed every time its thread or process priority is set. This
                means that a thread can reset its quantum by calling
                SetThreadPriority (without changing its priority) before its turn
                runs out. If it continues to do this it will effectively have an
                infinite quantum. Why does NT do this? Its not clear, but it
                appears to be a bug.

     NTOSKRNL's NTOSKRNL.EXE, the core file of the kernel-mode component of Windows
           Main NT, contains the Cache Manager, the Executive, the Kernel, the
                Security Reference Monitor, the Memory Manager, and the Scheduler,
                among other things, and is in charge of getting NT up and running.
                You may be surprised to know that it has a standard main() that is
                executed when it is loaded by the OSLOADER:

                //
                // NTOSKRNL main
                //
                int main()
                {
                    //
                    // Fire up NT!
                    //
                    KiSystemStartup();
                    return 0;
                }

         Tuning NT Workstation and NT Server have vastly different performance
    Workstation characteristics due to the internal tuning that the NT operating
            for system, which is identical on both, performs. Most tuning
    Server-like parameters are inaccessible, but a few are located in the Registry.
         Loads  If you are running Server and you double-click on the Server entry
                of the Services tab in the Control Panel's Network applet, you will
                get a dialog that lets you determine what type of application you
                want the machine to be tuned for. Choices let you select between
                "Minimize Memory Used", "Balance", "Maximize Usage for File
                Sharing", and "Maximize Usage for Network Applications". This
                dialog box is not presented on Workstation installations. The
                various selections actually change the values of two Registry
                values:

                HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
                Management\LargeSystemCache

                and

                HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\Size

                This table (which was derived from sessions with NTRegmon) presents
                the settings you should select on a Workstation to achieve the same
                effect you would get using the dialog box were your system a
                Server.

                    Tuning Target     LargeSystemCache Size

                 Minimize Memory Used         0          1

                       Balance               0           2

                     File Sharing             1          3

                 Network Applications         0          3

  ------------------------------------------------------------------------

                                       [Image]