In IIS 6.0, the core HTTP engine (HTTP.SYS) runs in kernel mode and all worker processes run in user mode. So what exactly is the difference between kernel mode and user mode programs?
User mode and kernel mode refers to the privilege level a process has to the system hardware. The closer to the hardware the process becomes, the more sensitive the system is to provoking system failure. In any OS, you want to separate applications from OS services because you want the OS to remain functional if an application crashes.
Typical OS architecture has two rings: one ring running in system mode, and a ring running in user mode. The kernel has full control of the
hardware and provides abstractions for the processes running in user mode. A process running in user mode cannot access the hardware, and must use the abstractions provided by the kernel. It can call certain services of the kernel by making "system calls" or kernel calls. The
kernel only offers the basic services. All others are provided by programs running in user mode.
Kernel mode program also run much faster than User mode programs as they are much closer to the hardware.