Task Manager and Resource Monitor in Windows
Task Manager is a powerful program for managing running applications and processes, checking system and network performance and logged on users. Since Windows Vista, there is also a program called Resource Monitor for more detailed information about your system and running applications.
You can open Task Manager by pressing Ctrl+Shift+Esc on your keyboard or by right-clicking (or tapping and holding on touch-screens) on an empty space of Taskbar and selecting Task Manager (Windows XP, Vista, 8 and 8.1) or Start Task Manager.
In Windows Vista and 7, you can also use Start menu Search box for launching Task Manager - just type "task" and click View running processes with Task Manager.
In Windows 8 and 8.1, open Apps search/Search everywhere using keyboard shortcut Windows Key+Q, type "task" into Search box and click Task Manager. Alternatively, use keyboard shortcut Windows Key+X to open Quick Links menu (a list of system management tools) and click Task Manager.
Touch-screen users should swipe in from the right edge of screen and tap Search icon.
To make system checking easier, Task Manager is on top of all other windows by default - it always hides contents of other open windows. You can change that by opening Options menu and clicking Always On Top. The Minimize On Use option works only after switching to another open program - you can turn the option off to keep Task Manager visible.
In Windows 8 and 8.1, Task Manager opens in simple view if launched for the first time. You can access its options by right-clicking a running app. If no program is open, "There are no running apps" is displayed and options are not available. You can either launch an app (please note that Windows/File Explorer is not listed in simple view) or click the More Details button to open full view of Task Manager.
Double-clicking an empty space inside the Task Manager window in Windows XP, Vista and 7 will hide its Title Bar and Tabs. On Performance and Networking tabs, this will show larger CPU (processor) or network usage graphs. Double-click some empty space again to restore normal view.
In Windows 8 and 8.1 this view is not available.
Windows 8/8.1 add several new commands to right-click menu in all views of Task Manager. You can launch apps using the Run new task command - for example, if Windows Explorer crashes so that no Taskbar is visible, click the command, type "explorer" and click OK to make Desktop reappear correctly.
Please note that while Windows Explorer has been renamed to File Explorer since Windows 8, all explorer.exe processes are still called Windows Explorer in Task Manager.
The Open file location command opens the app folder in File Explorer, so you can easily verify it is the correct program, not malware. You can also verify a program's legitimacy using Properties command.
The Search online command helps in case you have no idea whether the running app is a safe one or some malware. Clicking the command will open default Internet browser and search using default search engine. By default, it is Internet Explorer and Bing. If you see that the program is labelled as malware (for example, many links to removal guides), it is necessary to run full anti-virus and anti-malware scans.
You need Task Manager when an application (program) has stopped responding and you need to close it by force or a program is so busy that you cannot switch to other windows.
If an application is very busy doing something processor-intensive, its Taskbar icon might be unresponsive and you can't minimize its window. When you need to see other programs, open Task Manager and go to Applications tab. Right-click on the application name and select Minimize. This should force the application to minimize in a short period of time.
You could also right-click the program you want to see and click Switch To or Bring To Front.
In Windows 8 and 8.1, simple view of Task Manager offers only Switch To; other commands are available only if you click the More details button, expand an app and right-click its process in Processes tab. More details on that later in this article.
If an application stays unresponsive for a long time and distracts your work, it is better to close it. The nice way for this is by ending its task; the more brute way is to kill its process (discussed later in this article).
To play nice and tell an application to stop its work and close, right-click on its name in Task Manager Applications tab and click End Task (see picture above).
In most cases this closes the application.
Windows 8 and 8.1 changed the Processes tab of Task Manager completely - it displays current total usage of CPU, Memory, Disk and Network resources and allows application grouping for better overview. Fully manageable list of processes is now available in Details tab.
Click More details to reveal the tabs if Task Manager is in default (simple) view.
On this tab, you can sort by any column by clicking on it; stopping mouse pointer on a column header reveals what the contents mean.
Because new Modern UI/Metro-style apps can be suspended, you can reveal this status by opening View menu (Alt+V), expanding Status values and clicking Show suspended status.
Suspended Modern UI apps are sleeping in background and waiting to be activated. They will not update any Live Tiles while suspended. Metro apps suspend automatically if they are running, but not used for a longer period of time.
To enable easier distinguishing between the types of running applications, open View menu again and enable the Group by type option.
This will provide a much better overview of running programs/apps, background processes and Windows processes. Generally, you should not use the End task command on background or Windows processes.
If a process or app has several child processes or apps, the number of these are displayed in brackets until the group is expanded.
Grouping is not used if you sort the list by any other column than Name.
Please note that right-click menu has different options if clicked on a group, sub-process or service.
For a group, you can use the new and useful Open file location and Search online commands for quick distinguishing between safe processes and malware. The Go to details command opens the associated process in Details tab where you can also lower its priority or kill the process or process tree forcibly.
If you right-click a service, you can stop it, open Services management console to manage it, or search online to verify it is safe. The latter is useful in case you have no idea what the service does, if it is safe to stop it or if it is related to some malware.
Right-clicking Windows Explorer group adds one more option - Restart. This enables easier recovery of Desktop and Taskbar in case Windows Explorer stops responding or crashes completely.
To display usage percentages instead of numeric values in Memory, Disk or Network columns, select the option form Resource values of right-click menu.
To see a list of running processes (this includes applications and services) in Windows XP, Vista and 7, click the Processes tab.
In Windows 8 and 8.1, click More details if Task Manager is in default (simple) view and then open Details tab.
Here you can sort the applications listed by any column visible (Image name, CPU, etc) in ascending or descending order. Click on a column name once and it will be sorted in ascending order, the next click will sort it in descending order. The list will be dynamically updated every second, so if you sort the process list by CPU (processor usage in percentage) column in descending order you will see the processes that consume the most of your computer's processing power. If there are many programs running at the same time, this list changes often and makes it hard to find a process. Sort the list by Image Name or Name column (this is actually the file name of running program) and find the process in much more peaceful list.
Windows 8 and 8.1 display details on what each column means if you stop mouse pointer on column header.
By default in Windows XP, Vista and 7, only programs started by the current user (you) are shown. Windows 8 and 8.1 display all running processes for administrators, and processes of current user for standard users.
Administrators can also see and end system processes and applications of other users. To see processes of all users logged on to a Windows XP, Vista or 7 computer, click the Show processes from all users check box (in Windows XP) or button. This will also display "System Idle Process" - an indicator of unused processor power at the time. This should have a value around 90 if your computer is not doing much - but the value will never exceed 99.
Of course, Windows Vista will open User Account Control dialog after clicking the button. Click Continue then.
In Windows Vista and 7, the button will be replaced by a check box with the same name after the change.
But then a normal user never knows what process he/she needs to check - the names are sometimes pretty cryptic. To access the correct process, go back to Applications tab, right-click on the running application you want to manage and click Go To Process. This is especially useful when you have several My Computer windows open and one of them stops responding. All those My Computer and Windows/File Explorer windows are different processes with the same name (explorer.exe), but Go To Process shows you exactly the right one.
In Windows 8 and 8.1, Processes tab enables the same action for all programs except Windows Explorer. You can end any open Windows Explorer process by expanding its group and right-clicking the required one (select End task). For other apps, you can right-click on the group name (not any sub-processes) and click Go to details.
This command will open Processes (in Windows XP, Vista and 7) or Details tab and select the process related to the application you selected.
If your computer reacts slowly and a process is consuming lots of CPU for a longer time, try changing its priority to a lower level first. By default, most processes start with Normal priority, which means that CPU resources are shared equally as needed.
To lower priority of a process, right-click (or tap and hold on touch-screens) it in Processes tab (Windows XP, Vista and 7), select Set Priority and click BelowNormal (in Windows XP) or Below Normal.
In Windows 8 and 8.1, you should do this in Details tab instead.
To allocate more resources to a process, use Above Normal instead. This might be useful for programs that deal with time-consuming tasks, such as video encoding. High is also acceptable sometimes, but Realtime is never recommended because this might make your device unresponsive (essential system tasks do not get enough resources).
Windows will then open a window warning about possible system instability. Click Yes (in Windows XP) or Change priority.
Please note that if you are trying to change a priority level of some essential system processes, you will get "Access Denied" error message instead. Some processes do not allow changing their priorities to keep Windows stable.
This does not mean that you can fool around with all processes on the list, though! Keep your mind clear and change only the process that seems to be causing trouble.
You can also set the process to Low priority if it still seems to eat all processor power even after changing to Below Normal level. One example where this might be useful, is when Windows Search Indexer (SearchIndexer.exe) starts to consume way too many resources for no apparent reason.
Please remember that priority settings are not permanent - they last only until the process or your PC restarts.
In case your PC has multiple physical processors (CPU-s), or a CPU with multiple cores and/or HyperThreading, you can set the affinity of a process. Affinity defines which processors or cores a program, service or app can use.
For example, if your PC has 4 cores available, then limiting affinity to 3 cores means that the process can only use up to 75% of CPU resources, 2 cores limits it to 50% CPU, and 1 core means that only 25% of total CPU resources will be available for the process. Basically, the more cores your computer has, the better your options are - on a Dual Core computer your options are only 100% and 50%.
Again, you cannot change the affinity of critical system processes and services. For example, the infamous SearchIndexer.exe (Windows Search Indexer) affinity can only be limited in Windows 7 and newer. Windows Vista users should definitely limit Windows Search priority to Power Saver in Power Options.
To define affinity for a process, right-click (or tap and hold on touch-screens) it in Processes (Windows XP, Vista and 7) or Details tab (Windows 8 and 8.1), and choose Set Affinity.
Tick the check boxes for processors (CPU-s) that you want to allow for the selected process and click OK. In Windows 7 and newer, you can use the <All Processors> check box for selecting or deselecting all cores at once - but you must choose at least one core.
Please note that affinity settings are not permanent - they last only until the process or your PC restarts.
Users of Windows Vista and newer can also use Event Log for troubleshooting performance of programs, services and drivers.
If an application is totally unresponsive and clicking End Task on Applications (Windows XP, Vista and 7) or Processes (Windows 8/8.1) tab changes nothing, you can try killing the process itself. Right-click on the process and select End Process.
Windows will open a warning window, click Yes (in Windows XP) or End process to kill the process.
Some processes have sub-processes or related processes and if killing a power-hungry process does not stop it from eating CPU resources, right-click it again and select End Process Tree instead.
If after ending a hung process (especially when killing explorer.exe) your Desktop and Taskbar disappear, you can get them back by starting explorer.exe process again. Open File menu and click New Task (Run...) or Run new task (in Windows 8/8.1 only).
Create New Task window opens.
If you've enabled the Show processes from all users option in Windows Vista, there will be an additional line stating "This task will be created with administrative privileges". Some processes (such as explorer.exe) should not be run with elevated rights, close Task Manager and re-open it using keyboard shortcut Ctrl+Shift+Esc. Then launch the program normally.
In Windows 7, 8 and 8.1, you can just check or uncheck the Create this task with administrative privileges box, but for explorer.exe this is not required.
Type "explorer" and click OK.
Your Desktop and Taskbar will reappear after a few seconds.
In Windows 8 and 8.1, Processes tab of Task Manager enables easier restarting of Windows Explorer process. Just right-click the Windows Explorer group (not any of its sub-processes) and use the Restart command.
Please note that it restarts Desktop and Taskbar only, any previously open File Explorer windows must be relaunched.
You can also use Processes or Details tab for checking which program or process has used most resources over time.
In Windows XP, Vista and 7, open View menu and click Select Columns.
In Windows 8 and 8.1, just right-click any column head (title) and click Select columns.
Use check boxes to display or hide the columns you need.
To reveal long-time CPU (processor) hogs, enable the CPU Time column. This displays the total processor time that processes have used since they started.
To see which programs, apps or processes use hard disk the most, turn on I/O Read Bytes and I/O Write Bytes columns.
RAM usage can be seen in Memory Usage (Windows XP only) or Commit size columns. This reveals the total amount of memory used by a process.
Click OK after you're done.
Now Task Manager displays the columns you selected. You might have to resize its window to see all items.
In most cases, the System Idle Process should have the largest value in CPU Time column - this shows the total time while processor was not in use.
In Windows Vista, 7, 8 and 8.1, Task Manager also includes the Services tab. This displays a list of all services available with their current status (Stopped or Running). This tab is not meant for configuring services, but you can open Services management console by clicking the Services... (Windows Vista and 7) or Open Services button under the list.
Here you can start or stop services and see which process the selected running service is related to. I do not recommend fiddling with items listed under this tab as this can lower system security if you stop an important service. If you want to check which process a running (not stopped!) service is related to, right-click the service and select Go to Process (Windows Vista and 7) or Go to Details.
You can also do this the other way round - to see which service(s) a running process is related to, right-click the process under Processes (Windows Vista and 7) or Details tab and click Go to Service(s). This is especially useful in case you want to know which services a svchost.exe process is related to - there are normally several svchost.exe processes running in Windows.
Please note that not all running processes are related to services.
Under Performance tab of Task Manager are essential indicators for system performance. Most of these are useful for IT specialists only, but you can still see graphically how much of your computer's processor power and Page File (in Windows XP) or Physical Memory is used in real time. Please note that the History graphs are filled only while Task Manager is running.
In case you have a multi-core / HyperThreading processor or more than one processor installed, you will see a graph for each core or physical processor.
Windows 8 and 8.1 have a completely reworked tab again - it shows sub-tabs for CPU, Memory, Disk and Network, each displaying more detailed data about current usage. All graphs provide overview of data shown if you stop mouse pointer on them.
If processor usage is high for a long time, go back to Processes tab and click CPU column twice. This will show which processes use the most of your computer's processor. Ignore the "System Idle Process" - this shows how much of processor power is free.
To check if your computer has enough RAM (Random Access Memory) installed, open all the programs that you tend to keep running at all times and use these for some time (10-15 minutes).
In Windows XP, see the Available line in the Physical Memory (K) section on the right. If the number is consistently less than 32 000 (32 megabytes), you should consider adding more RAM.
In Windows Vista and 7, see the Physical Memory line on the bottom right of the window. If the percentage often exceeds 85, more RAM is required.
In Windows 8 and 8.1, open Memory tab on the left and check the Available column - if the number is often zero or only a few megabytes, the current amount of RAM is insufficient.
See the Memory and hard disks article about how to check which type of memory modules are required. In Windows Vista and later, use ReadyBoost to reduce stress on RAM and disk drives.
Next tab in Windows Task Manager is called Networking. In Windows 8 and 8.1, the same tab has been moved to Performance tab. In Windows XP, Vista and 7, it does not display any other useful information than the network adapter usage history and link speed. The usage indicator will not usually exceed a few percent. If your computer has multiple network adapters, there is a separate history graph for each adapter.
Windows 8 an 8.1 adds some more useful data, such as IP-address (local, not external), and DNS name.
In Windows 8/8.1, you can see which ModernUI/Metro-style/Windows Store apps have consumed most of available resources over a longer period of time. Open App history tab to see statistics for your user account.
You can again sort by any column by clicking on its header. All column headers provide overview of data displayed if you stop mouse pointer on them.
To enhance the overview, those apps that have used more resources are displayed in darker colors.
You can also select columns displayed by right-clicking on any present column header and enabling or disabling available options.
The difference between Metered networks and Non-metered networks is that the first one includes networks that charge for the amount of data uploaded and downloaded - cellular (3G, 4G, LTE), dial-up and other similar networks.
To reset the data usage for your account, click Delete usage history. The action will not be confirmed.
Another new tab in Windows 8 and 8.1 Task Manager is Startup. This allows easy management of startup apps for current user account and, if current user is an administrator, for local computer. Right-click on an app to disable or enable it at startup, or use the new Open file location and Search online commands to gather more information about the item.
In older versions of Windows, you can do the same using free CCleaner. Of course, the latter will not display the extremely useful Startup impact column that reveals which apps take most time starting.
The Users tab displays all users that are logged on to your computer. Administrators can disconnect their sessions, log them off or send messages to them. It does not seem to make much sense as consumer versions of Windows allow only one active user at a time, but it comes in handy when there are multiple user accounts on your computer and User Switching is turned on.
Windows 8 and 8.1 have again improved the tab, helping administrators list running processes and resource usage for every user. Standard users can see their own data here, but not others' data. The number of running processes for a user is displayed in brackets.
In first example, Mirjam is currently logged on and using the computer. Her status is "Active". Margus was also logged on, but he used Switch Users command instead of Log off command - his programs are still running, although his status is "Disconnected". In second example, it is the other way round - Margus is signed in with his Microsoft Account and Mirjam's local account is disconnected.
In first example, Mirjam has "Console" written in the Session column, this also means that she is actively using the computer (physical access). Second type for Sessions can be "RDP-Tcp" in case Remote Desktop or Remote Assistance is enabled. In most cases Remote Desktop should not be enabled, but if it is, you can see remote host name or IP address connected to your computer inClient Name column.
Connecting to another user's session
Now imagine that Mirjam needs to restart the computer after running Windows Update. If Margus is not available, but Mirjam knows his password (that is a very bad practice, never share passwords!), she can log on as Margus, close his running programs and then restart the computer. This is exactly the same as using the Switch Users command and logging on as Margus from Welcome Screen - but doing it with Task Manager takes less steps.
Please remember that only administrators can connect to another user's session. Windows Vista and 7 users must first click the Show processes from all users button of Processes tab in order to run Task Manager with elevated privileges. Without these rights, managing other users' sessions fails with the dreaded "Access is denied" error.
To connect as another user, right-click the user name and select Connect. In Windows 8 and 8.1, you can also use the Switch user account command - this will open Welcome screen with available user accounts.
Note that Windows 8/8.1 (the second picture) adds another useful feature to right-click menu - Manage user accounts command. This opens User Accounts in Control Panel (not the Modern UI/Metro-style app).
Type in password of the other user and click OK.
You will then be switched to another user's session. Your own open programs will continue to run in your own session.
Logging other users off
If Mirjam has administrative rights, but does not know Margus's password (this is good practice), she still can log Margus off.
To log other user off without connecting to that user's session, right-click on the user name and click Log Off (Windows XP, Vista and 7) or Sign off. This will close the user's running programs and therefore the user will lose all unsaved changes in his/her open documents. After closing programs, the user will be logged off. Use it with care!
Again, Windows Vista and 7 users must first click the Show processes from all users button (Processes tab) in order to run Task Manager as an administrator. Without these rights, ending other users' sessions fails with the "Access is denied" error.
A confirmation window opens. Click Yes (in Windows XP), Log off user (Windows Vista and 7) or Sign out user to log the selected user off.
Sending messages to other users
When Mirjam does not know Margus's password and she does not want to log him off, she can still leave a message for Margus, for example "Log off and restart the computer as soon as possible - new updates need to take effect!". Mirjam can then log off, leave the computer running and go to some night club... err, sports club. When Margus returns, he will see the message after logging on. Such an inexpensive substitute for a phone call!
To send a message to another user, you need administrative rights again.
Right-click on the user's name and click Send Message... command.
Send Message window opens. Message title field is automatically filled, but you can change that if you want to. Then type something in Message field and click OK to send the message.
You might hear a beep to indicate that a message was received by the user.
When the user logs on the next time, he/she will see the message:
Resource Monitor is best suited for tech support people who sometimes need to see more detailed reports about processes and services. I will not go into details with Resource Monitor as this site is primarily meant for beginners and intermediates. Windows 7, 8 and 8.1 users can see some helpful overview of any column contents after they stop mouse pointer on the column's title.
You can start by clicking the Resource Monitor... (Windows Vista and 7) or Open Resource Monitor button on Performance tab of Windows Task Manager.
Windows Vista will open another lovely User Account Window. Click Continue to assure the little creature that you know what you're doing.
Resource Monitor opens in Overview tab, with CPU section open. You can open and close any section by clicking on it. You can sort any list by any column by clicking the column name. If a value is longer than column width, stop mouse pointer on it and you will see the full value in a ToolTip.
Real-time history graphs for all main sections are on top in Windows Vista and on the right in Windows 7, 8 and 8.1. The latter also has different tabs for more detailed overview of a resource usage and a Views button to switch between sizes of the graphs on the right.
CPU section displays both running processes and services and how much processor resources they are using - sorted by Average CPU usage during the last 60 seconds. Section head shows current total CPU usage and at which frequency CPU is running - if there is nothing much to do, modern processors slow down automatically to save power.
Here you can see which processes or services are writing to or reading from which files. The section might be empty for a while, but it will fill eventually after some disk activity occurs. As in CPU section, the statistics are displayed for the last 60 seconds. Section head shows current Disk I/O (Input/Output) in kilobytes and current disk usage in percentage.
By default, all processes are sorted by I/O Priority column, but I suggest sorting by Response Time (how quickly hard disk completes reading or writing) or Total (B/sec) (how much data the service or process reads or writes) columns instead.
In picture below, the first row shows that System service has written 17 477 bytes (17 kilobytes) to Page File (Virtual Memory) in 14 milliseconds.
If Response Time column consistently shows values over 1000 milliseconds, it is probably time to defragment your hard disk and/or free up some disk space.
This section is empty until your computer does some networking (dooh!) - uses the Internet or local network. Processes and services using network are sorted by Total (B/sec) column - how many bytes of information the program sent and/or received during the last 60 seconds. You can see the remote host name the process or service is connected to in Address column. Section head shows current network traffic in kilobits (one byte equals 8 bits) and current usage of network speed available.
Those who have installed Spybot-Search & Destroy might be alarmed by some processes connecting to www.007guard.com - a known malware host. This happens because Spybot creates a list of malicious sites in Windows hosts file and assigns the IP-address of local computer (127.0.0.1) to them to block traffic to those harmful sites (aka Immunization). When Windows tries to resolve the IP 127.0.0.1 to a host name, it receives the first name in the hosts file - usually www.007guard.com.
So fear not, this is nothing to worry about!
Here you can see how much physical memory (RAM) processes and services are using. By default, the list is sorted by Private (KB) column - how much dedicated memory (in kilobytes) a process or service is using. To see the total amount of memory the process or service is using, see Committed (KB) column. Section head displays total Hard Faults and current total physical memory usage. If there are many hard faults consistently, you should run a RAM check to see if your computer's memory modules are working correctly or check for an update to the program that is causing hard faults.
If the Used Physical Memory is constantly over 85%, it is time to close some unneeded programs or add memory modules to your computer.
Monitoring only selected process(es) in Windows 7, 8 and 8.1
In Windows 7, 8 and 8.1, you can filter running processes to see only the data you need. Select one or more check boxes in CPU section and other sections will display only data related to the selected process(es). The selection will be assigned a color for the graphs on the right to visually determine the amount of resources used by it. You can get more detailed information on the selected processes under any of the tabs above.
All other tabs in Resource Monitor show even more detailed information about how many resources are being used by processes and services. As this gets really technical, I will not cover this part. You can find more information about using Resource Monitor in several Windows Vista, 7, 8 and 8.1 books and e-books, plus free online resources.
Do not forget that you can troubleshoot performance issues in Windows Vista and newer using Event Log entries.