System Administration

Windows system management for Linux administrators - users, services, registry, and PowerShell fundamentals.

User Account Management

User Account Types

Windows Account Type	Linux Equivalent	Permissions
Administrator	root user	Full system access
Standard User	Regular user	Limited system access
Guest	guest account	Very limited access

Managing Users (GUI)

Settings → Accounts → Family & other users

Linux Equivalent: User management in system settings or useradd/usermod commands.

Managing Users (Command Line)

Task	Windows Command	Linux Equivalent
List users	net user	cat /etc/passwd or getent passwd
Add user	net user username password /add	useradd username
Delete user	net user username /delete	userdel username
Change password	net user username newpassword	passwd username
Add to admin group	net localgroup administrators username /add	usermod -aG sudo username

User Account Control (UAC)

Windows equivalent of sudo - prompts for elevation when administrative tasks are needed.

Key Differences from Linux:

• No sudo command: Right-click → "Run as administrator"
• Elevation prompt: UAC dialog appears for admin tasks
• Admin approval mode: Even admin accounts get prompted
• Bypass UAC: Hold Ctrl+Shift when launching (like sudo prefix)

Service Management

Services Overview

Windows Services are equivalent to Linux systemd services/daemons.

Managing Services (GUI)

Windows + R → services.msc

Service States:

• Running = Active (systemd)
• Stopped = Inactive (systemd)
• Paused = Not available in systemd
• Disabled = Disabled (systemd)

Managing Services (Command Line)

Task	Windows Command	Linux (systemd) Equivalent
List services	sc query or Get-Service	systemctl list-units --type=service
Start service	sc start servicename	systemctl start servicename
Stop service	sc stop servicename	systemctl stop servicename
Restart service	sc stop servicename && sc start servicename	systemctl restart servicename
Enable at boot	sc config servicename start= auto	systemctl enable servicename
Disable at boot	sc config servicename start= disabled	systemctl disable servicename
Service status	sc query servicename	systemctl status servicename

PowerShell Service Commands

PowerShell Command	Purpose	Linux Equivalent
Get-Service	List all services	systemctl list-units --type=service
Start-Service servicename	Start service	systemctl start servicename
Stop-Service servicename	Stop service	systemctl stop servicename
Restart-Service servicename	Restart service	systemctl restart servicename
Set-Service servicename -StartupType Automatic	Enable at boot	systemctl enable servicename

Common Services for Linux Admins

Windows Service	Linux Equivalent	Purpose
Windows Update	unattended-upgrades	Automatic updates
DHCP Client	dhclient/NetworkManager	Network configuration
DNS Client	systemd-resolved	DNS resolution
Windows Firewall	iptables/firewalld	Firewall service
Task Scheduler	cron/systemd timers	Scheduled tasks
Windows Time	ntp/chrony	Time synchronization
Event Log	journald/rsyslog	System logging

Registry Management

Registry Overview

The Windows Registry is a central database for system and application configuration, replacing the scattered config files approach used in Linux.

Linux Equivalent Concept:

• Registry ≈ /etc/ + /home/user/.config/ + /usr/share/ combined
• Registry keys ≈ Directory structure
• Registry values ≈ Configuration parameters

Registry Structure

Registry Hive	Abbreviation	Linux Equivalent	Purpose
HKEY_CLASSES_ROOT	HKCR	/usr/share/applications/	File associations
HKEY_CURRENT_USER	HKCU	~/.config/	Current user settings
HKEY_LOCAL_MACHINE	HKLM	/etc/	System-wide settings
HKEY_USERS	HKU	/home/	All user profiles
HKEY_CURRENT_CONFIG	HKCC	/sys/	Current hardware config

Registry Editor (regedit)

Windows + R → regedit

Basic Operations:

• Navigate: Like file browser with folders (keys)
• Edit values: Double-click to modify (like editing config files)
• Export/Import: Backup/restore registry sections
• Search: Find keys/values by name

Registry via Command Line

Task	Command	Linux Equivalent
Query value	reg query "HKLM\Path\To\Key" /v ValueName	cat /etc/config/file
Set value	reg add "HKLM\Path\To\Key" /v ValueName /d Data	echo "value" > /etc/config/file
Delete value	reg delete "HKLM\Path\To\Key" /v ValueName	rm /etc/config/file
Export key	reg export "HKLM\Path\To\Key" backup.reg	cp -r /etc/config/ backup/
Import key	reg import backup.reg	cp -r backup/ /etc/config/

PowerShell Registry Commands

PowerShell Command	Purpose	Linux Equivalent
Get-ItemProperty	Read registry values	cat /etc/config/file
Set-ItemProperty	Write registry values	echo "value" > /etc/config/file
New-Item	Create registry key	mkdir /etc/config/newdir
Remove-Item	Delete registry key	rm -rf /etc/config/dir

Common Registry Locations

Registry Path	Purpose	Linux Equivalent
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	System startup programs	/etc/init.d/ or systemd
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	User startup programs	~/.config/autostart/
HKLM\SYSTEM\CurrentControlSet\Services	System services	/etc/systemd/system/
HKCU\Control Panel\Desktop	Desktop settings	~/.config/desktop/

Group Policy Management

Group Policy Overview

Centralized configuration management for Windows environments.

Linux Equivalent: Configuration management tools like Ansible, Puppet, or Salt.

Group Policy Editor

Windows + R → gpedit.msc

Note: Only available in Windows Pro/Enterprise editions.

Common Group Policy Settings

Policy Area	Purpose	Linux Equivalent
Computer Configuration	System-wide policies	/etc/ configurations
User Configuration	User-specific policies	User profile configurations
Security Settings	Password, audit policies	/etc/security/, PAM
Software Installation	Automatic software deployment	Package management

Event Viewer & Logging

Event Viewer

Windows + R → eventvwr.msc

Linux Equivalent: journalctl, /var/log/ files, or log viewers like gnome-logs.

Event Log Categories

Windows Log	Purpose	Linux Equivalent
Application	Application events	/var/log/application.log
Security	Security/audit events	/var/log/auth.log
System	System events	/var/log/syslog
Setup	Installation events	Package manager logs

PowerShell Log Commands

PowerShell Command	Purpose	Linux Equivalent
Get-EventLog -LogName System	Read system log	journalctl -u systemd
Get-EventLog -LogName Application	Read application log	tail /var/log/application.log
Get-WinEvent -FilterHashtable @{LogName='Security'}	Read security log	journalctl -t audit

Task Scheduler

Task Scheduler Overview

Windows equivalent of cron jobs and systemd timers.

Task Scheduler GUI

Windows + R → taskschd.msc

Managing Tasks (Command Line)

Task	Windows Command	Linux Equivalent
List tasks	schtasks /query	crontab -l
Create task	schtasks /create /tn "TaskName" /tr "command" /sc daily	crontab -e
Delete task	schtasks /delete /tn "TaskName"	Remove from crontab
Run task	schtasks /run /tn "TaskName"	Manual execution

Schedule Types

Windows Schedule	Cron Equivalent	Example
MINUTE	*/5 * * * *	Every 5 minutes
HOURLY	0 * * * *	Every hour
DAILY	0 0 * * *	Daily at midnight
WEEKLY	0 0 * * 0	Weekly on Sunday
MONTHLY	0 0 1 * *	Monthly on 1st

PowerShell Scheduled Tasks

PowerShell Command	Purpose	Linux Equivalent
Get-ScheduledTask	List scheduled tasks	crontab -l
Register-ScheduledTask	Create new task	crontab -e
Unregister-ScheduledTask	Remove task	Remove from crontab
Start-ScheduledTask	Run task immediately	Manual execution

PowerShell Basics for Linux Admins

PowerShell vs Bash Comparison

Task	PowerShell	Bash	Notes
List files	Get-ChildItem or ls	ls	Alias available
Change directory	Set-Location or cd	cd	Alias available
Copy files	Copy-Item or cp	cp	Alias available
Move files	Move-Item or mv	mv	Alias available
Delete files	Remove-Item or rm	rm	Alias available
Show content	Get-Content or cat	cat	Alias available
Find text	Select-String	grep	Different syntax
Process list	Get-Process or ps	ps	Object-oriented

PowerShell Object-Oriented Approach

Unlike bash text processing, PowerShell works with objects:

# Get services and filter by status
Get-Service | Where-Object {$_.Status -eq "Running"}

# Linux equivalent
systemctl list-units --type=service --state=running

PowerShell Execution Policy

# Check current policy
Get-ExecutionPolicy

# Set policy (as administrator)
Set-ExecutionPolicy RemoteSigned

Linux Equivalent: File permissions and PATH considerations for script execution.

Performance Monitoring

Performance Monitor (perfmon)

Windows + R → perfmon

Linux Equivalent: htop, iotop, nethogs, sar

Task Manager Performance Tab

Ctrl + Shift + Esc → Performance tab

Key Metrics:

• CPU: Like top or htop
• Memory: Like free -h
• Disk: Like iotop
• Network: Like nethogs

PowerShell Performance Commands

| PowerShell Command | Purpose | Linux Equivalent | | --------------------------------------------------------- | ---------------------------- | ----------------- | ----- | | Get-Counter "\Processor(_Total)\% Processor Time" | CPU usage | top, vmstat | | Get-Counter "\Memory\Available MBytes" | Available memory | free -m | | Get-Counter "\PhysicalDisk(_Total)\Disk Read Bytes/sec" | Disk I/O | iostat | | Get-Process | Sort-Object CPU -Descending | Top CPU processes | top |

Windows vs Linux Admin Workflow

Daily Admin Tasks Comparison

Task	Windows Method	Linux Method
Check system status	Task Manager, Event Viewer	htop, journalctl
Manage services	services.msc, PowerShell	systemctl
View logs	Event Viewer	journalctl, /var/log/
Install software	Settings, PowerShell, MSI	Package manager
Network config	Network settings, netsh	nmcli, config files
Firewall	Windows Defender Firewall	iptables, firewalld
Scheduled tasks	Task Scheduler	crontab
User management	User settings, net user	useradd, usermod

Best Practices for Linux Admins

1. Learn PowerShell: More powerful than Command Prompt
2. Use Windows Terminal: Modern terminal experience
3. Enable WSL: Access familiar Linux tools
4. Group Policy: Centralized configuration management
5. Remote management: WinRM (like SSH for Windows)
6. Package managers: Chocolatey or winget for software management
7. Registry backup: Before making changes (like config backups)
8. Event Viewer: Primary troubleshooting tool (like journalctl)