As we know, a multiprogramming OS switches the processor back and forth between all the program threads that are executing. When the current thread blocks, usually due to I/O, the Windows Scheduler finds another thread that is ready to run and schedules it for execution. If no threads are ready to run, Windows schedules a thread associated with the System Idle process to run instead. When an I/O operation completes, a blocked thread becomes eligible to run again. This scheme means that threads alternate back and forth between the two states: a ready state, where a thread is eligible to execute instructions, and a blocked state. A blocked thread is waiting for some system event that signals that the transition from waiting to ready can occur.

The Processor Queue Length counter in the System object is an extremely important indicator of processor performance. It is an instantaneous peek at the number of Ready threads that are currently waiting to run. Even though reporting processor utilization is much more popular, the Processor Queue Length is actually a more important indicator of a processor bottleneck. It shows that work is being delayed, and the delay is directly proportional to the length of the queue.

Think of priority scheduling as the set of rules for ordering the Ready Queue, which is the internal data, structure that points to the threads that are ready to execute. A ready tread (from IE or any other application) transitions directly to the running state, where it executes if no other higher-priority threads are running or waiting. If there is another thread, the Windows Scheduler selects the highest-priority thread in the Ready Queue to run.

Interrupts are subjected to priority. The interrupt priority scheme is hardware-determined, but in the interest of portability it is abstracted by the Windows HAL. During interrupt processing, interrupts from lower-priority interrupts are masked so that they remain pending until the current interrupt processing completes. Following interrupt processing during which interrupts themselves are disabled, the operation system returns to its normal operating mode with the processor reset once more to receive interrupt signals. The processor is once again enabled for interrupts.

Processor utilization can be further broken down into time spent executing in user mode (Intel Ring 3) or in privileged mode (Ring 0), two mutually exclusive states. Applications typically run in the more restricted user mode, while operating system functions run in privileged mode. Whenever, an application implicitly or explicitly calls an OS service (e.g. to allocate or free memory, or perform some operation on a file), a context switch occurs as the system transitions from user to privileged mode and back again. The portion of time that a tread is executing in user mode is captured as % User Time; privileged mode execution time is captured in the % Privileged Time counter.

Windows is a multiprogramming OS, which means that it manages and selects among multiple programs that can all be active in various stages of execution at the same time. The displaceable unit in Windows, representing the application or system code to be executed, is the thread. The Scheduler running inside the Windows OS kernel keeps track of each thread in the system and points the processor hardware to threads that are ready to run.

Windows OS functions also consumes RAM, so the system has a working set that needs to be controlled and managed like any other process. In this section we discuss the components of the system working set and look at how it is managed.

Both system code and device driver code occupies memory. In addition, the OS allocates data structures in two areas of memory: a pool for non-pageable storage and a pool for pageable storage. Data structures accessed by OS and driver functions when interrupts are disabled must be resident in RAM at the time they are referenced. These data structure are usually allocated from the non-pageable pool so that they reside permanently in RAM. The Pool Nonpages Bytes counter in the Memory object shows the amount of RAM currently allocated that is permanently resident in RAM.