Windows Task Manager: Complete Guide to Processes, Performance, and Startup

Task Manager is one of the most frequently opened tools on any Windows machine, yet most users only scratch the surface of what it can do. For IT professionals and power users, Task Manager is a first-response diagnostic tool. This guide covers every tab in the Windows 11 Task Manager, explains what the data means, and shows how to act on it.

Opening Task Manager

There are multiple ways to open Task Manager:

Ctrl + Shift + Esc — Opens Task Manager directly. Fastest method.
Ctrl + Alt + Delete — Opens the security screen, then select Task Manager.
Right-click the taskbar — Select Task Manager.
Win + X — Open the Power User menu, then select Task Manager.
Run taskmgr from the Run dialog or PowerShell.

The Processes Tab

The Processes tab shows all running applications and background processes grouped by type: Apps, Background processes, and Windows processes. For each process, you can see CPU, memory, disk, network, and GPU usage in real time.

Key actions on this tab:

End Task — Right-click a process and select End Task to forcibly terminate it. Use this for frozen applications.
Go to Details — Jumps to the Details tab, which shows the underlying executable name, PID, CPU time, and description.
Open File Location — Opens Explorer at the location of the executable. Useful for identifying suspicious processes.
Search online — Opens a Bing search for the process name. Quick way to identify unfamiliar processes.

The Performance Tab

The Performance tab displays real-time graphs for each hardware resource. Click a resource in the left panel to see its detailed view:

CPU

Utilisation — Percentage of total CPU capacity being used.
Speed — Current clock speed. May show lower than base speed if the CPU is throttling due to heat.
Processes, Threads, Handles — Baseline counts. A sudden spike in handle count can indicate a handle leak.
Cores and Logical processors — Shows the physical/logical core count. Useful for verifying hyperthreading status.

Memory

In Use — RAM currently allocated by processes.
Available — RAM that can be immediately assigned to new processes.
Committed — Total virtual memory committed (RAM + page file).
Cached — Memory used for file system cache. Windows reclaims this for processes on demand.
Speed and Slots Used — RAM speed and how many DIMM slots are populated.

Disk

Shows read and write throughput plus active time percentage. If active time is consistently at 100%, the disk is a bottleneck. This is common on older spinning hard drives under load. Check whether this is sequential or random I/O using Resource Monitor (click Open Resource Monitor at the bottom of the Performance tab).

GPU

Windows 10 version 1709 and later include GPU monitoring in Task Manager. You can see utilisation split by engine type: 3D, Copy, Video Decode, and Video Encode. This helps identify whether a slowdown is due to general GPU load or a specific workload like video processing.

The App History Tab

Shows cumulative CPU time and network usage for UWP (Universal Windows Platform) apps since the last reset. Less useful in enterprise environments where line-of-business applications are traditional Win32 apps, but helpful for identifying background UWP app resource consumption.

The Startup Apps Tab

This tab lists every application configured to start with Windows for the current user. The Startup Impact column (Low, Medium, High, Not Measured) is calculated from CPU and disk activity during boot. To disable a startup item, right-click it and select Disable.

For IT: Task Manager only shows per-user startup entries (HKCU Run key and the user's Startup folder). To manage machine-wide startup entries and services, use Autoruns from Sysinternals — it provides a far more comprehensive view.

# List all startup programs via PowerShell
Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location, User

# Disable a specific startup entry from the registry
Remove-ItemProperty -Path "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun" -Name "OneDrive"

The Users Tab

Shows all users with active sessions on the machine. On a shared workstation or Remote Desktop server, this is invaluable. You can expand each user to see their processes, and right-click a user to disconnect, log off, or send them a message.

The Details Tab

The Details tab is the power user view. Right-click the column headers to add additional columns:

PID — Process ID. Use this to correlate with netstat output or event logs.
CPU Time — Total CPU time consumed since the process started. High CPU time in a long-running process may indicate a performance problem.
Handles and Threads — High handle counts can indicate resource leaks.
Command Line — Shows the full command line used to launch the process. Invaluable for identifying suspicious processes that spoof legitimate process names.

The Services Tab

Lists all Windows services with their current status (Running, Stopped). You can start, stop, or restart a service by right-clicking. Click Open Services at the bottom to go to the full Services snap-in for detailed configuration.

For IT: to manage services from the command line:

# List all running services
Get-Service | Where-Object Status -eq Running

# Restart a specific service
Restart-Service -Name "Spooler" -Force

# Stop and disable a service
Stop-Service -Name "WSearch"
Set-Service -Name "WSearch" -StartupType Disabled

When to Use Resource Monitor Instead

Task Manager provides a useful overview, but for deep diagnostics, open Resource Monitor (resmon.exe). It shows per-process disk I/O by file, network connections with remote addresses, and memory working sets. When Task Manager tells you a process is using a lot of disk, Resource Monitor tells you exactly which files it is reading or writing.