2.1.4. Use Microsoft Windows operating system features and tools. (Obj. 1.4)

💡 First Principle: A technician must be proficient with graphical (GUI) tools to efficiently manage and troubleshoot Windows.

While the command line is powerful, a vast amount of Windows administration and troubleshooting is done through its graphical user interface (GUI) tools. These tools, many of which are part of the Microsoft Management Console (MMC), provide a visual and interactive way to manage system components. Knowing where these tools are and what they do is fundamental to your role. Most can be accessed by right-clicking the Start button, through the Control Panel, or by typing their executable name (.msc or .exe) into the Run dialog (Win+R).

• Task Manager (taskmgr.exe or Ctrl+Shift+Esc): Your primary tool for real-time diagnostics. Use it to see which processes are running, monitor CPU, memory, disk, and network usage, manage startup applications that slow down boot time, and force-close unresponsive programs. To identify an unfamiliar process, right-click it and choose Search online (or Open file location) before ending it; killing an unknown process blindly can crash Windows if it turns out to be a critical system service.
• Device Manager (devmgmt.msc): The central hub for all hardware attached to the system. Here you can view installed devices, update or roll back drivers, disable hardware, or troubleshoot issues. A yellow exclamation point next to a device is a universal sign of a driver problem.
• Disk Management (diskmgmt.msc): Used for managing hard drives and SSDs. You can initialize new disks, create and format partitions, assign or change drive letters, and extend volumes. A new disk must first be initialized (GPT or MBR); the New Simple Volume wizard then sets the volume size, assigns a drive letter, and formats it with a filesystem.
• Event Viewer (eventvwr.msc): The logbook of the operating system. It records significant events, categorized into Application, Security, and System logs. When a program crashes or a service fails to start, Event Viewer is the first place you should look for detailed error codes and clues.

Figure: Windows Event Viewer showing system logs - your first stop when investigating crashes and service failures

• System Configuration (msconfig.exe): A classic utility for troubleshooting boot issues. You can modify boot options (like booting into Safe Mode) and control which services and startup items load when Windows starts, helping to isolate the cause of a problem.
• Performance Monitor (perfmon.msc): A highly advanced tool for deep analysis. While Task Manager shows you what's happening now, Performance Monitor lets you track hundreds of specific performance counters over time, log the data, and generate reports to diagnose complex, intermittent performance issues.
• Resource Monitor (resmon.exe): Sits between Task Manager and Performance Monitor: a real-time, per-process breakdown of CPU, memory, disk, and network use. Its Disk tab shows which files each process is reading and writing. For a quick graphical overview of utilization, Task Manager's Performance tab is simpler.
• System Information (msinfo32.exe): A static, comprehensive report of the system's configuration: OS version and build, CPU, installed RAM, BIOS/UEFI, and components.
• Task Scheduler (taskschd.msc): Runs programs or scripts automatically at a set time (e.g., every day at 3:00 AM) or in response to an event.
• Local Users and Groups (lusrmgr.msc): Creates and manages local user accounts and groups (Pro and higher).
• Certificate Manager (certmgr.msc): Views and manages the current user's digital certificates.
• Services (services.msc): Manages services, background processes that provide system functions (Print Spooler, Windows Update, networking) and run whether or not anyone is signed in. Here you start and stop them and set each one's startup type (Automatic, Manual, Disabled).
• Registry Editor (regedit.exe): The Registry is Windows' central, hierarchical database of hardware, system, and application configuration settings and user preferences (user files are not stored there). Edit it only with care, after a backup.
• Disk Cleanup (cleanmgr.exe): Finds and deletes files that can safely go, such as temporary files, Recycle Bin contents, old update files and, under "Clean up system files", all but the most recent restore point, to free disk space. Optimize Drives / Disk Defragment (dfrgui.exe) rewrites a mechanical hard drive's fragmented files into contiguous blocks so the heads seek less (on an SSD it runs TRIM instead); it frees no space and repairs no filesystem errors (that is chkdsk).
• Local Group Policy Editor (gpedit.msc): Not in Home editions. Settings and Control Panel only change an option; a policy enforces it, locking the option (often greyed out) so users cannot change it back - for example, removing access to Control Panel or to personalization options.
• Control Panel / Settings: The main interfaces for user-facing configuration, such as managing user accounts, uninstalling programs (appwiz.cpl), configuring network settings, and personalizing the desktop.

Technician's Action Plan: Scenario: A user complains their PC has become extremely slow over the past week, especially when they first log in. Opening applications takes a very long time.

1. Initial Triage (Task Manager): Open Task Manager. On the Performance tab, check the CPU, Memory, and especially the Disk activity. A disk at 100% utilization for a prolonged period is a common cause of slowness.
2. Identify the Culprit (Task Manager): Switch to the Processes tab and sort by the Disk column to see which application or service is causing the high disk usage. It could be an antivirus scan, a background update, or a malfunctioning application.
3. Address Startup Impact (Task Manager): Go to the Startup tab. Review the list of applications that launch at boot. Disable any unnecessary or low-priority applications with a high "Startup impact" rating to speed up the login process.
4. Deeper Investigation (Event Viewer): If no single process stands out, open Event Viewer. Check the System and Application logs for repeating errors or warnings that coincide with the periods of slowness. For example, a disk-related error might indicate the hard drive is beginning to fail.
5. Formulate a Plan: Based on your findings, form a plan. If a specific application is the cause, try updating or reinstalling it. If startup items are the problem, disabling them is the fix. If Event Viewer points to a failing hard drive, the plan becomes to back up the user's data immediately and schedule a drive replacement.

Reflection Question: When troubleshooting a system that is randomly crashing, why would the Event Viewer be a more valuable tool than the Task Manager?