Section 6: Details Tab

The Big Picture: The Raw List

The Processes tab is friendly. It groups things, gives them nice names and hides the confusing parts. The Details tab takes the gloves off. It is a flat list of every process, using the real file names, with a lot of technical columns you can turn on. It is the closest Task Manager gets to the "raw truth" of Chapter 9.

Think of the Processes tab as a menu with pictures, and the Details tab as the kitchen's order sheet.

┌───────────────┬───────┬─────────┬───────────┬─────┬─────────────────┐
│ Name          │ PID   │ Status  │ User name │ CPU │ Memory          │
├───────────────┼───────┼─────────┼───────────┼─────┼─────────────────┤
│ chrome.exe    │  8124 │ Running │ Anna      │  3  │      182,340 K  │
│ notepad.exe   │  9560 │ Running │ Anna      │  0  │        9,876 K  │
│ svchost.exe   │  1120 │ Running │ SYSTEM    │  0  │        6,412 K  │
│ System        │     4 │ Running │ SYSTEM    │  0  │           24 K  │
└───────────────┴───────┴─────────┴───────────┴─────┴─────────────────┘
  Mock-up. Real numbers differ. Memory is shown in KB (K).

Notice: the CPU column here shows a plain number (3 means 3%) without the percent sign, and Memory is in kilobytes. On Windows 10 and 11 the full column title is Memory (active private working set): the private working set from Section 1.3, counting only memory the process is actively using.

6.1 PID, Status, User Name

PID (Process ID). Every process gets a unique number when it is created. It is like a ticket number at a bakery. If you have two Chrome processes, they have different PIDs, so you (and Windows) can tell them apart. Things to know:

• PIDs are reused. When a process ends, its number can later go to a brand-new process. So a PID only means something while the process is alive.
• The System process always has PID 4. The System Idle Process has PID 0. It is not a real program: its "CPU" percentage is simply the unused CPU time. If Idle shows 95%, the CPU is 95% free.
• The PID is what tools and commands use: taskkill /PID 8124 or tasklist.

Status. Shows what the process is doing at the moment:

User name. The account that owns the process. Common values:

This connects to Section 5: the owner decides what a process is allowed to do. A strange program owned by SYSTEM that you do not recognise deserves a closer look.

6.2 Priority Column

What it is: The Base priority column shows how important each process is to the scheduler: the part of Windows (Chapter 10) that decides which thread gets the CPU next. Higher priority means the thread is picked before lower ones when many threads are waiting.

Add the column: right-click any header, choose Select columns, tick Base priority.

Windows gives every process a priority class. Behind each class is a number (the base priority level for its normal thread):

(The exact numbers may look different in other books. They describe the base level for ordinary threads in each class.)

How the scheduler uses it: When two threads both want the same logical processor, the one with the higher priority wins. Threads at the same priority take turns in short slices of time (Chapter 10). Windows also adds small temporary boosts, for example to the program in front of you, so it feels quick.

Important: Priority does not make a program faster. It only decides who goes first when the CPU is busy. On an idle PC, changing priority changes nothing.

6.3 Architecture (32-bit vs 64-bit)

What it is: The Architecture column tells you what kind of program a process is. It is not on by default; add it from Select columns.

Why do 32-bit programs still exist? Old software was written when 32-bit was normal. Windows keeps a layer called WOW64 that lets 32-bit programs run on 64-bit Windows. In the Processes tab, you may see (32 bit) after the name of such programs.

Where are they stored? 64-bit programs usually live in C:\Program Files. 32-bit programs usually live in C:\Program Files (x86). That is a quick way to guess.

Why it matters: A 32-bit program cannot load a 64-bit library, and the reverse. Also, a 32-bit program can hit an "out of memory" error long before the PC runs out of RAM, because of its own address-space limit (Chapter 3).

6.4 Command Line Column

What it is: The exact text that was typed (or generated) to start the process. It includes the program path and every option.

Why is it useful? Look at this:

Name          Command line
────────────  ──────────────────────────────────────────────────────────
svchost.exe   C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
svchost.exe   C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
chrome.exe    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer ...
python.exe    python.exe C:\tools\backup_job.py --nightly

• Many processes share one name. Eight svchost.exe rows look identical, but the command line shows which service each one hosts (the -s part).
• Your Chrome helper processes show --type=renderer or --type=gpu-process, which tells you the role of each.
• Two python.exe rows? The command line shows which script each runs.
• A suspicious process with a strange path (for example inside C:\Users\...\AppData\Local\Temp) stands out right away.

Windows tip: On the Processes tab you can add the same Command line column. On both tabs, long lines get cut off; widen the column by dragging its edge.

6.5 Set Priority / Affinity (Right-Click Options)

What it is: The right-click menu on the Details tab gives you real controls over a process. These are the main ones:

Set priority. Choose one of the classes. Windows asks you to confirm. Safe uses:

• Lower a heavy video-encoding job to Below normal, so the PC stays smooth while it works.
• Raise a game to Above normal for a more steady response (small gain).
• Never choose Realtime for ordinary programs. A Realtime process can take over the CPU so completely that the mouse, keyboard and even the system freeze, because its threads run before Windows' own helper threads. The change does not survive: when the program closes and starts again, it is back to its normal priority.

Set affinity. Affinity means "which logical processors this process may use". A window shows tick boxes CPU 0, CPU 1, CPU 2, ..., one for each logical processor (the ones from Figure 11.4 and Chapter 2). Untick some, and the process threads will only run on the remaining ones.

Normal:      process threads can use all 16 logical processors
                [0][1][2][3][4][5][6][7][8][9][10][11][12][13][14][15]

Affinity set to CPU 0-3 only:
                [0][1][2][3]  ← allowed        the rest are off limits

Why do this? Rarely, to keep one noisy job away from the cores you want free for something else, or to test how a program behaves with fewer cores. Like priority, it resets when the program restarts. If you untick all, Windows will not let you. Most people never need it.

Analyze wait chain. When a program shows "Not responding", this option says who is waiting for whom. A thread (Chapter 10) may be waiting for a lock held by another thread, or for a disk, or for another process. The result looks like "chrome.exe is waiting for ... which is waiting for ...". If two threads wait for each other forever, Windows warns of a deadlock.

Create dump file. A dump is a snapshot of the process's memory and state. A developer can open it in a debugger to see why it froze or crashed. Windows saves it in your temporary folder and tells you the path. A dump can contain private data (passwords you typed in that program), so do not share it casually.

Warning: Ending a process from the Details tab can lose unsaved work or even crash Windows if you end a critical system process. Windows stops you from ending the most critical ones, but not all of them.

Summary