This is where standard application programs and "environment subsystems" (like Win32, POSIX, and OS/2) reside. Processes in user mode have limited access to system resources and must request help from the kernel to perform critical tasks.

Windows NT introduced several technologies that are now industry standards:

Manages core functions like memory, security (via the Security Reference Monitor), and I/O.

Handles low-level tasks such as thread scheduling, interrupt handling, and multiprocessor synchronization.

The defining characteristic of Windows NT is its , which separates the system into two distinct operational modes to ensure stability: