All-Access Pass FREE with any Masterclass Purchase!

Now for a Limited Time...

Receive our All-Access Pass FREE with any Masterclass Purchase!
This year-long, $695 value is only available for Masterclass purchases October 20 - December 31, 2026.
Don't miss the opportunity - purchase your Masterclass spot now and receive your FREE All-Access Pass!
See the Masterclass Schedule

Masterclass Description

In this 4-day LIVE Online Training, you’ll learn how the Windows operating system really works under the hood, and how to troubleshoot it effectively in real-world environments, on both clients and servers, covering Windows 10 and Windows 11 as well as Windows Server 2019, 2022, and 2025.

The training is delivered by Microsoft MVP Sami Laiho and is designed for experienced Windows administrators who want to take their troubleshooting skills to a new level. This is a level 400 class, not for beginners. If you already have extensive Windows knowledge and want to solve complex errors with confidence, this training is for you.

The training follows the same process Sami uses in the field: isolate the problem first, then pick the right tool for the job. You’ll go deep into processes, threads, services, the registry, and the Windows security model, and learn to use Sysinternals tools such as Process Monitor, Process Explorer, and Autoruns, along with the Windows Performance Toolkit and WinDbg, to find root causes instead of guessing. Along the way, you’ll also see how attackers abuse the same internals, and why least privilege and BitLocker matter as much for stability as they do for security.

Why This Training Is Different

This LIVE Online Training is unique in several important ways:

  • Developed and delivered by one of the world’s leading Windows OS troubleshooting experts
  • Built on real-life troubleshooting scenarios for both clients and servers
  • Packed with real customer cases, from 400 computers blue screening on a Monday morning to a 1,000 VM VDI farm stuck at 65 percent CPU
  • Level 400 content focused on Windows internals, not the basics
  • Covers current Windows versions, including Windows 10, Windows 11, and Windows Server 2019, 2022, and 2025

Hands-on-Labs
The training includes a series of hands-on labs that build on each other as one continuing story, from finding hidden settings with Process Monitor to crashing machines on purpose and analyzing the resulting memory dumps. The labs run on dedicated virtual machines in a hosted lab environment that you reach over RDP, so there is nothing to install on your own computer.

Added Bonus
You’ll receive the PDF lab guides with answer keys, the instructor’s class notes, and a reference list of common kernel debugger commands to keep using after the course ends.

What’s Included

This 4-day LIVE Online Training includes:

  • Daily live sessions with plenty of time for Q&A
  • Access to a community of peers with similar goals
  • Direct access to Sami Laiho during live sessions

This training is for you if you want to:

  • Master a structured methodology for isolating and documenting Windows problems
  • Understand Windows OS internals, including processes, threads, services, and the registry
  • Use Sysinternals, the Windows Performance Toolkit, and WinDbg like an expert
  • Troubleshoot slow startup, slow logon, and memory, disk, and CPU bottlenecks
  • Resolve security, permission, Group Policy, domain, network, and device driver issues
  • Recover unbootable machines and analyze BSODs and memory dumps

...and so much more!

Prerequisites

Participants should have good knowledge of Windows client and server operating systems, along with a solid understanding of Active Directory and network infrastructure. Participants should have hands-on experience with Windows administration.

Masterclass Schedule

Date and start time for the next Masterclass:

  • Monday-Thursday, February 1-4, 2027, 9:00 AM-4:00 PM Central Time (US and Canada)


Note: The live sessions of the Masterclass will be recorded and made available for live participants to view.

Sign Up Today!



Masterclass Outline

Module 1: Troubleshooting Methodology

  • Understanding What We Are Up Against, and Why Windows Is Not Always Logical
  • Isolating the Error: Computer, User, Profile, Hardware, Network, Domain, and Mode
  • Capturing a Failing System with Disk2vhd for Later Analysis
  • Documenting the Error and Teaching Users What to Report
  • Avoiding the Two Biggest Mistakes: Wrong Object and Wrong Permissions
  • Knowing When to Escalate to Microsoft, and When to Give Up
  • How Windows Versions, Builds, and Servicing Channels Affect Troubleshooting


Module 2: Tools and Procedures for Troubleshooting Windows

  • Building Your Toolkit: Sysinternals, the Symbol Path, and Built-in Tools
  • Using Process Monitor to Find Any Registry or File Setting
  • Translating Error Codes and Capturing Error Details with Snipping Tool Screen Recording
  • Using Event Viewer Custom Views, Event Tasks, and Event Subscriptions
  • Remote Troubleshooting with PsExec, PowerShell Remoting, tasklist, and taskkill
  • Out-of-Band Access with Intel vPro/AMT and KVM over IP
  • Working with the Appropriate Permissions, and Why Privileges Beat Permissions
  • Regaining Access to a Machine When the Local Admin Password Is Unknown, and Preventing It with Windows LAPS


Module 3: Windows OS Internals

  • Understanding Windows Modes: Kernel Mode, User Mode, and CPU Rings
  • Virtualization-based Security and the Secure Kernel
  • 64-bit Virtual Memory, WOW64, and Running 32-bit Applications
  • Processes and Threads, Call Stacks, and Symbols
  • Finding the Thread or Driver Behind High CPU with Process Explorer
  • Services and Programs: The Service Control Manager and svchost Grouping
  • Service Accounts, Service SIDs, and TrustedInstaller
  • SYSTEM vs Administrator, Access Tokens, and Integrity Levels
  • Session 0 Isolation and Its Impact on Applications


Module 4: Registry Internals

  • Understanding the Registry Structure: Hives, Keys, Values, and Data Types
  • Where the Registry Lives: HiveList, Transaction Logs, and the Lazy Writer
  • Managing the Registry Locally and Remotely with Regedit and reg.exe
  • How Group Policy Uses the Registry, and Mapping Policies to Registry Keys
  • User Profiles, HKEY_USERS, and Editing the Default User Profile
  • Control Sets, the Select Key, and Re-enabling Last Known Good Configuration
  • Loading Offline Hives to Repair a Dead System
  • Using Image File Execution Options for Troubleshooting


Module 5: Troubleshooting Slow Systems

  • Measuring Boot and Logon Times with Diagnostics-Performance Events
  • Troubleshooting Slow Startup and Logon with the Windows Performance Toolkit (WPR and WPA)
  • Finding Startup Offenders with Autoruns and autorunsc
  • Tracing Group Policy and Logon Script Delays
  • Troubleshooting Slow Operations with Process Monitor and Process Explorer
  • Identifying Memory, Disk, and CPU Bottlenecks with Resource Monitor
  • Working Sets, Hard Faults, Memory Compression, SysMain (SuperFetch), and Why Tweaking Usually Hurts
  • Benchmarking Disk Performance with DiskSpd and Other Tools


Module 6: Troubleshooting Security-related Issues

  • Understanding Windows Security Internals: Privileges, Permissions, and Tokens
  • Troubleshooting Permission-related Issues and Access Denied Errors
  • Moving to Least Privilege without Breaking Applications
  • Impersonation, Network Logons, and the One-Hop Limit
  • Troubleshooting Domain-related Issues: Computer Accounts, Secure Channel, and Lost Trust Relationships
  • Domain Admins, Restricted Groups, and a Tiered Admin Account Model
  • Troubleshooting Group Policy, Including Tattooed Security Settings
  • Verifying Effective Audit Settings and EFS Recovery Agent Issues


Module 7: Troubleshooting Network Issues

  • Best Practices for Troubleshooting Network Issues
  • Checking Firewall Profiles and Resetting the TCP/IP Stack
  • Testing Ports, Latency, and Bandwidth with PsPing, PortQry, and Telnet
  • Interpreting Ping Results and Finding the Missing Route Back
  • Detecting IP Conflicts and Rogue DHCP Servers
  • DHCP Authorization, Failover, and Lease Behavior
  • Troubleshooting DNS Resolution and DNS Suffixes, and Isolating Kerberos vs NTLM Issues, Including the NTLM Deprecation
  • Monitoring Network Activity with netsh trace, Pktmon, and Wireshark


Module 8: Troubleshooting Device Drivers

  • How Windows Uses Its Driver Store
  • Driver Start Types and Boot-critical Drivers
  • Identifying Drivers that Cause CPU Load in the System Process
  • Isolating Hardware Problems from Driver Problems
  • Reading the Plug and Play Device Installation Log
  • Troubleshooting Device Drivers with Boot Logging and Memory Dumps


Module 9: Troubleshooting Unbootable Machines

  • Creating External Windows RE and Windows PE Media
  • Windows PE and Windows RE Internals: boot.wim, startnet.cmd, and wpeinit
  • Understanding the UEFI and GPT Disk Layout
  • Secure Boot and Boot Media Signed with the Windows UEFI CA 2023
  • Tools for Fixing an Unbootable OS: Startup Repair, bcdboot, bootrec, and the BCD
  • Safe Mode and Other Advanced Startup Modes, and How to Reach Them
  • Customizing Safe Mode for Windows Installer and Remote Access
  • Recovering BitLocker-protected Systems
  • Comparing Boot Logs between Working and Failing Machines


Module 10: Debugging and Debugger Basics

  • Kernel-mode vs User-mode, and Invasive vs Non-invasive Debugging
  • Getting and Running WinDbg and the Windows Debugging Tools
  • Configuring Symbols and the Microsoft Symbol Server
  • How to Debug a Machine: Debug Mode and Live Kernel Debugging with LiveKD
  • When to Debug a Machine with an Actual Debugger
  • Essential WinDbg Commands for Processes, Threads, and Loaded Modules


Module 11: BSOD Internals

  • How a BSOD Works: Bug Checks, KeBugCheckEx, and Writing the Dump
  • Choosing the Right Dump Type: Small, Kernel, Automatic, Complete, and Active
  • Page File Sizing and Dedicated Dump Files
  • How to Make a BSOD: NotMyFault, Keyboard Crashes, and NMI (Including Hyper-V)
  • Analyzing Memory Dumps with WinDbg and !analyze
  • Preparing Memory Dumps for Microsoft Support
  • Knowing When to Stop Investigating and Reinstall

Instructor

Sami Laiho

Sami Laiho is one of the world’s leading professionals in the Windows OS and Security. Sami has been working with and teaching OS troubleshooting, management, and security since 1995. Sami has been auditing and implementing security solutions, specializing in Principle of Least Privilege, Application Control and Privileged Access Workstations, since 2002. Sami has deployed solutions for companies with between 1-550000 endpoints. One of the world's leading professionals in the Windows OS and Security, Sami has been working with and teaching OS troubleshooting, management, and security since 1995. Sami's session was evaluated as the best session in TechEd North America, Europe and Australia in 2014, and Nordic Infrastructure Conference in 2016, 2017, 2019, 2020, 2022, 2023, 2024 and 2025 (Keynote for NIC). Sami is also an author at PluralSight and the conference chair for the TechMentor and "Cyber Security and Ransomware Live!" conferences.

Sami Laiho

Chief Research Officer, MVP