12.2 Windows Fundamentals

Windows remains the dominant desktop operating system in many enterprise and DoD environments, and cyber operators must be comfortable with its core ideas even when day-to-day work also includes Linux. The Cyber Test focuses on conceptual literacy more than clicking through every Control Panel applet. Three pillars carry most of the weight: services, the Registry, and the difference between CMD and PowerShell.

Why Windows Literacy Matters for Cyber

Attackers and defenders both live in Windows' management surfaces. Malware may install itself as a service so it restarts after reboot. Persistence mechanisms often write Registry keys. Incident responders use shells to inventory processes, network listeners, and scheduled tasks. If you only memorize Linux commands and ignore Windows concepts, you leave a large part of the operating-systems domain uncovered.

Windows Services

A service is a program designed to run in the background under the control of the Windows Service Control Manager (SCM). Unlike a normal desktop app you launch and close, a service can:

• Start automatically when Windows boots
• Run without a logged-on interactive user
• Restart according to recovery options if it fails
• Operate under a configured account (Local System, Network Service, a domain account, and so on)

Examples you have almost certainly used without thinking about them: Windows Update-related services, print spooler, networking services, antivirus agents, and remote management helpers.

Exam-ready mental model:

From a security angle, services matter because they are powerful and persistent. A malicious or misconfigured service can survive reboots and run with high privileges. From an operations angle, "the website is down" or "remote desktop failed" often traces to a stopped or disabled service rather than a broken application binary.

You do not need every sc or PowerShell cmdlet memorized for the Cyber Test, but you should recognize that administrators start/stop/configure services as a first-line troubleshooting and hardening action.

The Windows Registry (Conceptual Depth)

The Windows Registry is a hierarchical database that stores configuration data for the operating system and many applications. Think of it as Windows' central settings store — more structured than a pile of random text files, and more sensitive than a user preference dialog.

High-level structure (enough for aptitude exams):

• Data is organized in keys (like folders) and values (like named settings)
• Major top-level hives include areas for machine-wide settings and per-user settings (you may see names like HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER in documentation)
• Applications and Windows components read Registry values at startup or when a feature is used

Why cyber cares:

1. Persistence — malware frequently adds Run keys or service-related Registry entries so it launches again after reboot
2. Configuration integrity — changing a security policy, proxy setting, or auth-related value can weaken or harden a host
3. Forensics — Registry artifacts help reconstruct what was installed, configured, or executed

What the Registry is not: it is not a general-purpose document store, not the same thing as Active Directory, and not identical to the Linux /etc directory — though /etc is a fair analogy for "where system configuration lives." Keep the analogy loose: Linux leans on text config files; Windows centralizes many settings in the Registry.

Safe practice in real operations: back up before editing, prefer supported management tools/policies when possible, and treat direct Registry edits as high-impact. For the exam, the key is recognizing the Registry as the configuration database attackers and admins both touch.

CMD vs PowerShell

Windows offers more than one command-line environment. The two you must distinguish are Command Prompt (CMD) and PowerShell.

Command Prompt (CMD)

CMD is the traditional Windows command interpreter. It understands classic commands and batch-file syntax that go back decades:

• Familiar examples: dir, cd, copy, move, del, ipconfig, ping
• Scripts are often .bat or .cmd files
• Output is primarily text streams you parse by eye or with simple filters

CMD is still everywhere: recovery environments, quick one-liners, older documentation, and muscle memory from help-desk workflows.

PowerShell

PowerShell is a newer shell and scripting language designed for administration and automation. Distinctive traits:

• Commands are often cmdlets with a Verb-Noun pattern (Get-Service, Get-Process, Set-Item)
• Pipelines can pass objects, not just raw text — so you filter and select properties more reliably
• Deep coverage of Windows management: services, processes, event logs, Registry providers, remoting, and more
• Script files commonly use the .ps1 extension

Comparison table for exam recall:

Important nuance: many tasks overlap. You can check IP settings from either world, and some CMD commands still work inside PowerShell for convenience. The Cyber Test angle is conceptual: if a question emphasizes object pipelines, cmdlets, or modern automation on Windows, the answer points to PowerShell. If it references classic batch syntax or old-school commands in a Command Prompt context, think CMD.

Practical Mental Scenarios

Map symptoms to concepts:

• "A background component should start at boot but users never launch it" → service
• "A setting survives reboot and is stored in Windows' configuration database" → Registry
• "Need a one-off ipconfig in a recovery console" → often CMD-style workflow
• "Need to script an inventory of services and filter by status across many hosts" → PowerShell

Defensive Takeaways Without Overclaiming

Hardening and detection on Windows frequently involve:

• Reviewing which services are unnecessary or running as overly powerful accounts
• Monitoring Registry locations associated with persistence
• Restricting who can run unsigned or unexpected PowerShell scripts in enterprise policy

You are not expected to recite every MITRE technique ID here. You are expected to know the building blocks those techniques abuse.

Study Focus for the Cyber Test

Prioritize definitions and contrasts over memorizing long command encyclopedias. If you can explain what a service is, what the Registry stores, and how PowerShell differs from CMD in purpose and style, you are aligned with the Operating Systems domain's Windows slice. Pair this section with Linux fundamentals: cyber aptitude rewards candidates who can switch mental models between the two ecosystems without mixing their vocabularies.