In the last several sections, we've concentrated on the virtual view of a Windows process— page tables, PTEs, and VADs. In the remainder of this chapter, we'll explain how Windows keeps a subset of virtual addresses in physical memory.
As you'll recall, the term used to describe a subset of virtual pages resident in physical memory is called a working set. There are three kinds of working sets:
Process working sets contain the pages referenced by threads within a single process.
The system working set contains the resident subset of the pageable system code (for example, Ntoskrnl.exe and drivers), paged pool, and the system cache.
On systems with terminal services enabled, each session has a working set that contains the resident subset ...