Practical Lab: Task Manager Deep Dive

Objective

Use Task Manager like an investigator. You will turn on the hidden columns, read the graphs, make a harmless CPU spike on purpose and find the process that caused it, and check your startup list. Almost everything is looking only. The one thing you change is a test program that you start and close yourself.

Time: 25–30 minutes
You need: A Windows 10 or 11 PC. No extra software. (Notepad and PowerShell are enough.)

What to Open

Part 1: Turn On the Hidden Columns

1. Open Task Manager. If you see a small window, click More details.
2. On the Processes tab, right-click any column header and tick: PID, Command line, Power usage, Power usage trend.
3. Go to the Details tab. Right-click a header, choose Select columns, and tick: Base priority, Architecture, Session ID, Threads, Handles, CPU time.

Now fill in the facts about your PC from the Details tab:

1. PID of System: ________________ (hint: a very small number)
2. PID of System Idle Process: ________________
3. Session ID of System: ________________
4. Session ID of explorer.exe: ________________
5. Architecture of explorer.exe: ________________
6. Base priority of explorer.exe: ________________
7. Number of threads in explorer.exe: ________________
8. How many svchost.exe rows are there? ________________

Part 2: Read the Performance Tab

Open the Performance tab and click CPU.

9. Logical processors: ________________
10. Cores: ________________
11. Are logical processors double the cores (hyper-threading, Chapter 2)? ________________
12. Base speed: ________________ GHz Current speed: ________________ GHz
13. Processes / Threads / Handles: ________________ / ________________ / ________________
14. Up time: ________________
15. L3 cache: ________________

Right-click the graph and choose Change graph to → Logical processors. Then click Memory:

16. In use: ________________ GB Available: ________________ GB
17. Committed (first/second): ________________ / ________________ GB
18. Paged pool / Non-paged pool: ________________ / ________________
19. Slots used and form factor (if shown): ________________

Click Disk:

20. Type (SSD or HDD): ________________ Active time right now: ________________ %
21. Average response time: ________________ ms

Part 3: Make a CPU Spike and Catch It

You will make one logical processor busy for a short time, and then find it.

1. In Task Manager, open Performance → CPU and set the graph to Logical processors.
2. Open PowerShell and run this line. It makes a busy loop that runs for about 20 seconds and then stops by itself:

$end = (Get-Date).AddSeconds(20); while ((Get-Date) -lt $end) { }

3. While it runs, look at the graphs.

4. Which graph(s) showed one logical processor rising high? ________________

5. Overall Utilization while it ran (about): ________________ %

6. Open the Processes tab and sort by CPU. Which process is at the top? ________________ (hint: it is Windows PowerShell)

7. Expected CPU % for one busy thread = 100 ÷ (number of logical processors) = ________________ %

On the Processes tab, right-click the process and choose Go to details. On the Details tab, look at its CPU time and Threads.

26. PID of the PowerShell process: ________________
27. Command line of the process: ________________

After 20 seconds, the loop ends. Check that the graph falls back down.

Part 4: Identify a Runaway Process

Imagine a program that will not stop using the CPU. Here is the checklist an expert follows:

Safe practice with Notepad: Open Notepad, find notepad.exe in the Details tab, right-click it, Set priority → Below normal and confirm. Note the Base priority column. Then close Notepad.

28. What did the Base priority column say after you changed it? ________________
29. Did anything on your PC feel different? ________________ (Probably not: Notepad uses almost no CPU.)

Part 5: Check the Startup Ratings

Open the Startup tab (called Startup apps on Windows 11). Right-click a header and tick Startup type and CPU at start if they are there.

30. How many items are Enabled? ________________
31. How many are rated High? ________________ Medium? ________________ Low? ________________ Not measured? ________________
32. Name one High item, and say whether you need it at sign-in: ________________
33. For one item, read its Startup type (Registry or Folder): ________________

(Do not disable anything unless you are sure. The point of the lab is to read the list.)

Part 6: Services and Users

On the Services tab:

34. Find Spooler. Is it Running or Stopped? ________________ Its Description (display name): ________________
35. Click Open Services. In the console, find the same service: Startup Type: ________________

On the Users tab:

36. How many users are shown? ________________ How many processes does your row have (the number in brackets)? ________________

What Should Happen

• Part 1 shows that System has PID 4, Idle has PID 0, and system processes are in session 0 while your programs are in session 1 (or higher).
• Part 2 gives you the hardware facts from Chapters 2 and 3, as the OS sees them.
• Part 3 shows one logical processor jumping while Utilization moves only a little (around 1 ÷ logical processors).
• Part 5 shows you which start-up programs cost the most.

Interpretation Guide

Follow-Up Questions

1. In Part 3, why did Utilization not show 100% even though one thread used a full logical processor?
2. Your PC has 8 cores and 16 logical processors. What is the highest Utilization you would expect from a program with one busy thread?
3. In Part 2, why can Committed be larger than In use?
4. Why is the start-up impact rating not enough to tell you how heavy a program is later?
5. Name three facts from this lab that you could not have learned from the Processes tab alone.