Windows Tools & Management Consoles

Windows ships with a powerful set of built-in tools for managing hardware, diagnosing problems, scheduling tasks, and configuring the system. A technician who knows these tools — and knows them by name AND by their exact executable or .msc filename — can work efficiently without installing third-party software. The A+ exam tests both: given a task, which tool? Given a filename, what does it do?

This lesson covers every tool in the 220-1202 objective. For each one, memorize the display name and the exact filename. They are both tested.

Task Manager (taskmgr.exe)

Task Manager is the first tool you open when a system is slow, unresponsive, or behaving unexpectedly. Open it with Ctrl+Shift+Esc (direct), Ctrl+Alt+Del → Task Manager, or right-click the taskbar → Task Manager — flag the keyboard shortcuts for verification.

Task Manager has seven tabs in Windows 10 and 11:

Processes — lists every running application and background process with real-time CPU, memory, disk, and network usage per process. Right-click any process to open its file location or end it. This is the tab you use when a specific program is consuming excessive resources or needs to be force-quit.

Performance — real-time graphs for CPU, memory, disk, network, and GPU. Each resource shows current usage, capacity, and utilization history. Use this tab to confirm whether a system is under load or to baseline performance for a support ticket.

App history — cumulative resource usage over time per application, focused on UWP (Universal Windows Platform) apps. Useful for identifying which apps have consumed significant resources over the past month.

Startup — lists every program configured to launch when Windows starts, along with a startup impact rating (Low, Medium, High). Right-click any entry to enable or disable it. Use this tab to reduce slow boot times by disabling unnecessary startup programs.

Users — shows all currently logged-in user accounts and their aggregate resource usage. Useful on shared workstations to see if another user's session is consuming resources.

Details — a more granular process view than Processes. Shows the process ID (PID), CPU and memory usage, and allows setting process priority (Low, Below Normal, Normal, Above Normal, High, Realtime) and CPU affinity (which processor cores the process can use).

Services — lists all Windows services with their status (Running, Stopped) and start type. You can start, stop, and restart services from here without opening the full Services snap-in.

MMC Snap-ins

The Microsoft Management Console (MMC) hosts a set of administrative tools called snap-ins. Each snap-in runs as a .msc file. You open them by typing the filename in the Run dialog (Win+R) or the Start menu search.

Event Viewer — eventvwr.msc

Event Viewer collects log entries from Windows and installed applications and displays them in a searchable, filterable interface. Three main Windows logs:

• Application — events from software running on Windows: crashes, warnings, and informational messages from applications and services
• Security — audit events: successful and failed login attempts, policy changes, object access. This is where you look when investigating unauthorized access or failed authentication
• System — events from Windows components: driver failures, service starts/stops, hardware issues

Each log entry has a severity level: Information, Warning, Error, or Critical. When diagnosing a system problem, filter by Error and Critical in the System and Application logs and note the Event ID — it identifies the specific failure type.

Disk Management — diskmgmt.msc

Disk Management is the GUI tool for storage configuration. Use it to: initialize a new unrecognized disk, create and delete partitions (called volumes), format partitions with a filesystem (NTFS, exFAT, FAT32), assign or change drive letters, extend or shrink existing volumes, and convert a disk between MBR and GPT partition schemes — reference L2 for GPT/MBR context.

Task Scheduler — taskschd.msc

Task Scheduler runs scripts or programs automatically based on a trigger. Common triggers: at a specific time (daily, weekly, at logon), when Windows starts, when the system is idle, or when a specific event appears in Event Viewer. Use Task Scheduler to automate backups, maintenance scripts, or software updates without user interaction.

Device Manager — devmgmt.msc

Device Manager lists all hardware devices Windows recognizes, organized by device category. When a device has a problem, Device Manager shows a status icon:

• Yellow exclamation mark (!) — the device has a driver problem: the driver is missing, corrupted, outdated, or incompatible
• Downward-pointing arrow (↓) — the device is disabled (either by the user or by Windows); this replaced the red X used in older Windows versions (XP/Vista/7)

From Device Manager you can: update a driver (search automatically or from a file), roll back a driver to the previous version, uninstall a driver, disable or enable a device, and view device properties including the driver version and date.

Certificate Manager — certmgr.msc

Certificate Manager displays and manages digital certificates for the currently logged-in user. It organizes certificates by purpose: Personal (certificates issued to this user), Trusted Root Certification Authorities, Intermediate Certification Authorities, and others. Use it to inspect certificate details, import or export certificates, and diagnose certificate errors in browsers or applications.

Local Users and Groups — lusrmgr.msc

Local Users and Groups manages the local user accounts and security groups on the machine — accounts that exist only on this computer, not on a domain. Create, delete, and modify local accounts here; add or remove users from local security groups (Administrators, Users, Remote Desktop Users, etc.).

Not available on Windows Home editions — reference L3. lusrmgr.msc requires Windows Pro or above.

Performance Monitor — perfmon.msc

Performance Monitor tracks specific performance counters over time and saves the data for analysis. Unlike Task Manager's real-time view, Performance Monitor can log data continuously and produce reports. Counters are organized by object (Processor, Memory, PhysicalDisk, Network Interface) and instance. Data Collector Sets bundle multiple counters together for scheduled collection runs.

Use Performance Monitor when you need a baseline, a trend report, or data that covers a period longer than what Task Manager shows.

Group Policy Editor — gpedit.msc

The Local Group Policy Editor configures Local Group Policy — settings that apply to the machine and its local users. Policy settings cover security (password requirements, account lockout), software restriction, user interface restrictions, and hundreds of Windows behaviors.

Not available on Windows Home editions — reference L3. gpedit.msc requires Windows Pro or above.

Additional Windows Tools

These tools run as standalone executables (.exe), not as MMC snap-ins.

System Information — msinfo32.exe

System Information produces a comprehensive inventory of the machine: OS version, system manufacturer and model, BIOS/UEFI version, processor, installed RAM, page file location, installed drivers, running services, loaded modules, network adapters, and more. Use it when you need a complete snapshot of a system's configuration for a support ticket or compatibility check — all the information in one place without opening multiple tools.

Resource Monitor — resmon.exe

Resource Monitor provides more granular real-time data than Task Manager. It shows per-process CPU, memory, disk, and network activity — including which specific files each process is reading or writing, which TCP connections each process has open, and which DLLs and handles each process holds. Use Resource Monitor when Task Manager shows a resource spike but you need to identify exactly which file, connection, or handle is responsible.

System Configuration — msconfig.exe

System Configuration controls how Windows starts. Its key tabs:

• General — choose Normal startup, Diagnostic startup (minimal services and drivers), or Selective startup
• Boot — configure boot options including Safe Boot (Minimal, Network, Active Directory), boot timeout, and which OS to load in a multiboot setup
• Services — hide/show Windows services; uncheck services to prevent them from starting
• Startup — in older Windows versions, this managed startup programs; in modern Windows 10/11, this tab links to Task Manager's Startup tab
• Tools — a shortcut launcher for other administrative tools

Disk Cleanup — cleanmgr.exe

Disk Cleanup scans a selected drive and identifies files that can be safely deleted: Temporary Internet Files, Recycle Bin contents, Windows Update cleanup, thumbnail cache, error reports, and more. The "Clean up system files" button (which requires administrator elevation) adds system-level cleanup targets including old Windows installations and service pack backups — significantly more aggressive than the default scan.

Disk Defragmenter — dfrgui.exe

The Disk Defragmenter tool — labeled "Defragment and Optimize Drives" in Windows 10/11 — consolidates fragmented files on HDDs so that the read head can access them without seeking across the platter. Modern Windows schedules HDD defragmentation automatically on a weekly basis.

SSDs must not be defragmented. An SSD has no moving read head — fragmentation does not cause the same performance penalty as on HDDs. Running defragmentation against an SSD adds unnecessary write cycles without providing any performance benefit, contributing to the drive's wear. The correct operation for an SSD is optimization, which triggers the TRIM command — this informs the SSD's controller which blocks of data are no longer in use so they can be erased in advance. Windows automatically sends TRIM to SSDs; running "Optimize" from dfrgui.exe on an SSD triggers this correctly.

Registry Editor — regedit.exe

The Windows Registry is a hierarchical database that stores OS configuration, hardware settings, user preferences, and application data. Registry Editor lets you browse, edit, add, and delete registry keys and values directly.

The Registry is organized into five top-level hives — flag all five for verification:

1. HKEY_CLASSES_ROOT (HKCR) — file type associations and COM object registrations
2. HKEY_CURRENT_USER (HKCU) — settings for the currently logged-in user
3. HKEY_LOCAL_MACHINE (HKLM) — system-wide settings that apply to all users; hardware configuration
4. HKEY_USERS (HKU) — all loaded user profiles on the system
5. HKEY_CURRENT_CONFIG (HKCC) — current hardware profile information

The check questions below test your ability to match tools to filenames, interpret Device Manager status indicators, and apply the correct tool to a given technician scenario.