This chapter provides a comprehensive guide to Windows Task Manager, a critical troubleshooting tool for the CompTIA A+ 220-1102 exam. Task Manager is used to monitor system performance, manage running processes, and diagnose application or system issues. Expect 2-3 exam questions that directly test your ability to interpret Task Manager data, identify resource bottlenecks, and use its various tabs and features. Mastery of Task Manager is essential for the Operating Systems domain objective 1.2.
Jump to a section
Imagine you're the captain of a large cargo ship. Your ship has dozens of engines, pumps, generators, and crew members. To manage everything, you have a central dashboard called the 'Engine Room Console.' This console shows you real-time data: engine RPMs, fuel flow, electrical load, temperature readings, and a list of all active systems. If a pump starts consuming too much power, the console highlights it in red. If a generator is idle, you can shut it down to save fuel. You can also see which crew members are running which tasks and how much time they're spending. This console is your primary tool for troubleshooting performance issues, identifying resource hogs, and keeping the ship running smoothly. Similarly, Windows Task Manager is the central dashboard for your PC. It shows you real-time CPU, memory, disk, and network usage. It lists all running processes, their resource consumption, and lets you end unresponsive programs. Just as a captain uses the engine console to diagnose a failing pump, a technician uses Task Manager to identify a memory-leaking application or a process consuming 100% CPU. Without it, you'd be navigating blind, relying on guesswork instead of data.
What is Windows Task Manager?
Windows Task Manager is a system monitor, performance analyzer, and process management utility built into all modern Windows versions (Windows 8, 10, and 11). It provides a real-time view of running applications, background processes, system services, and hardware resource usage (CPU, memory, disk, network, and GPU). Task Manager is the first tool a technician should open when a user reports a slow computer, an unresponsive application, or high resource usage.
How to Launch Task Manager
There are several ways to open Task Manager, and the exam expects you to know at least the most common methods:
Ctrl+Shift+Esc: Direct shortcut – always works.
Ctrl+Alt+Delete: Then select "Task Manager" from the security screen.
Right-click the taskbar: Select "Task Manager" from the context menu.
Windows Key + X: Then select "Task Manager" from the Power User menu.
Run dialog (Win+R): Type taskmgr and press Enter.
Command Prompt or PowerShell: Type taskmgr and press Enter.
The Two Views: Compact and Full
When you first open Task Manager, it may appear in a compact view showing only running applications. Click "More details" at the bottom to expand to the full view. The full view is the one you'll use for troubleshooting and is what the exam tests.
The Tabs of Task Manager
Task Manager has multiple tabs, each serving a specific purpose. The default tabs are:
Processes: Shows all running processes (apps and background processes) with real-time resource usage columns (CPU, Memory, Disk, Network, GPU, Power usage).
Performance: Displays graphs and detailed statistics for CPU, Memory, Disk (including transfer rates and active time), Ethernet/Wi-Fi, and GPU.
App history: Shows resource usage for the current user account over time (CPU time, network usage).
Startup: Lists programs that launch at startup and their impact (None, Low, Medium, High, Not measured).
Users: Shows active user sessions and their resource consumption.
Details: Advanced view of all processes with additional columns (PID, status, priority, etc.).
Services: Lists Windows services with their status (Running, Stopped) and allows starting/stopping.
Processes Tab – The Heart of Troubleshooting
The Processes tab is the most frequently used. It groups processes into three categories:
Apps: User-facing applications (e.g., Chrome, Word, File Explorer).
Background processes: Processes that run without a user interface (e.g., antivirus, update services).
Windows processes: Critical system processes (e.g., System, Service Host, Windows Explorer).
Each process shows:
Name: The executable name.
Status: Running, Suspended, or Not responding.
CPU: Percentage of CPU usage. A process consistently using 100% CPU may indicate a problem.
Memory: Amount of RAM in use. High memory usage can slow the system.
Disk: Disk activity as a percentage. 100% disk usage is a common sign of a bottleneck.
Network: Network utilization as a percentage of the adapter's capacity.
GPU: GPU usage (if a compatible GPU is present).
Power usage: Estimated power consumption (Very low, Low, Moderate, High, Very high).
You can right-click a process to:
End task: Forcefully terminates a process. Use this when an application is unresponsive.
Restart: Ends and relaunches the process (useful for File Explorer).
Go to details: Jumps to the Details tab with that process selected.
Open file location: Opens the folder containing the executable.
Search online: Searches for the process name using your default browser.
Properties: Shows file properties.
Set priority: Changes the process priority (Realtime, High, Above Normal, Normal, Below Normal, Low). Be cautious – setting a process to Realtime can destabilize the system.
Set affinity: Limits the process to specific CPU cores.
Analyze wait chain: Shows which threads the process is waiting on – useful for diagnosing deadlocks or hangs.
Create dump file: Creates a memory dump for debugging.
Go to service(s): Shows which services are associated with the process.
Performance Tab – System Resource Overview
The Performance tab provides a high-level view of system resource usage. It shows:
CPU: Utilization percentage, speed, number of cores/logical processors, and a graph of usage over time. Also shows processes, threads, and handles.
Memory: Total RAM, used, available, cached, and a memory composition graph (In use, Modified, Standby, Free). Also shows the amount of memory in use as a percentage.
Disk: Active time percentage, transfer rate, and average response time. High active time (100%) often indicates a slow disk, especially on HDDs.
Ethernet/Wi-Fi: Send and receive speed in Mbps, and a graph of network activity.
GPU: Multiple graphs for 3D, Copy, Video Encode, and Video Decode usage.
At the bottom of the Performance tab, you'll find:
Resource Monitor button: Opens Resource Monitor, a more detailed tool.
Open Resource Monitor: Provides per-process CPU, memory, disk, and network data.
App History Tab
This tab shows resource usage for the current user account, specifically for Microsoft Store apps and some desktop apps. It displays:
CPU time: Total CPU time used by the app.
Network: Total data sent and received (in MB).
Metered network: Data used on metered connections.
Tile updates: Not commonly used.
The data is cumulative since the last reset (use "Delete usage history" to reset). This tab is useful for identifying apps that use excessive data.
Startup Tab
This tab lists programs that run automatically when Windows starts. It shows:
Name: Program name.
Publisher: Software publisher.
Status: Enabled or Disabled.
Startup impact: Measured as None, Low, Medium, High, or Not measured. This is based on the program's effect on boot time.
To disable a startup program, right-click it and select "Disable." This is a common step to speed up boot time.
Users Tab
Shows all users currently logged on to the system (local or remote). For each user, it displays:
User: Username.
Status: Active or Disconnected.
CPU, Memory, Disk, Network: Resource usage per user.
Sessions: Number of sessions.
You can right-click a user and select:
Disconnect: Ends the user's session (data loss may occur).
Log off: Logs the user off.
Send Message: Sends a message to the user (on older systems).
Details Tab
This tab provides a detailed list of all running processes, similar to the Processes tab but with more columns and no grouping. Key columns include:
PID: Process Identifier – a unique number for each process.
Status: Running, Suspended, etc.
User name: The account under which the process runs.
CPU: CPU usage percentage.
Memory (active private working set): Memory that cannot be shared.
Description: A description of the process.
Command line: The full command used to start the process (including arguments).
Platform: 32-bit or 64-bit.
You can add columns by right-clicking any column header and selecting "Select columns." Useful columns include:
Base priority: Priority level.
Threads: Number of threads.
Handles: Number of open handles.
Working set (memory): Total memory in use.
Peak working set: Maximum memory used.
I/O reads/writes: Disk I/O activity.
Right-click a process to:
End task: Terminates the process.
End process tree: Terminates the process and all its child processes.
Set priority: Change priority.
Set affinity: Bind to specific CPU cores.
Analyze wait chain: Diagnose hangs.
Open file location: Locate the executable.
Properties: View file properties.
Create dump file: For debugging.
Debug: Attach a debugger (if one is installed).
Services Tab
Lists all Windows services with:
Name: Service name.
PID: Process ID.
Description: What the service does.
Status: Running, Stopped, or Paused.
Group: Service group (optional).
You can right-click a service to:
Start: Start a stopped service.
Stop: Stop a running service.
Restart: Stop then start.
Open Services: Opens the Services MMC snap-in for more detailed management.
Go to process: Jumps to the Details tab for the associated process.
Using Task Manager for Troubleshooting
Task Manager is essential for diagnosing common issues:
High CPU usage: In the Processes tab, sort by the CPU column to find the process using the most CPU. If it's a legitimate application (e.g., antivirus scan), wait for it to finish. If it's unknown or suspicious, end the task and investigate further.
High memory usage: Sort by the Memory column. If memory usage is near 100%, the system may become slow. Identify the process and consider closing it or adding more RAM.
High disk usage: Sort by the Disk column. 100% disk usage on an HDD often indicates a bottleneck. Check if the disk is an HDD or SSD. For HDDs, defragmentation may help, but for SSDs, check for excessive writes. Common causes include Windows Search indexing, Superfetch (SysMain), or antivirus scans.
Unresponsive application: If an application is "Not responding" in the Processes tab, select it and click "End task" (or right-click and select "End task"). This forces the application to close.
Slow startup: Use the Startup tab to disable high-impact programs that are not needed at boot.
Network issues: The Performance tab shows network utilization. If a process is using excessive network bandwidth, identify it in the Processes tab and take action.
Task Manager in Different Windows Versions
While the core functionality is similar across Windows 8, 10, and 11, there are minor differences:
Windows 8/8.1: Introduced the modern Task Manager with the current tab layout. The Processes tab groups apps and background processes.
Windows 10: Added GPU monitoring in the Performance tab and the App history tab. The Startup tab shows startup impact.
Windows 11: The interface is visually updated but functionally similar. The Performance tab now shows disk type (HDD or SSD). The Processes tab includes a "Power usage" column.
The exam focuses on Windows 10 and 11, but be aware of the general features.
Task Manager vs. Resource Monitor
Resource Monitor (resmon.exe) provides more granular data than Task Manager. It offers per-process CPU, memory, disk, and network activity with real-time graphs and detailed I/O information. Task Manager is the first line of defense; Resource Monitor is used for deeper analysis.
Command-Line Alternatives
For scripting or remote management, you can use:
tasklist: Lists running processes with PID, session name, and memory usage.
taskkill: Terminates processes by PID or image name. Example: taskkill /IM notepad.exe /F (force kill).
wmic: Windows Management Instrumentation Command-line. Example: wmic process list brief.
These are not directly tested on the 220-1102 exam but are useful in practice.
Open Task Manager
Press Ctrl+Shift+Esc to open Task Manager directly. Alternatively, use Ctrl+Alt+Delete and select Task Manager, or right-click the taskbar and choose Task Manager. If the compact view appears, click 'More details' to expand to the full view. The full view is essential for troubleshooting as it shows all tabs and detailed resource usage.
Identify the Problem Tab
Based on the reported issue, navigate to the relevant tab. For a slow computer, go to the Processes tab to see which process is consuming the most CPU, memory, or disk. For a network issue, check the Performance tab for network utilization. For a startup problem, use the Startup tab. For an unresponsive application, the Processes tab will show 'Not responding' status.
Sort by Resource Column
Click the column header for the resource you want to analyze (e.g., CPU, Memory, Disk). This sorts processes by that resource in descending order, placing the highest consumer at the top. For example, if the system is sluggish, sort by CPU to see if any process is using 100% CPU. This immediately highlights the culprit.
Analyze the Culprit Process
Examine the process name and its resource usage. Right-click the process to see options like 'Go to details' for more information, 'Search online' to identify unknown processes, or 'Open file location' to see where the executable resides. If the process is legitimate (e.g., a system process like System or a known application), determine if its high usage is temporary or abnormal.
Take Corrective Action
If the process is unresponsive or causing problems, select it and click 'End task' (or right-click and choose 'End task'). For startup programs, right-click and select 'Disable' to prevent them from launching at boot. For services, you can stop or restart them. If the issue persists, consider further investigation using Resource Monitor or Event Viewer.
Enterprise Scenario 1: Help Desk Response to a Slow Computer
A user calls the help desk reporting that their Windows 10 workstation is extremely slow, especially when opening files or launching applications. The technician remotely connects and opens Task Manager. In the Processes tab, they sort by Disk and see the disk usage is consistently at 100%. They notice that the 'System' process (specifically the 'System' process with high disk activity) or 'Microsoft Windows Search Indexer' is causing the bottleneck. The technician checks if the disk is an HDD (mechanical drive) – often the case in older enterprise deployments. They temporarily disable Windows Search via Services.msc and ask the user to test performance. The issue resolves. The technician then schedules a disk defragmentation (for HDD) or checks for excessive writes (for SSD). They also verify if the SysMain (Superfetch) service is causing high disk activity. This scenario is common in environments with older hardware, and Task Manager is the first tool to diagnose the bottleneck.
Enterprise Scenario 2: Identifying a Memory Leak in a Custom Application
A company deploys a custom inventory management application. Over time, the application consumes more and more memory until the system becomes unresponsive. Users report that after a few hours, the application slows down. The IT team opens Task Manager on an affected workstation and sorts by Memory. They see the inventory app's memory usage climbing steadily. They right-click the process and select 'Go to details' to see the exact PID and memory working set. They also check the Performance tab to see overall memory usage. The memory graph shows a steady increase over time. The team ends the task, which frees the memory. They then contact the software vendor with evidence from Task Manager (screenshots of memory usage over time) to report the memory leak. The vendor patches the application. Task Manager provides the data needed to quantify the issue and communicate it effectively.
Enterprise Scenario 3: Managing Startup Programs in a Corporate Environment
An organization rolls out a new security agent that installs a startup program. After deployment, many users complain about slow boot times. The IT team uses Task Manager's Startup tab on a sample of workstations to measure the startup impact of the new agent. They see it is marked as 'High impact.' They also check the 'Last BIOS time' in the Performance tab (if available) to differentiate between POST time and Windows boot time. They decide to deploy a Group Policy Object (GPO) to disable the startup program for most users, relying instead on a scheduled task that runs after logon. This reduces boot time significantly. Task Manager's Startup tab provides a quick way to assess the impact of startup programs without additional tools.
What the 220-1102 Exam Tests
The CompTIA A+ 220-1102 exam objective 1.2 (Microsoft Windows) includes Task Manager as a key troubleshooting tool. Specifically, you need to know:
How to open Task Manager (multiple methods).
The purpose of each tab (Processes, Performance, App history, Startup, Users, Details, Services).
How to end a task (End task vs. End process tree).
How to analyze resource usage (CPU, memory, disk, network).
How to manage startup programs (enable/disable).
How to identify a process that is not responding.
How to use the Details tab to find a PID or command line.
Common Wrong Answers and Why Candidates Choose Them
Confusing 'End task' with 'Close window': Candidates often think that clicking the X on an unresponsive application is the same as using Task Manager. The exam tests that Task Manager's 'End task' forcefully terminates the process, while closing the window may not work if the application is hung.
Thinking the Performance tab shows per-process data: The Performance tab shows overall system resource usage, not per-process. Candidates might incorrectly use it to find which process is using the most CPU. The correct tab is Processes.
Believing that disabling a startup program in Task Manager uninstalls it: Disabling only prevents it from running at startup; the program remains installed. Candidates might think it's a permanent removal.
Assuming 'Not responding' always means the application is frozen: Sometimes an application may temporarily become unresponsive while performing a lengthy operation. The exam may test that you should wait a moment before ending the task.
Specific Numbers and Values to Memorize
Ctrl+Shift+Esc: The direct shortcut for Task Manager.
taskmgr: The executable name.
PID: Process Identifier – unique number for each process.
Columns in Details tab: PID, Status, User name, CPU, Memory, Description, Command line, Platform.
Startup impact levels: None, Low, Medium, High, Not measured.
Resource categories: CPU, Memory, Disk, Network, GPU, Power usage.
Edge Cases and Exceptions
Task Manager itself may become unresponsive: In rare cases, Task Manager may not open. Use Ctrl+Alt+Delete as an alternative.
Ending a critical system process: Ending a process like 'System' or 'svchost.exe' can cause a system crash (BSOD). The exam expects you to know not to end critical system processes.
Multiple instances of the same process: Some applications run multiple instances. The Details tab shows each instance with a unique PID.
Virtual machines: Task Manager in a VM shows virtual resources, not physical.
How to Eliminate Wrong Answers
When you see a question about Task Manager, ask yourself:
Which tab gives me the information I need? (Processes for per-process, Performance for overall)
Is the action safe? (Ending a system process is dangerous)
What is the correct keyboard shortcut? (Ctrl+Shift+Esc is the direct one)
What does 'End task' actually do? (Forcefully terminates the process)
By understanding the underlying mechanism, you can eliminate answers that suggest using the wrong tab or that imply a less forceful action.
Task Manager can be opened with Ctrl+Shift+Esc, Ctrl+Alt+Delete, or by right-clicking the taskbar.
The Processes tab shows per-process CPU, Memory, Disk, Network, and GPU usage.
Sort by a column header to identify the resource hog.
End task forcefully terminates a process; use it for unresponsive applications.
The Performance tab shows overall system resource usage with real-time graphs.
The Startup tab lists programs that run at boot; disable high-impact ones to speed up boot.
The Details tab provides advanced information including PID, command line, and priority.
Be careful not to end critical system processes like System or svchost.exe.
The Services tab allows starting, stopping, and restarting Windows services.
Task Manager does not show processes from other users by default; use the Users tab or 'Show processes from all users'.
These come up on the exam all the time. Here's how to tell them apart.
End Task
Terminates only the selected process.
Safe for most applications; other related processes may continue running.
Use when a single application is unresponsive.
May leave child processes running, which can cause issues.
Quick and minimal impact.
End Process Tree
Terminates the selected process and all its child processes.
Use when an application has spawned multiple processes that are all problematic.
Ensures all related processes are stopped.
Can cause data loss if child processes are performing important tasks.
More aggressive; use with caution.
Mistake
Task Manager shows all processes from all users by default.
Correct
Task Manager by default shows processes for the current user only. To see processes from other users, you must go to the Users tab or click 'Show processes from all users' (requires administrator privileges).
Mistake
Ending a task in Task Manager is the same as closing the application normally.
Correct
Ending a task forcefully terminates the process without allowing it to save data or clean up. Normal closing allows the application to perform shutdown procedures. Always try to close an application normally first.
Mistake
The Performance tab shows per-process CPU usage.
Correct
The Performance tab shows overall system CPU usage, not per-process. Use the Processes tab to see which process is using the most CPU.
Mistake
Disabling a startup program in Task Manager uninstalls the program.
Correct
Disabling a startup program only prevents it from running automatically at boot. The program remains installed and can be run manually. To remove it, you must uninstall it via Settings or Control Panel.
Mistake
High disk usage always indicates a failing hard drive.
Correct
High disk usage can be caused by many factors, including Windows Search indexing, Superfetch (SysMain), antivirus scans, or a fragmented HDD. It does not necessarily mean the drive is failing. Check the disk's health using tools like CHKDSK or SMART status.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The quickest way is to press Ctrl+Shift+Esc. You can also press Ctrl+Alt+Delete and select Task Manager, right-click the taskbar and choose Task Manager, or press Windows Key + X and select Task Manager. Alternatively, type 'taskmgr' in the Run dialog (Win+R) or in a Command Prompt.
100% disk usage often indicates a bottleneck, especially on HDDs. Common causes include Windows Search indexing, the SysMain (Superfetch) service, antivirus scans, or a fragmented drive. In the Processes tab, sort by Disk to see which process is causing the high usage. For HDDs, consider defragmenting; for SSDs, check if the drive is failing or if there's excessive write activity.
It means the application is not processing Windows messages and appears frozen. This can happen due to a hang, a deadlock, or a lengthy operation. You can wait a moment to see if it recovers, or you can right-click and select 'End task' to force close it. Use 'Analyze wait chain' to see what the application is waiting on.
By default, Task Manager shows only processes for the current user. To see all processes, click 'More details' (if in compact view), then click the 'Processes' tab. At the bottom, click 'Show processes from all users'. You may need to confirm a User Account Control (UAC) prompt. Alternatively, go to the Users tab to see per-user resource usage.
'End task' terminates only the selected process. 'End process tree' terminates the selected process and all child processes it started. Use 'End process tree' when an application has spawned multiple processes that are all problematic. Be cautious as it may cause data loss in child processes.
Open Task Manager and go to the Startup tab. Right-click the program you want to disable and select 'Disable'. The status will change from 'Enabled' to 'Disabled'. This prevents the program from running automatically when Windows starts. To re-enable it, right-click and select 'Enable'.
Yes, in the Details tab, right-click a process, select 'Set priority', and choose a priority level (Realtime, High, Above Normal, Normal, Below Normal, Low). Be careful: setting a process to Realtime can make the system unstable. Priority changes are not permanent; they revert when the process restarts.
You've just covered Windows Task Manager — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?