Let's take a look at thread details using some tools.
Here's my Windows 11 virtual machine.
The first thing I'm going to do is show you Task Manager.
So here's Task Manager with the Details tab.
And one of the columns you can find here is the number of threads,
so currently it's not here.
Let me right‑click on Select columns and look out for the Threads column.
So once we add that column, we see the number of threads in every process.
And I'm going to sort by number of threads just to
show you what's going on here.
So notice that the processor with the most number of
threads is the System process.
Remember that the System process represents kernel space,
everything that's going on in kernel space,
so that's 243 kernel threads.
By kernel threads,
I mean threads that only run in kernel mode and never go into user mode.
They were created by the kernel itself directly or by device drivers,
which are part of system space, which are part of the kernel,
really.
And so the number of threads is not something constant or
fixed that you might find on a typical system.
It depends on the actual version of Windows,
the type of device drivers that are installed,
and some other aspects of kernel behavior.
So you shouldn't really expect any particular number here,
but typically the number is in the hundreds.
So this is fairly small, relatively speaking, to today's systems.
Usually, we'd find something like 400 threads or even more.
And then you can see here, explorer, having 79 threads.
You might be wondering, why does explorer need 79 threads?
Unfortunately, the answer is that it really doesn't,
and you can see that the CPU consumption here is 0,
which means that the explorer is doing absolutely nothing,
but still has 79 threads.
There is a qualification with threads these days.
Usually, number of threads created is much higher than actually is needed.
Here's a SearchHost, which is handling search on the modern windows.
It also has 66 threads, which really is not justified at all.
You can see 0 consumption here.
Visual Studio here has some project open in it, and it has 59 threads.
So at least you can get a sense of the number of
threads that you have for every process,
and you should always see at least one thread for every process.
There are a few exceptions, on the other hand.
For example, here we have System interrupts here.
This is not really a process.
This is just a way to provide some timing related to something
called interrupt and defer procedure calls,
something that is currently outside the scope of this course.
So it's always going to show a dash here for nothing
because there's not really process.
And then we have the secure system here.
The secure system is the secure kernel part of utilization‑based security.
So it's the the secure mode kernel against something,
which we don't discuss in this particular course.
In any case,
the reason that it has no thread is that all it's threading
needs are actually handled by the normal kernel,
so we shouldn't really be worried about that either.
And there is some virtual machine here,
which is suspended and no threads available here.
So that's fine.
Here, we can see how many threads we have in every process,
which is definitely interesting, at least in some cases.
If we go to the Performance tab here on Task Manager and look at the CPU tab,
we can get a sense of the total number of threads and processes on the system.
We can even right‑click here and change the graph to Logical processors
just to see what each processor is actually doing.
So in this virtual machine, we have eight logical processors,
which means that eight threads at most can be in the running state.
You'll notice, the CPU utilization is very low,
just 3 or 4%, which means that at any given point in time,
there is no more than one thread on average that is
actually in the running state,
which means that all these thousands of threads here are
actually in a waiting state most of the time.
This is a very typical thing to see on a typical Windows machine.
There are many more threads than you might expect to exist,
but like I said, there's just, I would say,
in general,
bad programming on the part of many applications that use way
many more threads than they really need.
And although they're not running at the same time,
it's still wasting resources because, as we'll see later on,
thread objects have some data structures in place,
there's a stack and other stuff, so it's never free.
It's perhaps not super expensive, but it's definitely not free.
So at this point, we can see number of threads that we have in the system,
and most of them are in the waiting state.
Next, let's examine Process Explorer.