Now that we’ve looked at how Windows keeps track of physical memory, and how much memory it can support, we’ll explain how Windows keeps a subset of virtual addresses in physical memory.
As you’ll recall, the term used to describe a subset of virtual pages resident in physical memory is called a working set. There are three kinds of working sets:
Process working sets contain the pages referenced by threads within a single process.
System working sets contains the resident subset of the pageable system code (for example, Ntoskrnl.exe and drivers), paged pool, and the system cache.
Each session has a working set that contains the resident subset of the kernel-mode session-specific data structures allocated by the kernel-mode part of the ...