Task Manager and the MMC Snap-Ins

A tool for every question

Windows administration is a set of consoles, each answering one question. The exam gives the question and expects the console, often by its .msc name. Memorize the pairs and the one distinguishing detail for each.

Task Manager, tab by tab

tab           question it answers                                    action
Processes     what is running and what is it consuming right now     end task; sort by CPU, memory, disk, network
Performance   how busy is each resource, graphed                     open Resource Monitor
App history   which store apps used the most over weeks
Startup       what launches at sign-in and how much it slows boot     disable
Users         who is signed in and what their sessions use            sign off, disconnect
Details       every process by executable, PID, priority              set priority or affinity, end process tree
Services      which services run and under what PID                   start, stop, open Services console

Open it with Ctrl+Shift+Esc; it works even when the desktop is unresponsive.

The snap-ins, by scenario

scenario                                                   console                       what you would see or do
a service failed overnight; why?                           eventvwr.msc, System log       Error events with the service name and reason
a program crashes on launch                                eventvwr.msc, Application log  faulting module name
who logged on or failed to                                 eventvwr.msc, Security log     audit events 4624 and 4625
a new disk does not appear in File Explorer                diskmgmt.msc                   Not initialized: initialize as GPT, New Simple Volume, format
extend C: into unallocated space                           diskmgmt.msc                   Extend Volume (space must be adjacent)
a hardware device stopped working after an update          devmgmt.msc                    yellow triangle; Roll Back Driver
a device is present but should not be used                 devmgmt.msc                    Disable device (down arrow)
run a cleanup script every Sunday at 2 a.m.                taskschd.msc                   Create Basic Task, weekly trigger, run whether logged on or not
an HTTPS site is not trusted only on this PC               certmgr.msc                    missing or expired root certificate
add a local admin on a standalone Pro machine              lusrmgr.msc                    New User, add to Administrators
find a slow memory leak over a week                        perfmon.msc                    data collector set logging Available MBytes
require 12-character passwords on a standalone PC          gpedit.msc                     Computer Configuration, Windows Settings, Security Settings, Account Policies

Event Viewer levels and habits

Levels: Critical (the system could not recover, such as an unexpected shutdown), Error (a problem that did not stop the system), Warning (something to watch), Information (normal events). Filter the log by level and time window around the incident. Custom views collect what you care about. The Source column names the component; the Event ID is what you search for.

Disk Management vocabulary

state or action        meaning
Not initialized        brand new disk; choose MBR or GPT
Unallocated            no partition yet; New Simple Volume creates and formats one
Healthy (Primary)      a normal partition
Healthy (Boot, System) the Windows partition and the EFI or system partition
Extend Volume          grow into adjacent unallocated space
Shrink Volume          free space at the end for a new partition
Change Drive Letter    reassign; also mount into an empty NTFS folder
Dynamic disk           software spanning, striping, or mirroring; rarely used now (Storage Spaces instead)

Device Manager icons

A yellow triangle with an exclamation mark: the device has a problem (no driver, driver failed, resource conflict). A gray down arrow: disabled by an administrator. A device in "Other devices" with a question mark: unknown, no driver at all. "View, Show hidden devices" reveals ghosts from unplugged hardware. Roll Back Driver is only available if a previous driver exists.

Worked example

A user reports the PC "freezes for a second every few minutes." Task Manager shows disk at 100 percent in bursts; Resource Monitor names a backup agent scanning files; Event Viewer's Application log shows the agent logging errors about a locked file; Task Scheduler shows the agent's task running every five minutes; the fix is the task's schedule, and Performance Monitor logging disk queue length over the next day proves it.

How the exam asks it

• "Which tool shows why a service failed to start?" Event Viewer.
• "Which snap-in initializes a new disk?" Disk Management.
• "A technician needs to roll back a driver." Device Manager.
• "Automate a script to run nightly." Task Scheduler.
• "Log processor use over several days." Performance Monitor.
• "Set a local password policy on a Pro workstation." Group Policy Editor.
• "Which Task Manager tab disables programs that launch at login?" Startup.

What to memorize

• Task Manager tabs and Ctrl+Shift+Esc.
• eventvwr (Application, Security, System; levels), diskmgmt (initialize, unallocated, extend), taskschd, devmgmt (yellow triangle, roll back), certmgr, lusrmgr, perfmon, gpedit; compmgmt bundles them.