Windows Kernel

Many programs run on a computer at the same time: browser, game, music app. None of these programs is allowed to decide for itself when to use the processor or which part of memory to write to. These decisions are made by a central piece of software that starts first when the machine is switched on and keeps running until it is switched off. On Windows, this core piece is called the Windows kernel. It allocates processing time, manages memory, and forwards commands to the keyboard, hard drive, or graphics chip. Everything else on the computer is ultimately a customer making requests to the kernel.

What a fault in the core causes

Programs are shielded from one another. If the browser crashes, the music app keeps running. This does not apply to the kernel. It is the layer on which everything else is built. A severe error there therefore brings down the entire system. That is exactly the notorious Blue Screen, the blue screen with the error message.

Even more important is the security question. Code in the kernel can do practically anything: read any memory area, open any file, bypass any protection rule. Whoever exploits a gap in the kernel takes over not just a program, but the entire machine. Such vulnerabilities are considered the most valuable of all and are traded for high sums on the black market. That is why Microsoft releases security updates every second Tuesday of the month, which often close exactly such gaps.

The kernel is also an economic factor. Windows runs on more than a billion devices, including checkout systems, hospital computers, and airport terminals. A faulty update that interferes with the kernel can trigger outages worldwide. In July 2024, the incident involving the security firm CrowdStrike demonstrated this: a defective file caused millions of Windows computers to crash and led to flight cancellations.

The split into two operating modes

Modern processors know two operating modes. In user mode, normal programs run with limited privileges. In kernel mode, the kernel itself and some system components run with full privileges. If a program wants to do something it is not allowed to do itself, it makes a system call. The processor then switches to kernel mode, the kernel checks the request, and carries it out.

An example: your word processor saves a file. It does not write to the SSD itself. It asks the kernel to do so, and the kernel passes the task on to the appropriate driver. A driver is a small additional program that understands the language of a particular component. This is exactly why drivers are delicate: many of them run with kernel privileges even though they come from third-party manufacturers.

A common misconception: that the kernel is the same as Windows. It is only the core, technically the file ntoskrnl.exe, a few megabytes in size. The Start menu, Explorer, Settings, and all apps sit on top of it. The Windows kernel originates from the NT line of 1993 and has been developed further ever since, not rewritten from scratch. Linux and macOS have their own kernels with a similar task but a different structure.

From the Blue Screen to the AI data center debate

In everyday life, you usually only notice the kernel when something goes wrong. A Blue Screen often names a module, such as a graphics driver. The Task Manager also shows traces: the entry “System” stands for kernel work. If a game stutters even though the processor has headroom, it is sometimes due to drivers in the kernel.

In the news, you mostly encounter the term in connection with security topics. Antivirus programs and anti-cheat systems in games like to install their own kernel modules because that lets them monitor deeply. Privacy advocates criticize this because such software has more privileges than any other program. After the CrowdStrike incident, Microsoft is working on getting security software out of the kernel.

The kernel is also relevant to AI. Data centers train models on specialized chips, and the kernel controls how programs access these chips. However, Linux dominates there, not Windows. Beware of a coincidental term overlap: in AI programming, a small computation program for the graphics card is also called a “kernel.” This has nothing to do with the operating system kernel.