Search notes:

Windows kernel

The first process that is started by the kernel is the Windows Session Manager (smss.exe).

Components running in kernel mode

Components that run in kernel mode (as opposed to user mode) include

Drivers

Device drivers run in the same privilege level as the kernel itself.

See also

ntoskrnl.exe
kd.exe is the Windows Kernel Debugger.
ntdll.dll provides the native API to the kernel.
kernel objects
Kernel Patch Protection

Index