6.3.2.1. Lab 1: Windows Troubleshooting Tools

6.3.2.1. Lab 1: Windows Troubleshooting Tools (30 minutes)

Objective: Become familiar with Task Manager, Event Viewer, and Resource Monitor.

Setup: Any Windows 10/11 computer (physical or VM)

Steps:

1. Task Manager Deep Dive

   • Open Task Manager (Ctrl+Shift+Esc)
   • Click "More details" if in simple view
   • Go to the Performance tab - observe CPU, Memory, Disk, Network graphs
   • Go to the Processes tab - sort by CPU, then by Memory. Identify the top consumers
   • Go to the Startup tab - note which apps have "High" impact. Disable one non-essential app
   • Question: What's the difference between "Processes" and "Details" tabs?

2. Event Viewer Investigation

   • Open Event Viewer (eventvwr.msc)
   • Navigate to Windows Logs > System
   • Filter by "Error" level events (right-click > Filter Current Log)
   • Find an error and note: Event ID, Source, and Description
   • Navigate to Windows Logs > Application and repeat
   • Question: Where would you look for failed login attempts? (Hint: Security log)

3. Resource Monitor

   • Open Resource Monitor (resmon.exe)
   • Go to the Disk tab - observe which processes are reading/writing
   • Go to the Network tab - observe which processes are using bandwidth
   • Question: How does this differ from Task Manager's Performance tab?

Deliverable: Write a one-paragraph summary of what you found in Event Viewer.