While Vista does not actually run applications virtually, what it does do is help applications to run in a secure environment by virtualizing the file and registry entries necessary to let applications “think” they can write where they please. As in Windows XP, standard users (those without admin privileges) cannot write to “Program Files”, or “Windows”, or “System32” or a great number of other places an application may attempt to write. Same with the registry—users are prohibited from modifying areas of the system that may affect other users so they can modify only the HKEY_CURRENT_USER hive of the registry. While they should not, many applications still write to these restricted areas as a matter of how they operate. Installation requires such access, but ideally the user of the application should not.

To deal with this, most users just run as administrators and avoid any such problems (but at the same time make their systems far more vulnerable to malicious code). In a corporate environment, administrators and engineers must systematically “unlock” file and registry areas required for proper functionality of the software. This can be a time-consuming and tedious process.

Vista’s implementation of virtualization comes the rescue here by intelligently watching for failed attempts to write to restricted areas of the system and then dynamically virtualizing these file and registry areas so that they may be modified by the restricted user without affecting others. These virtualized elements of the file and registry are then stored in the users profile for future use. As far as the application is concerned, the users has access to these areas and functions as designed while Vista does the work of ensuring that such changes that would normally affect all users of a system actually affect just the current user.

Want more technical details of how this works? Please comment on this article and let me know!