Chapter 11 · Windows Task Manager

Knowledge Check

9 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. Name three keyboard ways to open Task Manager.
  2. What are the three groups on the Processes tab?
  3. A PC has 16 logical processors. One thread runs flat out. About what CPU % does Task Manager show for that process?
  4. What does the Memory column on the Processes tab show: private working set, or total virtual memory?
  5. What is the difference between Available and Cached memory?
  6. What does a disk showing "100% active time" really mean?
  7. What are the four values of Startup impact?
  8. Which PID does the System process have, and what is the System Idle Process?
  9. What is the difference between a service's service name and its display name?
  10. What does the Open Services button open?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. Ways to open Task Manager

Ctrl + Shift + Esc (direct), Ctrl + Alt + Del then Task Manager, and Win + X then Task Manager. You can also right-click the taskbar (Windows 10) or the Start button (Windows 11).

2. The three groups

Apps, Background processes and Windows processes.

3. One busy thread on 16 logical processors

About 6% (1 ÷ 16). One thread can only fill one logical processor.

4. Memory column

The private working set: the private RAM the process uses now. Shared parts are not counted.

5. Available vs Cached

Available is memory that can be given to a program right away (free plus standby). Cached is memory holding copies of file data (and modified pages waiting to be saved) for fast reuse; most of it is part of what is available.

6. 100% active time

The disk was busy with at least one request all the time. It does not mean the disk is moving data at its top speed. A slow hard drive can be at 100% while moving very little.

7. Startup impact

High, Medium, Low, Not measured.

8. PID of System and the Idle process

System has PID 4. System Idle Process (PID 0) is not a program; its percentage is the unused CPU time.

9. Service name vs display name

The service name is the short name that commands use (wuauserv). The display name is the friendly name (Windows Update), shown as Description in Task Manager.

10. Open Services

The Services console, services.msc.

UNDERSTANDING QUESTIONS

Q1. Why do the Memory values of all processes not add up to the "In use" number on the Performance tab?

Answer The Processes tab counts each process's private working set. Shared memory (such as libraries used by many programs) is left out. The Performance tab's "In use" also counts memory used by the kernel, drivers and other parts that no process row owns. So the two are measuring slightly different things.

Q2. Why can a computer with 8 cores show 16 graphs on the CPU page, and what does that tell you?

Answer Each core runs two threads at once (hyper-threading, Chapter 2), so Windows sees 16 logical processors and draws one graph for each. It tells you that the CPU can run 16 threads in parallel, though two threads that share a core share its hardware, so they are not twice as fast as two real cores.

Q3. Why does a low overall CPU % not prove that a program is not CPU-limited?

Answer Overall % is spread over all logical processors. A program with one busy thread uses 100% of one logical processor, but only 1 ÷ N of the total. That one thread may be the bottleneck while the overall figure looks low. Looking at the graph per logical processor reveals it.

Q4. Why is the start-up impact rating not the same as how heavy a program is?

Answer It measures only the CPU time and disk activity during start-up. A program can be cheap to start but use a lot of memory or CPU later, or the other way round. Use the Processes tab for how it behaves while running.

Q5. Why do services run in Session 0 with no desktop?

Answer Services have strong permissions. Since Windows Vista they are kept in Session 0, away from user desktops, so that a program on the desktop cannot talk to a service through windows and messages to take advantage of its power. This is called Session 0 isolation.

SCENARIO QUESTIONS (Troubleshooting)

S1. The PC feels slow. The CPU graph shows 12% overall, but one logical processor is at 100%. What does that suggest?

Answer A single-threaded program (or one busy thread) is maxing out one logical processor. In the Processes tab, sort by CPU and look at the top process. Faster single-core speed or fixing the program helps, not more cores.

S2. Disk shows 100% active time with a response time of 300 ms, and the PC is slow after sign-in. What do you check?

Answer Many programs are fighting for the disk, probably a hard drive. Check the Startup tab and disable heavy items you do not need at sign-in. Sort the Processes tab by Disk to find the heaviest user. Moving Windows to an SSD helps a lot.

S3. You disabled a program in the Startup tab, but it still starts with Windows. Why might that be?

Answer It may also start through a service set to Automatic or a scheduled task with a "log on" trigger. Neither appears in the Startup tab. Look in services.msc and in the Task Scheduler (or use Autoruns).

S4. A program says "Not responding". How can Task Manager help you find out why?

Answer On the Details tab, right-click the process and choose Analyze wait chain. It shows what the stuck threads wait for (a lock, a disk, another process). If it is truly stuck, choose End task. If a developer needs to investigate, choose Create dump file first.

S5. Memory shows 85% in use but the PC is fast and Available is several GB. Is something wrong?

Answer Probably not. Windows uses spare RAM as a file cache, and cached/standby memory counts as available when a program needs it. Worry if the PC is slow, the disk is busy with paging, and Available is very low or Committed is near its limit.

INTERVIEW QUESTIONS

I1. How does Task Manager compute a process's CPU percentage?

Answer It takes the CPU time used by the process's threads during a short interval and divides it by the interval length multiplied by the number of logical processors. So one thread fully busy on a 16-logical-processor system is about 6%.

I2. What is the difference between priority and affinity?

Answer Priority decides who goes first when threads compete for a logical processor. Affinity decides which logical processors a process may use. Priority has no effect on an idle CPU. Both are changed on the Details tab and reset when the process restarts.

I3. Explain what committed memory means and why it can exceed physical RAM.

Answer Committed memory is virtual memory that Windows has promised to processes, backed by RAM or the page file. The limit is roughly RAM plus the page file. It can exceed the amount of RAM used because not all promised memory is in RAM at once. If it reaches the limit, new allocations fail.

I4. Why are there so many svchost.exe processes, and how do you tell them apart?

Answer svchost.exe is the Service Host. Services need a process, and Windows hosts them in svchost.exe processes, often one per service on modern PCs so that a crash is contained. The Command line column (the -s ServiceName part), or the PID shown on the Services tab, tells which service each one hosts.

I5. What does "Session 0 isolation" mean?

Answer Since Windows Vista, services run in session 0 with no interactive desktop, while users sit in session 1 and above. A service cannot show windows to users, and user programs cannot easily interact with services' windows, which is a security boundary.

PRACTICAL TASK

Write a one-page "health report" for your own PC. Using Task Manager, record: the CPU model, cores and logical processors; RAM in use, available and committed; disk type and a typical active time; the top three processes by CPU and by memory at an idle moment; the number of startup items by impact rating; and the number of services running. Then write three sentences of advice for yourself (for example "turn off two High-impact startup apps").

Why This Matters

When a PC is slow, most people guess. A report like this lets you measure first: which resource is the limit, and which process causes it. It also gives you a baseline, so you can tell later what "normal" looks like on your machine.

CHAPTER SUMMARY

  • Processes tab: groups (Apps, Background processes, Windows processes); CPU % is process CPU time ÷ (time × logical processors); Memory is the private working set; Disk, Network and GPU show file traffic, Mbps and the busiest engine.
  • Performance tab: CPU (utilization, speed, processes, threads, handles, cores vs logical processors), Memory (in use, available, committed, cached, pools), Disk (active time vs response time), Network (bits per second) and GPU (engines, dedicated and shared memory).
  • App history: running totals of CPU time and network use since a date, mostly for Store apps.
  • Startup: programs that start at sign-in, rated High, Medium, Low or Not measured; they come from Registry Run keys and Startup folders (services and tasks start things elsewhere).
  • Users: one row per signed-in user; sessions keep users apart; services live in Session 0.
  • Details: PID, status, user name, priority, architecture, command line, set priority and affinity, wait chain, dump file.
  • Services: service name vs display name, Running vs Stopped, svchost.exe, and services.msc for full control.