the Windows NT architecture
/ en-TEE /
Every modern version of Windows — Windows 10, 11, and Windows Server — is built on a design called Windows NT, created in the early 1990s under David Cutler (who had built earlier serious operating systems). Picture a well-run company: the workers up front (the apps) never touch the bank vault or the wiring directly; they file requests with a back office that actually carries them out under strict rules. NT was designed from the start to be that disciplined — secure, reliable, portable across CPU types, and able to run programs written for different older systems.
Its structure has a few signature pieces. At the very bottom sits the Hardware Abstraction Layer (HAL), a thin shim that hides the differences between motherboards and chips so the rest of the kernel can ignore them. Above the small core kernel sits the Executive, a set of cooperating manager components — the object manager, process and thread manager, memory manager, I/O manager, and security reference monitor — that together provide the real operating-system services in kernel mode. On top, in user mode, sit environment subsystems: the most important is the Win32 subsystem that almost all Windows programs talk to. Historically NT also offered other personalities (such as a POSIX/Unix-style subsystem), which is why people call NT's design subsystem-based: the same kernel can present more than one programming environment.
The honest point is that NT is usually called a hybrid kernel. It is not a pure microkernel — for speed, big subsystems like graphics and the file systems run in kernel mode rather than as isolated user-mode servers — but it borrows microkernel ideas of clean separation and a small privileged core, more than a classic monolithic Unix does. Whether that makes it a microkernel or a monolith is partly a matter of definition; the practical takeaway is that NT deliberately blends both styles to balance reliability against performance.
A Windows app calls a function to read a file. That call goes through the Win32 subsystem into the Executive's I/O manager, which hands the request to a driver; the driver talks to the disk only through the Hardware Abstraction Layer, so the exact controller chip does not matter. The app never knew which of these layers existed — it just got its bytes back.
Layered design: apps to subsystem to Executive to driver to HAL to hardware.
Do not equate the NT kernel version with the marketing name. Windows 7, 10, and 11 are all NT-based and share the same underlying architecture; the consumer numbers do not match the internal kernel version at all.