Operating Systems · Topic 4 of 15
Task Manager and Monitoring Tools
Use Task Manager, Resource Monitor, Performance Monitor, Event Viewer and the Services console to find slow processes, failed services and system errors.
- 4 min
- Task Manager opens with Ctrl+Shift+Esc.
- The Startup tab controls which programs run at sign in.
- Resource Monitor breaks use down by process for CPU, memory, disk and network.
What it is
Windows includes several tools that show what the computer is doing and what has gone wrong. Task Manager gives a quick live view. Resource Monitor and Performance Monitor go deeper.
Event Viewer keeps a history of what happened, and the Services console controls background programs.
How it works
Task Manager
Task Manager opens with Ctrl+Shift+Esc, or from the Ctrl+Alt+Del screen. Its tabs are set out below.
| Tab | What it shows or does |
|---|---|
| Processes | Running apps and background processes, with central processing unit (CPU), memory, disk and network use. End a task here |
| Performance | Live graphs for CPU, memory, disk, network and graphics |
| App history | Resource use of apps over time (mainly store apps) |
| Startup | Programs that start at sign in, which can be enabled or disabled (named Startup apps in Windows 11) |
| Users | Signed in users and what each one is using |
| Details | Each process with its process ID (PID), where priority and affinity can be set |
| Services | Services, their state and a shortcut to the Services console |
Ending a process stops it at once and can lose unsaved work. Disabling an item on the Startup tab is a safe way to speed up sign in.
Resource Monitor
Resource Monitor (resmon) gives more detail than Task Manager. It has tabs for CPU, Memory, Disk and Network, and shows which process is reading a file or using a network connection. It is the tool to open when Task Manager says the disk is at 100 percent and you need to know which process causes it.
Performance Monitor
Performance Monitor (perfmon) records counters over time. A counter is a measured value such as processor time, available memory or disk queue length. Data collector sets can log counters to a file, so you can compare a baseline with the system at its worst.
Event Viewer
Event Viewer (eventvwr.msc) reads the system logs. The main Windows logs are these.
| Log | Contents |
|---|---|
| Application | Events from programs |
| Security | Sign in attempts and other audit events |
| System | Events from the operating system (OS), drivers and services |
| Setup | Installation and update events |
| Forwarded Events | Events collected from other computers |
Each event has a level such as Information, Warning, Error or Critical, plus a source and an event ID. Searching the event ID is a quick way to learn what an error means.
Services console
The Services console (services.msc) lists every service, its status and its startup type. A service is a program that runs in the background without a window.
| Startup type | Meaning |
|---|---|
| Automatic | Starts at boot |
| Automatic (Delayed Start) | Starts shortly after boot to keep startup fast |
| Manual | Starts when something needs it |
| Disabled | Cannot start |
Right click a service to start, stop or restart it. On the Recovery tab you can choose what happens if the service fails. The Dependencies tab shows what a service needs, which matters when a service refuses to start.
Choosing the right tool
Task Manager answers what is happening now. Event Viewer answers what happened earlier. If the question mentions a log or an event ID, the answer is Event Viewer.
What to remember for the exam
- Task Manager opens with Ctrl+Shift+Esc.
- The Startup tab controls which programs run at sign in.
- Resource Monitor breaks use down by process for CPU, memory, disk and network.
- Performance Monitor records counters over time and can compare against a baseline.
- Event Viewer logs include Application, Security, System and Setup.
- Event levels are Information, Warning, Error and Critical.
services.mscopens the Services console and sets startup types.- The startup types are Automatic, Automatic (Delayed Start), Manual and Disabled.
Common mistakes
Disabling the wrong service. Stopping a service that others depend on can break features. Check the Dependencies tab first.
Using Task Manager for history. Task Manager shows the present. Past crashes are in Event Viewer.
Ending a system process. Killing a core Windows process can force a restart. Identify the process before you end it.
Forgetting the baseline. A counter value means little without knowing what normal looks like on that system.
Check yourself
Which tool shows which process is using the most disk activity right now?
Resource Monitor, or the Processes tab of Task Manager for a quick view.
Which Event Viewer log records sign in attempts?
The Security log.
How can you stop a program from launching at sign in?
Disable it on the Startup tab of Task Manager.
Topic 4 of 15 in Operating Systems
Test yourself on Operating Systems
The full CompTIA A+ 220-1202 question bank has 835 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.