The best Windows internals books are still the two volumes of Windows Internals, 7th edition. We found no 8th edition or pre-order at Microsoft Press or on Amazon, so the current set is the one to buy today. What you add next depends on your job: access control and Kerberos, kernel drivers, hardening a fleet or reading the Security event log.
This list pairs the two Microsoft Press volumes with five Windows security books and says which Windows release each one was written against. We checked every edition, page count and Amazon listing on October 27, 2026 against the publisher pages or Google Books. All seven had new copies in stock on Amazon that day.
Is there a Windows Internals 8th edition?
No. As of October 27, 2026, the 7th edition is the newest Windows Internals, and we found no 8th edition or pre-order on the Microsoft Press Store, InformIT or Amazon. Microsoft’s own Sysinternals page for the book still describes the 7th edition, which is split into two volumes published four years apart.
Those four years matter because the two parts describe different Windows builds. Part 1 covers Windows 8 through Windows 10 version 1703 and Server 2016. Part 2 covers Windows 10 up to the 21H1 release from May 2021, plus Windows Server 2016, 2019 and 2022. Neither was written against Windows 11, but the kernel they describe is the one Windows 11 still runs on. Before you buy, check these points on the listing:
- The Part 1 listing shows Microsoft Press, 7th edition, and ISBN 9780735684188.
- The Part 2 listing shows 7th edition, ISBN 9780135462409, and a 2021 or 2022 date.
- Neither listing is the 6th edition from 2012, which covers Windows 7 and is still sold.
A search for “Windows Internals 8th edition” mostly returns the 7th edition or the old 6th edition. Read the edition line on the listing rather than trusting the cover thumbnail.
Which Windows internals books are worth buying?
Seven books made the list, and they fall into three groups: how Windows works, how to write code that runs in its kernel, and how to defend and monitor it. The table shows the facts that change a buying decision, taken from the publisher pages and Amazon’s catalog data on October 27.
| Book | Edition and date | Pages | Best for |
|---|---|---|---|
| Windows Internals, Part 1 | 7th, May 2017 | 800 | Processes, threads, memory, I/O, security |
| Windows Internals, Part 2 | 7th, Oct 2021 | 912 | Boot, Hyper-V, VBS, ETW, registry, file systems |
| Windows Security Internals | 1st, Apr 2024 | 608 | Tokens, access checks, NTLM and Kerberos |
| Windows Kernel Programming | 2nd, Feb 2023 | 625 | Writing software kernel drivers |
| Rootkits and Bootkits | 1st, May 2019 | 448 | Boot process, Secure Boot and firmware threats |
| Mastering Windows Security and Hardening | 2nd, Aug 2022 | 816 | Hardening Windows 11 and Server 2022 fleets |
| Windows Security Monitoring | 1st, Apr 2018 | 656 | Reading the Security event log |
Prices ran from about $27 to $57 on October 27, with Part 2 the most expensive and the Packt hardening book the cheapest after a discount. Amazon moves these often, so treat every price below as a rough band and check the live listing before you buy.
How did we pick these books?
We started from the Microsoft Press, No Starch, Packt and Wiley catalogs and Amazon’s search results for Windows internals, kernel and security titles, then dropped anything that failed one of four checks:
- The edition on sale is the newest one the publisher lists.
- The publisher page or Google Books gives a table of contents we could read.
- A new copy was in stock on Amazon on October 27.
- The book teaches Windows itself, not a certification exam or general hacking.
Some popular titles are missing on purpose. Practical Malware Analysis is a 2012 book that belongs on a malware shelf. Offensive red team titles belong with our OSCP reading list and the Windows Server admin titles have their own Windows Server book guide. We read the publisher descriptions and sample chapters, not every page of all seven books, so the notes below describe scope and fit rather than a full review.
1. Windows Internals, Part 1 (7th Edition)
Part 1 is where almost every reader should start, because the other six books assume you already know what it teaches.
Its seven chapters cover concepts and tools, system architecture, processes and jobs, threads, memory management, the I/O system and security. Each chapter pairs the design with experiments in WinDbg, Process Explorer and the other Sysinternals tools. You see the kernel structures on your own machine instead of taking the text on trust. The authors also published the book’s companion tools with source code on GitHub (zodiacon/WindowsInternals).
- You get 800 pages from Microsoft Press, published May 2017.
- It fits developers, incident responders and anyone moving into Windows security work.
- Skip it if you only need Group Policy or admin tasks, because it barely touches management tooling.
Its age shows in the details. It was written against Windows 10 version 1703, so later additions such as newer VBS protections and Windows 11 scheduling changes are missing. Even so, the process, thread and memory model it explains has not changed in a way that makes the chapters wrong. It sat in the $40 to $45 range on October 27, so check the live price.
2. Windows Internals, Part 2 (7th Edition)
Part 2 picks up where Part 1 stops and is the newer of the two, which makes it the better buy if you already know the basics.
Andrea Allievi led this volume, and the publisher says it covers Windows 10 up to 21H1 and Windows Server 2016, 2019 and 2022. It covers system mechanisms such as ALPC, the object manager, WNF and WoW64. After those come Hyper-V and virtualization-based security, the registry, services, WMI, ETW, the cache manager, NTFS and ReFS, and the boot path through UEFI Secure Boot, Measured Boot and Secure Launch.
- You get 912 pages from Microsoft Press, published October 2021.
- It fits security engineers who need background on VBS, ETW or the boot chain.
- Skip it if you have not read Part 1 or something at the same depth first.
The Hyper-V and VBS chapters are the reason security readers buy it, since much of the Windows 11 security baseline rests on them. It is the most expensive book here, in the $55 to $60 range on October 27. A marketplace seller, not Amazon itself, held the buy box that day, so check the seller before you order.
3. Windows Security Internals
James Forshaw’s book is the one to read after Part 1 if your work is access control, authentication or auditing.
Forshaw is on Google’s Project Zero team and has spent more than 20 years finding Windows security bugs, which shows in how precisely the book explains each check. Its 15 chapters go from kernel and user-mode basics to access tokens, security descriptors, access checking and auditing, then to authentication. That part covers the SAM, Active Directory, interactive logon, NTLM, Kerberos and Negotiate. Every example is PowerShell you can run and change, and Appendix A shows how to build a small Windows domain to test against.
- You get 608 pages from No Starch Press, published April 2024.
- You can read Chapter 5, Security Descriptors, as a free PDF on the No Starch page before you buy.
- Skip it if you want hardening checklists, because it explains mechanisms rather than settings.
Forshaw’s book is the newest on the list and goes much further than the security chapter in Part 1. If you need a lab domain for Part III (the authentication chapters, 10 to 15), our guide to installing Active Directory on Windows Server gets you a domain controller to test against. It sat in the $40 to $45 range on October 27, so check the live price.
4. Windows Kernel Programming (2nd Edition)
Pavel Yosifovich, the first author of Part 1, wrote this one for people who want to write kernel code rather than only read about it.
The book is about software drivers: code that monitors processes, threads, modules and the registry, and can block some of those events when it needs to. It does not cover hardware drivers. The second edition expands the first edition’s material and adds the Windows Filtering Platform and more advanced techniques. Its samples for chapters 2 to 15 sit in an MIT-licensed GitHub repo (zodiacon/windowskernelprogrammingbook2e).
- You get 625 pages in a self-published paperback from February 2023.
- It fits C and C++ developers building monitoring tools, security agents or filter drivers.
- Skip it if you do not write C or C++, because every chapter is driver code.
Amazon still lists the 2019 first edition next to it, so check that the listing is the 625-page February 2023 paperback. Leanpub sells the ebook as well. The paperback sat in the $35 to $40 range on October 27.
5. Rootkits and Bootkits
This No Starch book is the one to read when you need to understand what can happen before Windows itself loads, and what Secure Boot does about it.
The authors walk through the Windows boot process for 32-bit, 64-bit and UEFI systems. Then they analyze historical malware families such as TDL3, TDL4 and Gapz to show where each boot stage was weak. The later chapters cover Secure Boot, Virtual Secure Mode and Device Guard, BIOS and UEFI firmware threats, and analysis with Bochs, IDA Pro and Intel’s Chipsec tool.
- You get 448 pages from No Starch Press, published May 2019.
- It fits malware analysts, firmware security engineers and anyone responsible for boot integrity.
- Skip it if you need Windows 11 specifics, because it predates Windows 11 and its boot requirements.
Read the boot chapters of Part 2 first, since this book goes deeper on the same path and assumes you know it. On October 27 a marketplace seller held the buy box with limited stock, in the $40 to $45 range, so check the seller and delivery date before you order.
6. Mastering Windows Security and Hardening (2nd Edition)
Dunkerley and Tumbarello wrote the practical book on the list, aimed at administrators and architects who have to secure a Windows estate rather than study its kernel.
Mark Dunkerley and Matt Tumbarello target Windows 11 and Windows Server 2022. Their 16 chapters run from baselines, hardware and virtualization, networking and identity to deployment, client and server hardening, monitoring, security operations and auditing. The tooling is the Microsoft stack most shops already pay for: Intune, Configuration Manager, Group Policy, Defender for Endpoint and Azure services, all framed around zero trust.
- You get 816 pages from Packt, published August 2022.
- It fits sysadmins and security architects running Microsoft 365 or hybrid Windows fleets.
- Skip it if you do not use Intune or Defender, because many chapters depend on them.
Age is the trade-off in a fast-moving product line. Several Microsoft cloud products it describes have been renamed since 2022, such as Azure AD becoming Entra ID, so expect to translate some console paths. It was the cheapest book here, in the $25 to $30 range on October 27 after a discount of about half its list price, so check the live price.
7. Windows Security Monitoring: Scenarios and Patterns
Andrei Miroshnikov’s book is the blue-team reference for the Windows Security event log, and we found no newer book that covers the Security log in as much detail.
Miroshnikov is a former Microsoft security program manager. The book explains the auditing subsystem first. Then it walks through monitoring scenarios: account logons, local and domain accounts, Active Directory changes, NTLM and Kerberos events, privileges, file system and registry access, removable storage and network shares. It pairs well with our guide to Windows event logging when you set up collection.
- You get 656 pages from Wiley, published April 2018.
- It fits SOC analysts and detection engineers writing rules against Windows events.
- Skip it if you need Sysmon or cloud log coverage, because it focuses on the built-in Security log.
It was written in the Windows 10 and Server 2016 era, but the core event IDs it documents are still the ones most detection rules use. For the hunting side, our threat hunting book list picks up where this book stops. Amazon showed limited stock in the $35 to $40 range on October 27, so check the live price.
What should you look for in a Windows internals book?
Windows changes faster than book editions, so the Windows build a book targets matters as much as its reputation. Use these checks on any title, including ones not on this list:
- The book names the Windows build or Server release it was written against.
- The examples use tools you can still download, such as WinDbg and the Sysinternals suite.
- The companion code or tools are on GitHub and still build.
- The listing shows the newest edition, not a cheaper older one with a similar cover.
A book written against Windows 10 can still be the right choice, because the kernel design carries forward and newer features are layered on top. What ages badly is anything tied to management products and cloud consoles, which is why the hardening pick needs more translation than the internals books. If you want the theory under all of this, our operating systems book list covers the general concepts.
Which order should you read them in?
Start with the foundation and branch out by role, because each later book assumes the earlier chapters. This reading order works for most people:
- Read Windows Internals Part 1 and run its experiments on a Windows test VM.
- Read Windows Security Internals next if your work is identity, access control or auditing.
- Move to Windows Internals Part 2 when you need Hyper-V, VBS, ETW or boot details.
- Pick Windows Kernel Programming if you will write drivers, or Rootkits and Bootkits if you will analyze boot-level threats.
- Add Mastering Windows Security and Hardening or Windows Security Monitoring for the operational side of the job.
If you only buy one book, buy Part 1. If you already know Windows internals and want the most current security material, Forshaw’s book is the most recent title on this list.
