There is a Hybrid Kernel in the Windows NT branch. This is not a monolithic kernel, where all services run in kernel mode or in Micro-kernels, where everything runs in user space. This provides a balance between the protection obtained from the microkernel and the performance that can be seen in the monolithic kernel (since there are fewer user / kernel context switches).
As an example, device drivers and the hardware abstraction layer run in the kernel node, but the workstation service starts in user mode. The wikipedia article on Hybrid Kernels has a good review.
The Windows Internals Reference Describes the Hybrid Approach
... Carnegie Mellon University Mach operating system, a modern example of microkernel architecture, implements a minimal core that includes thread scheduling, message transfer, virtual memory and device drivers. Everything else, including various APIs, file systems and networks, works in user mode. However, commercial implementations of a fly-by-kernel microkernel operating system typically run at least the entire file system, managing network and code memory in kernel mode. The reason is that it is simple: a clean microkernel design is commercially impractical because it is too unsatisfactory.
Robert Christie
source share