Some Windows drivers run in user space, but many run in kernel space (https://msdn.microsoft.com/en-us/library/windows/hardware/ff... shows Windows has kernel drivers; the some/many distinction is my guesstimate, based on the fact that anything that needs to process data fast benefits from being a kernel driver)
As someone who has done Windows driver development, I can assure you drivers run at ring0, kernel context. Not in userland (except maybe some USB device and printer drivers).
The NT kernel is not a microkernel. It all runs in ring 0, including device drivers: I/O, graphics, HID, file systems, etc. It's modular, but there is no protection between the various parts, which all run in a single kernel process, with a single address space.
The NT kernel is sometimes called a _hybrid_ microkernel, but this refers only to the fact that the internal modules are logically decoupled (with message passing between them, for example). Also, graphics actually used to run in userland until they moved it into the kernel for Windows 2000.
Since NT 6.0 (Vista), graphics drivers run primarily in user mode. There is still a kernel mode component, the miniport driver, but it is kept small to reduce the likelihood of crashes.
There are some other drivers that also run in user mode, but graphics drivers were the really big change. Most bluescreens in Windows XP were caused by graphics drivers.
Since Vista, Windows has been able to recover from a failure in the graphics driver. The screen blinks for a second, and then a balloon notification comes up, saying that the graphics driver has been restarted.
NT is a hybrid kernel for sure. In a monolithic kernel everything would be running in ring 0.
NT is a hybrid kernel because some drivers run in ring 0, others (typically peripheral drivers) run outside ring 0. Some drivers (specifically graphics card drivers) run split in kernel mode and user mode: A small part runs in kernel mode, while the complex part runs in user mode.
While you are correct that the graphics driver was moved to kernel mode for Windows 2000/XP, it was actually moved half-way back with Vista. This was in fact the reason why graphics drivers sucked in the beginning for Vista: MS only gave the vendors 4 months since the last change to the graphics driver model before Vista was released.
It's still running pretty much everything in ring 0 that a traditional monolithic kernel would. All the "complex parts" run in kernel mode.
The new WDDM driver model runs a user-mode driver, but it's still backed by a set of kernel-mode drivers [1], including the "display miniport" driver.
As kernels go, it's pretty monolithic. What makes it more like a microkernel is that many of the internal APIs use a message-passing model rather than direct calls.
On Linux the OpenGL implementation of the graphics driver (which is by far the most complex part) runs in user space, as do drivers for printers and a lot of other USB devices. However that doesn't make Linux a "hybrid kernel", and neither does what you said make NT one.
I don't think so, the windows manager is also in userland. It's not the most documented thing, and it depends on what are "the things" of windows, there are many. :)
