Task Manager: A Complete Walkthrough

01
of 11

Task Manager: A Complete Walkthrough

Illustration of a man at an old switchboard
CSA Images/Archive / Getty Images

There's a mind boggling level of information available in Task Manager about what's going on in Windows, from overall resource usage down to minute details like how many seconds each individual process has used of the CPU's time.

Every little bit, tab by tab, is fully explained over the next 10 slides. Right now, however, let's look at your menu options and what features and choices you have access to there:

File

  • Run new task opens the Create new task dialog box. From here you can browse to, or enter the path of, any executable on your computer and open it. You also have the option to Create this task with administrative privileges, which will run the executable with "elevated" permissions.
  • Exit will close the Task Manager program. It will not end any apps, programs, or processes you're viewing or have selected.

Options

  • Always on top, if selected, will keep Task Manager in the foreground at all times.
  • Minimize on use, if selected, will minimize Task Manager when you choose the Switch to option, available in several areas throughout the tool.
  • Hide when minimized, if selected, will prevent Task Manager from showing up in the taskbar like a normal program. It will, in either case, always appear in the taskbar notification area (the space next to the clock with the little icons).
  • Show full account name will, if selected, display a user's real name next to the user's username where applicable.
  • Show history for all processes will, if selected, show data for non-Windows Store apps and programs in the App History tab.

View

  • Refresh now will, when tapped or clicked, instantly update all of the regularly updated hardware resource data found throughout Task Manager.
  • Update speed sets the rate at which resource data is updated throughout Task Manager. Choose High for 2 updates per second, Normal for 1 update per second, and Low for an update every 4 seconds.
  • Group by type will, when checked, group processes in the Processes tab by App, Background process, and Windows process.
  • Expand all will instantly expand any collapsed entries but only on the tab in which you're viewing at the moment.
  • Collapse all will instantly collapse any expanded entries but only on the tab in which you're viewing at the moment.
  • Status values sets whether or not a process' suspended status is reported in the Status column, available in the Processes and Users tabs. Choose Show suspended status to show it or Hide suspended status to hide it.

Check out the next 10 slides for every detail imaginable on the Processes, Performance, App History, Startup, Users, Details, and Services tabs in the Windows Task Manager!

Note: Microsoft has improved the Task Manager utility considerably from early versions of the Windows operating system, incrementally adding features with every new Windows release. This walkthrough is valid for Windows 10, and mostly for Windows 8, but can also be used to understand the more limited Task Manager versions available in Windows 7, Windows Vista, and Windows XP.

02
of 11

The Processes Tab

Screenshot of the Processes tab in Task Manager in Windows 10
Processes Tab in Task Manager (Windows 10).

The Processes tab in Task Manager is like "home base" in a way - it's the first tab you see, gives you some basic information about what's running on your computer right now, and lets you do most of the common things people do in Task Manager.

Right-click or tap-and-hold on any listed process and you'll be presented with several options, depending on the type of process:

  • Expand/Collapse is just another way to collapse or expand any grouped processes or windows - the same as using the little arrows to the left of the app or process name.
  • The Switch to and Bring to front options, available via right-clicking on the window results under the Apps, both bring up the selected window. Minimize and Maximize do what you'd guess, only they don't necessarily bring the window to the foreground.
  • Restart is available for some processes in control of Windows, like Windows Explorer, and will close and automatically restart that process.
  • End task, no matter where you find it, does just that - it closes the task. If you End task from a process that has child windows or processes, they will close as well.
  • Resource values has nested menus within it of Memory, Disk, and Network. Choose Percents to show resources as a percent of total available on your system. Choose Values (the default) to show the actual level of resource being used. Resource values is also available from the individual column options (more on this in the section below).
  • Create dump file generates what's called a "dump with heap" - an often very large file, in DMP format, that contains everything going on with that program, usually helpful only to a software developer trying to fix an unknown problem.
  • Go to details switches you to the Details tab and preselects the executable responsible for that process.
  • Open file location opens the folder on your computer that contains the executable responsible for that process and preselects it for you.
  • Search online opens up a search results page in your default browser for the executable file and the common name, hopefully serving up something useful.
  • Properties opens the Properties of the processes' executable. This is the same Properties window you have access to from the file if you were to go there manually via the right-click menu in any file list in Windows.

By default, the Processes tab shows the Name column, as well as Status, CPU, Memory, Disk, and Network. Right-click or tap-and-hold on any column heading and you'll see additional information you can choose to view for each running process:

  • Name is the program or process's common name, or file description, if it's available. If it's not, the file name of the running process is shown instead. In 64-bit versions of Windows, 32-bit program names are suffixed by (32-bit) when they're running. This column can not be hidden.
  • Type shows the type of process in each row - a standard App, a Background process, or a Windows process. Task Manager is usually configured to Group by type already, so this column isn't usually helpful to have open.
  • Status will note if a process is Suspended, but only if Task Manager is configured to Show suspended status from the View -> Status values menu.
  • Publisher shows the running file's author, extracted from the file's copyright data. Nothing is shown if no copyright was included when the file was published.
  • PID shows each process's process id, a unique identifying number assigned to each running process.
  • Process name displays the actual file name of the process, including the file extension. This is exactly how the file appears if you were to traditionally navigate to it in Windows.
  • Command line shows the full path and exact execution of the file that resulted in the running of the process, including any options or variables.
  • CPU is a continuously updated display of how much of your central processing unit's resources each process is using at the given moment. Total percentage of total CPU utilization is shown in the column header and includes all processors and processor cores.
  • Memory is a continuously updated display of how much of your RAM is being used by each process at the given moment. Total memory usage is shown in the column header.
  • Disk is a continuously updated display of how much read and write activity each process is responsible for, across all of your hard drives, at the given moment. The percentage of total disk utilization is shown in the column header.
  • Network is a continually updated display of the bandwidth being utilized by each process. The percentage utilization of the primary network as a whole is shown in the column header.

The button at the bottom-right of this tab changes depending on what you have selected. On most processes it becomes End task but a few have a Restart ability.

03
of 11

The Performance Tab (CPU)

Screenshot of the CPU section in the Performance tab in Task Manager in Windows 10
CPU Resources in the Performance Tab in Task Manager (Windows 10).

The Performance tab in Task Manager gives you an overview of how your hardware is being utilized by Windows and whatever software you're running right now.

This tab is further broken down by the individual hardware categories that are most important to your system's performance - CPU, Memory, and Disk, plus either Wireless or Ethernet (or both). Additional hardware categories might also be included here too, like Bluetooth.

Let's look at CPU first and then Memory, Disk, and Ethernet over the next several parts of this walkthrough:

Above the graph, you'll see the make and model of your CPU(s), along with the maximum speed, also reported below.

The CPU % Utilization Graph operates like you'd probably expect, with time on the x-axis and total CPU utilization, from 0% to 100%, on the y-axis.

The data at the far right is right now, and moving left you're seeing an increasingly older look at how much of your CPU's total capacity was being utilized by your computer. Remember, you can always change the rate at which this data is updated via View -> Update Speed.

Right-click or tap-and-hold anywhere on the right to bring up some options for this graph:

  • Change graph to gives you the options of Overall utilization (one graph representing the total utilization across all physical and logical CPUs), Logical Processors (individual graphs, each representing a single CPU core), and NUMA nodes (each NUMA node in an individual graph).
  • Show kernel times adds a second layer to the CPU graph that isolates CPU utilization due to kernel processes - those executed by Windows itself. This data appears as a dotted-line so you don't confuse it with the overall CPU utilization, which includes both user and kernel processes (i.e. everything).
  • Graph summary view hides all the data in Task Manager, including the menus and other tabs, leaving only the graph itself. This is particularly helpful when you need to keep an eye on CPU utilization without the distractions of all that other data.
  • View gives you a right-click method of jumping to the other Memory, Disk, and Network areas of the Performance tab.
  • Copy will copy all of the non-graph information on the page (more on all of that below) to the Windows clipboard, making it really easy to paste anywhere you like... like that chat window where you're getting help from tech support.

There's lots of other information on this screen, all located below the graph. The first set of numbers, which are displayed in a larger font and that you'll no doubt see change from moment to moment, include:

  • Utilization shows the current Overall utilization of the CPU, which should match where the data line meets the graph's y-axis, on the far right.
  • Speed shows the speed at which the CPU is operating at right now.
  • Processes is a total count of all processes running at the moment.
  • Threads is the total number of threads running in the processes at this time, including one idle thread per processor installed.
  • Handles is the total number of object handles in the tables of all running processes.
  • Up time is the total time the system has been running in DD:HH:MM:SS (e.g. 2:16:47:28 means 2 days, 16 hours, 47 minutes, and 28 seconds). This count resets to zero when the computer is restarted or powered on.

The remaining data you see is static data about your CPU(s):

  • Maximum speed is the listed maximum speed for your CPU. You may see the actual speed go a bit higher and lower than this as you use your computer.
  • Sockets indicates the number of physically distinct CPUs you have installed.
  • Cores reports the total number of independent processing units available across all installed processors.
  • Logical processors is the total number of non-physical processing units available across all installed processors.
  • Virtualization reports the current status, either Enabled or Disabled, of hardware-based virtualization.
  • Hyper-V support indicates whether or not Microsoft Hyper-V virtualization is supported by the installed CPU(s).
  • L1 cache reports the total amount of L1 cache is available in the CPU, a small but super-fast pool of memory the CPU can use exclusively for its own purposes.
  • L2 cache, L3 cache, and L4 cache are increasingly larger, and slower, stores of memory that the CPU can use when the L1 cache is full.

Finally, at the very bottom of every Performance tab you'll see a shortcut to Resource Monitor, a more robust hardware monitoring tool included with Windows.

04
of 11

The Performance Tab (Memory)

Screenshot of the Memory section in the Performance tab in Task Manager in Windows 10
Memory Resources in the Performance Tab in Task Manager (Windows 10).

The next hardware category in the Performance tab in Task Manager is Memory, tracking and reporting on various aspects of your installed RAM.

Above the topmost graph, you'll see the the total amount of memory, likely in GB, installed and recognized by Windows.

Memory has two different graphs:

The Memory Usage Graph, similar to the CPU graph, operates with time on the x-axis and total RAM utilization, from 0 GB to your maximum usable memory in GB, on the y-axis.

The data at the far right is right now, and moving left you're seeing an increasingly older look at how much of your RAM's total capacity was being utilized by your computer.

The Memory Composition Graph is not time based, but instead a multi-section graph, some parts of which you may not always see:

  • In use is memory in use by "processes, drivers, or the operating system."
  • Modified is memory "whose contents must be written to disk before it can be used for another purpose."
  • Standby is memory in memory that contains "cached data and code that is not actively in use."
  • Free is memory that "is not currently in use, and that will be repurposed first when processes, drivers, or the operating system need more memory."

Right-click or tap-and-hold anywhere on the right to bring up some options:

  • Graph summary view hides all the data in Task Manager, including the menus and other tabs, leaving only the two graphs themselves. This is particularly helpful when you need to keep an eye on memory usage without all that extra data in the way.
  • View gives you a right-click method of jumping to the other CPU, Disk, and Network areas of the Performance tab.
  • Copy will copy all of the non-graph memory use and other information on the page (more on all of that below) to the clipboard.

Below the graphs are two sets of information. The first, which you'll notice is in a larger font, is live memory data which you'll probably changes every so often:

  • In use is the total amount of RAM in use at this moment, which matches where the data line crosses the graph's y-axis, on the far right of the memory usage graph.
  • Available is the memory that's available to be used by the operating system. Adding the Standby and Free amounts listed in the Memory Composition Graph will get you this number as well.
  • Committed has two parts, the first being the Commit Charge, a lower number than the second, the Commit Limit. These two amounts are related to virtual memory and the paging file; specifically, once the Commit Charge reaches the Commit Limit, Windows will attempt to increase the size of the pagefile.
  • Cached is the memory is memory being passively used by the operating system. Combining the Standby and Modified amounts listed in the Memory Composition Graph will get you this number.
  • Paged pool reports the amount of memory used by important operating system processes (kernel mode components) that can be moved to the pagefile if physical RAM starts to run out.
  • Non-paged pool reports the amount of memory used by kernel mode components that must be kept in physical memory and can't be moved to the virtual memory pagefile.

The remaining data, in smaller font and on the right, contains static data about your installed RAM:

  • Speed is the speed of the installed RAM, usually in MHz.
  • Slots used reports the physical RAM module slots on the motherboard that are used and the total available. For example, if this is 2 of 4, it means that your computer supports 4 physical RAM slots but only 2 are currently being used.
  • Form factor reports the form factor of the installed memory, almost always DIMM.
  • Hardware reserved is the amount of physical RAM reserved by hardware devices. For example, if your computer has integrated video hardware, without dedicated memory, several GB of RAM may be reserved for graphics processes.

The slots used, form factor, and speed data are particularly helpful when you're looking to upgrade or replace your RAM, especially when you can't find information about your computer online or a system information tool isn't more helpful.

05
of 11

The Performance Tab (Disk)

Screenshot of the Disk section in the Performance tab in Task Manager in Windows 10
Disk Resources in the Performance Tab in Task Manager (Windows 10).

The next hardware device to be tracked in the Performance tab in Task Manager is Disk, reporting on various aspects of your hard drive and other attached storage devices like external drives.

Above the topmost graph, you'll see the make model number of the device, if available. If you're looking for a specific hard drive, you can check the other Disk x entries on the left.

Disk has two different graphs:

The Active Time Graph, similar to the CPU and main Memory graphs, this one operates with time on the x-axis. The y-axis shows, from 0 to 100%, the percentage of time that the disk was busy doing something.

The data at the far right is right now, and moving left you're seeing an increasingly older look at the percentage of time this drive was active.

The Disk Transfer Rate Graph, also time based on the x-axis, shows the disk write speed (dotted line) and disk read speed (solid line). The numbers on the top-right of the graph are showing peak rates over the time frame on the x-axis.

Right-click or tap-and-hold anywhere on the right to show some familiar options:

  • Graph summary view hides all the data in Task Manager, including the menus and other tabs, leaving only the two graphs themselves.
  • View gives you a right-click method of jumping to the other CPU, Memory, and Network areas of the Performance tab.
  • Copy will copy to the clipboard all of the non-graph disk use and other information on the page.

Below the graphs are two different sets of information. The first, shown in a larger font, is live disk usage data which you'll certainly see change if you watch:

  • Active time shows the percentage of time, within the units of time on the x-axis, that the disk is busy reading or writing data.
  • Average response time reports the average total time it takes for the disk to complete an individual read/write activity.
  • Read speed is the rate at which the drive is reading data from the disk, at this moment, reported in either MB/s or KB/s.
  • Write speed is the rate at which the drive is writing data to the disk, at this moment, reported in either MB/s or KB/s.

The rest of the data about the disk is static and reported in TB, GB, or MB:

  • Capacity is the total size of the physical disk.
  • Formatted is the total of all formatted areas on the disk.
  • System disk indicates whether or not this disk contains the system partition.
  • Page file indicates whether or not this disk contains a pagefile.

Much more information about your physical disks, the drives they make up, their file systems, and lots more, can be found in Disk Management.

06
of 11

The Performance Tab (Ethernet)

Screenshot of the Ethernet section in the Performance tab in Task Manager in Windows 10
Ethernet Resources in the Performance Tab in Task Manager (Windows 10).

The final major hardware device to be tracked in the Performance tab in Task Manager is Ethernet, reporting on various aspects of your network, and ultimately internet, connection.

Above the graph, you'll see the make and model of the network adapter you're viewing the performance of. If this adapter is virtual, like a VPN connection, you'll see the name provided for that connection, which may or may not look familiar to you.

The Throughput Graph has time on the x-axis, like most graphs in Task Manager, and the total network utilization, in Gbps, Mbps, or Kbps, on the y-axis.

The data at the far right is right now, and moving left you're seeing an increasingly older look at how much network activity was taking place via this particular connection.

Right-click or tap-and-hold anywhere on the right to bring up some options for this graph:

  • Graph summary view hides all the data in Task Manager, including the menus and other tabs, leaving only the graph, a fantastic choice if you want to dock this window in the corner of your desktop to keep an eye on things.
  • View gives you a right-click method of jumping to the other CPU, Memory, and Disk areas of the Performance tab.
  • View network details will bring up the Network Details window, a data-only, fine grained, down-to-the-byte view the different types of information passing in and out of each adapter on your system.
  • Copy will copy to the clipboard all of the non-graph network utilization data and other information on the page.

Below the graph is live send/receive data:

  • Send shows the current rate by which data is being sent via this adapter, in Gbps, Mbps, or Kbps, and reported on the graph as a dotted line.
  • Receive shows the current rate by which data is being received via this adapter, in Gbps, Mbps, or Kbps, and reported on the graph as a solid line.

...and next to that, some helpful static information on this adapter:

  • Adapter name is the name, in Windows, given to this adapter.
  • SSID is the wireless network name that you're connected via this adapter.
  • DNS name is the DNS server that you're currently connected to. This is not the same thing as the DNS servers that your connection to the internet is using!
  • Connection type shows the general type of connection this is, like Ethernet, 802.11ac, Bluetooth PAN, etc..
  • IPv4 address lists the current IPv4 IP address tied to this adapter's current connection.
  • IPv6 address lists the current IPv6 address tied to this adapter's current connection.
  • Signal strength shows the current wireless signal strength.

The data you see in this "static" area varies greatly depending on the type of connection. For example, you'll only see signal strength and SSID on non-Bluetooth wireless connections. The DNS name field is even more rare, usually only showing up on VPN connections.

07
of 11

The App History Tab

Screenshot of the App History tab in Task Manager in Windows 10
App History in Task Manager (Windows 10).

The App History tab in Task Manager shows CPU and network hardware resource usage on a per-app basis. To also see data for non-Windows Store apps and programs, choose Show history for all processes from the Options menu.

Note: The date app-specific resource tracking started is shown at the top of the tab, after Resource usage since .... Tap or click the Delete usage history link to remove all the data recorded in this tab and immediately start the counts over at zero.

By default, the App History tab shows the Name column, as well as CPU time, Network, Metered network, and Tile updates. Right-click or tap-and-hold on any column heading and you'll see additional information you can choose to view for each app or process:

  • Name is the program or process's common name, or file description, if it's available. If it's not, the file name of the running process is shown instead. This column can not be removed.
  • CPU time is the amount of time spent by the CPU executing instructions initiated by this app or process.
  • Network is the total network activity (downloads + uploads), in MB, this process or app is responsible for.
  • Metered network reports, in MB, the total network activity by this app that occurred over a metered network connection.
  • Tile updates is the total download and upload activity, in MB, used by this app's tile updates and notifications.
  • Non-metered network reports, in MB, the total network activity by this app that occurred over a non-metered network connection
  • Downloads reports the total download activity, in MB, this process or app is responsible for.
  • Uploads reports the total upload activity, in MB, this process or app is responsible for.

Right-click or tap-and-hold on any row with a non-app process and you'll get two options:

  • Search online opens a search results page in your default browser, using the executable file and the common name as the search terms.
  • Properties opens the Properties of the processes' executable. This is the same Properties window you'd see if you were to choose this option after right-clicking on the file anywhere else in Windows.

Right-click or tap-and-hold on any app to Switch to that app. The switch to wording on the apps is a little disingenuous here because the app, even if running, won't be switched to at all. Instead, a completely new instance of the app is started.

08
of 11

The Startup Tab

Screenshot of the Startup tab in Task Manager in Windows 10
Startup in Task Manager (Windows 10).

The Startup tab in Task Manager shows you all the processes that are configured to start automatically when Windows starts. Previously disabled startup processes are listed, too.

Note: In versions of Windows that have it, this Task Manager tab replaces, and expands upon, the data in the Startup tab found in the System Configuration (msconfig) tool.

Above the table is a Last BIOS time indication which is a measurement, in seconds, of the last system startup time. Technically, this is the time between BIOS handing booting off to Windows and when Windows has fully started (not including you signing on). Some computers may not see this .

Right-click or tap-and-hold on any listed process and you'll be presented with several options, depending on the type of process:

  • Expand/Collapse is just another way to expand or collapse grouped processes. This is no different than using the little arrows to the left of the process name.
  • Disable/Enable will disable a currently enabled, or enable a previously disabled, process from starting automatically with Windows.
  • Open file location opens the folder on your computer that contains the executable responsible for that process and selects it for you.
  • Search online opens up a search results page in your default browser, using the file and common names as search terms. This is a great way to investigate a startup item you're not sure what to do with.
  • Properties opens the Properties of the processes' executable. This is the same Properties option available from the file's right-click menu in other parts of Windows.

By default, the Startup tab shows the Name column, as well as Publisher, Status, and Startup impact. Right-click or tap-and-hold on any column heading and you'll see additional information you can choose to view for each startup process:

  • Name is the program or process's common name, or file description, if it's available. If it's not, the file name of the running process is shown instead. You can't remove this column from the table.
  • Publisher shows the running file's author, extracted from the file's copyright data. If the file doesn't contain copyright data then this field is left blank.
  • Status will note if a process is Enabled or Disabled as a startup item.
  • Startup impact is the impact on CPU and disk activity that this process had the last time the computer started. Possible values include High, Medium, Low, or None, and is updated after each startup. You'll see Not measured if Windows wasn't able to determine the resource impact for some reason.
  • Startup type indicates the source of the instruction to start this process at startup. Registry is referring to the Windows Registry (at SOFTWARE\Microsoft\Windows\CurrentVersion\Run in HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER) and Folder to the Startup folder in the Start Menu.
  • Disk I/O at startup is the total read/write activity, measured in MB, that this process engaged in during the Windows startup process.
  • CPU at startup is the total CPU time, measured in milliseconds, that this process used during the Windows startup process.
  • Running now indicates if the listed process is currently running.
  • Disabled time lists the day of the week, month, day, year, and local time that a disabled startup process was disabled.
  • Command line shows the full path and exact execution, including any options or variables, of this startup process.

In lieu of right-clicking or tap-and-holding a process to disable or enable it from starting up, you can choose to tap or click the Disable or Enable button, respectively, to do the same.

09
of 11

The Users Tab

Screenshot of the Users tab in Task Manager in Windows 10
Users in Task Manager (Windows 10).

The Users tab in Task Manager is a lot like the Processes tab but processes are instead grouped by signed in user. At a minimum, it's a convenient way to see which users are currently signed in to the computer and what hardware resources they're using.

Tip: To see real names in addition to account usernames, choose Show full account name from the Options menu.

Right-click or tap-and-hold on any user and you'll be presented with several options:

  • Expand/Collapse is just another way to collapse or expand the grouped processes running under that user. It works the same as the arrows to the left of the user.
  • Disconnect will disconnect the user from the system but will not sign that user off. Disconnecting usually only has value if the user you disconnect is using the computer remotely, at the same time you are.
  • Manage user accounts is just a shortcut to User Accounts applet in Control Panel.

Right-click or tap-and-hold on any listed process under a user (expand the user if you don't see these) and you'll be presented with several options:

  • Switch to, if available, brings this running program to the foreground.
  • Restart is available for some Windows processes, like Windows Explorer, and will close and automatically restart the process.
  • End task, unsurprisingly, ends the task.
  • Resource values is the top level menu of a series of nested menus: Memory, Disk, and Network. Choose Percents to show resources as a percent of total resources. Choose Values (the default) to show the actual resource level being utilized.
  • Create dump file generates a "dump with heap" in DMP format. This often very large file contains everything involved with that process.
  • Go to details switches you to the Details tab and selects the executable responsible for that process.
  • Open file location opens the folder on your computer that contains the executable responsible for the particular process.
  • Search online automatically searches online for information about the process. The page that opens is in your default browser but always uses Microsoft's Bing search engine.
  • Properties opens the Properties data available for this processes' executable.

By default, the Users tab shows the User column, as well as Status, CPU, Memory, Disk, and Network. Right-click or tap-and-hold on any column heading and you'll see additional information you can choose to view for each user and running process:

  • User shows the user's account name along with an updated number, in parenthesis, indicating the number of processes running under that user at this moment. The expanded view of the User shows those running processes.
  • ID shows the number assigned to the session that the user became a part of when signing in. Certain types of software, as well as Windows itself, may be a part of a session so a sole user of a computer may not be assigned Session 0.
  • Session describes the type of session this user is using on the computer. When using your computer normally you'll see Console. If you're connecting remotely, like via Remote Desktop, you'll see RDP-Tcp#0 or something similar.
  • Client name displays the hostname of the client computer that the user is using to connect to this computer. You'll only see this when there's an active remote connection, like a Remote Desktop connection to your PC.
  • Status will note if a process is Suspended, but only if Task Manager is configured to report this, via View -> Status values -> Show suspended status.
  • CPU is a continuously updated display of how much of your CPU's resources each process, as well as each user as a whole, is using at the given moment. Total percentage of total CPU utilization is shown in the column header and includes all processors and processor cores.
  • Memory is a continuously updated display of how much of your RAM is being used by each process and each user at the given moment. Total memory usage is shown in the column header.
  • Disk is a continuously updated display of how much read and write activity each process, and user, is responsible for, across all of your hard drives, at the given moment. The percentage of total disk utilization is shown in the column header.
  • Network is a continually updated display of the bandwidth being utilized by each process and each user. The percentage utilization of the primary network as a whole is shown in the column header.

The button at the bottom-right of this tab changes depending on what you have selected. On a user, it becomes Disconnect and on a process it becomes End task or Restart, depending on the process selected.

10
of 11

The Details Tab

Screenshot of the Details tab in Task Manager in Windows 10
Details in Task Manager (Windows 10).

The Details tab in Task Manager contains what can only be interpreted as the mother lode of data on each process running on your computer right now. This tab is what the Processes tab was in Windows 7 and earlier, with a few extras.

Right-click or tap-and-hold on any listed process and you'll be presented with several options:

  • End task ends the process. Assuming the ending was successful, the process will disappear from the list in the tab.
  • End process tree ends the process, as well as any child processes that the process was responsible for starting.
  • Set priority allows you to set the base priority of a process which, depending on what threads are seeking the same priority at the same time, may improve the process' ability to utilize the CPU by giving it access to it before other processes. Options are Realtime, High, Above normal, Normal, Below Normal, and Low.
  • Set affinity allows you to choose which CPU cores the process is allowed to utilize. Options include <All Processors> or any combination of CPU cores available on your computer. At least one core must be chosen.
  • Analyze wait chain shows, in a new Analyze wait chain window, what other processes the process in question is using... or waiting to use. If one of those processes this one is waiting on is frozen/hung, it will be highlighted in red. You can then end that process, via the End process button, and potentially prevent any data loss that may have occurred by ending the original process.
  • UAC virtualization toggles UAC virtualization on or off for the process, assuming it's allowed for it.
  • Create dump file generates a "dump with heap" - a file, DMP format, that contains everything going on with that process.
  • Open file location opens the folder on your computer that contains the executable responsible for that process.
  • Search online opens up a search results page in your default browser, using the executable file and the common name as search terms.
  • Properties opens the Properties of the processes' executable. This is the same Properties window you'd see if you opened Properties from the file directly.
  • Go to service(s) switches you to the Services tab and preselects the service(s) associated with the process. If no service is associated then no preselection takes place but you'll still be switched to that tab.

By default, the Details tab shows the Name column, as well as PID, Status, User name, CPU, Memory (private working set), and Description. Right-click or tap-and-hold on any column heading and choose Select columns. From this list are a number of additional columns of information you can choose to view for each running process:

  • Name is the actual file name of the running process, including the file extension. This is exactly how the file appears if you were to navigate to it in Windows.
  • Package name is another descriptive field available for apps. These processes are typically located in the \Windows\SystemApps or \Program Files\WindowsApps folders.
  • PID shows the process's process id, a unique identifying number assigned to each running process.
  • Status will note if a process is currently Running or Suspended.
  • User name shows the account name of the user that started the process, even if it was automatic. Aside from signed in users (like you), you'll also see LOCAL SERVICE, NETWORK SERVICE, SYSTEM, and possibly a few others.
  • Session ID shows the number assigned to the session that the process was started in. Windows itself may be a part of a session, probably 0, and then other users, like you, will be part of different sessions, likely 1 or 2.
  • Job Object ID shows the "job object in which the process is running."
  • CPU is live display of how much of your central processing unit's resources the process is currently using and includes all processors and cores.
  • CPU time is the total processor time, in HH:MM:SS format, that the process has utilized since it started.
  • Cycle reports the current percent of CPU cycle time consumption by the process, which includes all processors and cores. Usually, the System Idle Process will be utilizing most of the cycle time.
  • Working set (memory) is a live display of how much of your computer's physical memory is in use by the process at this time. This is a combination of the memory reported in the private and shared working set.
  • Peak working set (memory) is the maximum amount of physical memory this process used at one time since the process started. Think of this as the "record high memory use" for this process.
  • Working set delta (memory) is the change in the process' physical memory usage between each test. In other words, it shows the change in the Working set (memory) value each time that value is tested.
  • Memory (private working set) is the physical memory in use by the process that no other process is able to use.
  • Memory (shared working set) is the physical memory in use by the process that is available for sharing with other processes.
  • Commit size is the "amount of virtual memory reserved by the operating system for the process."
  • Paged pool is the "amount of pageable kernel memory allocated by the kernel or drivers on behalf of the process."
  • NP pool is the "amount of non-pageable kernel memory allocated by the kernel or drivers on behalf of the process."
  • Page faults is the "number of page faults generated by the process since it was started." A page fault occurs when the process accesses memory that's not part of its working set.
  • PF Delta is the "change in the number of page faults since the last update."
  • Base priority is the "ranking that determines the order in which threads of a process are scheduled." Possible values include Realtime, High, Above normal, Normal, Below Normal, Low, and N/A. Base priority for a process can be set via Set priority, available when right-clicking or tap-and-holding on the process.
  • Handles reports the "current number of handles open by the process."
  • Threads reports the number of active threads the process is running right now.
  • User objects is the "number of window manager objects (windows, menus, cursors, keyboard layouts, monitors, etc.) used by the process."
  • GDI objects is the "number of GDI (Graphics Device Interface) objects used by the process."
  • I/O reads is the count of " read I/O operations generated by the process since it was started." This includes file, device, and network I/Os.
  • I/O writes is the count of "write I/O operations generated by the process since it was started." This includes file, device, and network I/Os.
  • I/O other is the count of "non-read/non-write I/O operations generated by the process since it was started." Control functions are a common other example.
  • I/O read bytes reports the actual amount of I/O reads, in bytes, that this process is responsible for generating since it started.
  • I/O write bytes reports the actual amount of I/O writes, in bytes, that this process is responsible for generating since it started..
  • I/O other bytes reports the actual amount of I/O operations (other than reads and writes), in bytes, that this process is responsible for generating since it started.
  • Image path name reports the full location, including the drive, folders, and file name with extension, where this process can be found on the hard drive.
  • Command line shows the full image path name, plus any options or variables used to execute the process.
  • Operating system context reports the "operating system context in which the process is running." If you see an older version of Windows in this field it does not indicate that you're running an outdated process. It's simply reporting level of compatibility and only if provided by the manifest in the process executable.
  • Platform reports if the process is running as 64-bit or 32-bit. This notation can also be seen, in parenthesis, after the process' name back on Processes tab.
  • Elevated indicates whether or not the process is running "elevated" (i.e. as an administrator) or not. This is the same "elevated" as in running a command via an elevated Command Prompt.
  • UAC virtualization "specifies whether User Account Control (UAC) virtualization is enabled, disabled, or not allowed in the process."
  • Description is the process's common name, or file description, if available. If it's not, the file name of the running process is shown instead.
  • Data Execution Prevention "specifies whether Data Execution Prevention (DEP) is enabled or disabled for the process."

With all selected processes, the button on the bottom-right will End task - the same as the End task right-click/tap-and-hold option.

11
of 11

The Services Tab

Screenshot of the Services tab in Task Manager in Windows 10
Services in Task Manager (Windows 10).

The Services tab in Task Manager is a stripped-down version of Services, the tool in Windows that's used to manage Windows services. The full Services tool can be found in Administrative Tools, via Control Panel.

Right-click or tap-and-hold on any listed service and you'll be presented with a few options:

  • Start will start a currently stopped service.
  • Stop will stop a currently running service.
  • Restart will restart a currently running service (i.e. stop it and then automatically start it again).
  • Open Services, no matter which service you choose this option from, opens the Services tool. It does not preselect the service in Services.
  • Search online opens up a search results page in your default browser, using the service name and description as the search terms.
  • Go to details switches you to the Details tab and auto-selects the executable responsible for that service. This option is only available if the service is running.

Unlike with other tabs in Task Manager, the columns in the Services tab are preset and can not be be changed:

  • Name is the name of the service and comes from the Service name field in the Services tool.
  • PID shows the unique process id for the service's associated process.
  • Description is the listed description for the service and comes from the Display name field in the Services tool.
  • Status will note if a process is currently Running or Stopped.
  • Group displays the group the service is a part of, if it is part of one.

While they can't be changed, the columns in the Services tab can be rearranged. Just click or hold and drag around as you like.

Was this page helpful?