Windows Administration Tools

Week of 2026-12-01 · Download .docx

Objectives

Use Task Manager, Event Viewer, and msconfig for system administration
Manage Windows Registry hives and understand their scope
Configure services and update deployment with Services.msc and WSUS

Key terms

Ctrl+Shift+Esc: Direct keyboard shortcut to open Task Manager immediately.
Event Viewer: eventvwr.msc — reads System, Application, and Security event logs.
msconfig: System Configuration — manages startup programs and boot options including Safe Boot.
Disk Management: diskmgmt.msc — creates, formats, and manages disk partitions graphically.
HKLM: HKEY_LOCAL_MACHINE — registry hive storing machine-wide settings for all users.
HKCU: HKEY_CURRENT_USER — registry hive storing settings for the currently logged-in user.
Services.msc: Windows Services console for starting, stopping, and configuring background services.
Resource Monitor: resmon.exe — detailed per-process CPU, memory, disk, and network usage.
WSUS: Windows Server Update Services — centralizes Windows update approval and deployment.
Performance Monitor: perfmon.exe — records system metrics over time in configurable data collector sets.
regedit: Windows Registry Editor — direct editing of the registry; back up before changes.
sfc /scannow: System File Checker — must run elevated; repairs corrupted Windows system files.

The concept

TASK MANAGER AND RESOURCE MONITOR

Ctrl+Shift+Esc opens Task Manager directly. Ctrl+Alt+Delete opens the Windows security screen first. Task Manager's Performance tab shows real-time CPU, memory, disk, and network graphs. Its Startup tab shows which programs launch at login and their startup impact score. For deeper per-process analysis, Resource Monitor (resmon.exe) shows disk I/O operations by file name, network connections with remote IPs, and memory handles for each process — essential for diagnosing resource hogs.

EVENT VIEWER

Event Viewer organizes Windows logs by category. The System log records OS events like service failures and hardware errors. The Application log captures application crashes, including the faulting module and exception code. The Security log records login attempts, policy changes, and access events when auditing is enabled. When troubleshooting, filter by Error and Critical levels in the relevant log and correlate timestamps with when the problem occurred.

THE WINDOWS REGISTRY

The registry is a hierarchical database of configuration settings. HKEY_LOCAL_MACHINE (HKLM) stores machine-wide settings applying to all users — hardware, installed software, and system configuration. HKEY_CURRENT_USER (HKCU) stores per-user settings like application preferences and desktop configuration. Always back up a registry key (File → Export) before editing. Incorrect changes can prevent Windows from booting.

SERVICES AND UPDATES

Services.msc lists all registered Windows services. Each service can be started, stopped, or set to Automatic, Manual, or Disabled startup type. WSUS (Windows Server Update Services) downloads updates from Microsoft once and distributes them to all enterprise clients, allowing IT to approve updates, defer problematic ones, and maintain consistent patch levels across hundreds of machines without each device downloading individually.

Worked examples

Example 1: A user's PC has become slow over time. Diagnostic approach: open Resource Monitor and check the CPU, Memory, and Disk tabs. Identify any process with consistently high disk I/O or memory usage. If a service is using excessive CPU, open Services.msc to check its description and consider whether it is necessary. Check the Startup tab in Task Manager and disable high-impact unnecessary startup programs.

Example 2: An admin needs to prevent Windows from updating automatically on 200 workstations during production hours. Solution: deploy WSUS. Configure clients to point to the WSUS server via Group Policy. In WSUS console, configure automatic approval for security updates only; require manual approval for feature updates. Schedule deployment to run outside business hours.

Common mistakes

Editing the registry without exporting a backup first — a mistake can prevent Windows from booting.
Confusing HKLM (all users, machine-wide) with HKCU (current user only).
Using Task Manager when Resource Monitor is needed — Task Manager's process view lacks disk I/O and network details.
Confusing Services.msc (service configuration) with msconfig (boot and startup) — both manage startup behavior but differently.
Assuming WSUS manages all software updates — WSUS handles Windows and Microsoft product updates; app store apps are separate.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. Task Manager is opened quickly with:

Ctrl+Shift+Esc
Ctrl+Alt+Delete only
Win+R
Win+X

2. Event Viewer is used to:

View system, application, and security logs
Monitor real-time CPU
Manage startup programs
Edit the registry

3. HKLM (HKEY_LOCAL_MACHINE) stores:

Machine-wide settings for all users
Settings for the current user only
Temporary session data
Application crash logs

4. Services.msc allows you to:

Start, stop, disable, and configure Windows background services
Manage user accounts
Edit firewall rules
Configure disk encryption

5. WSUS allows IT admins to:

Centrally manage and approve Windows updates
Auto-update all Store apps
Block all updates permanently
Update network device firmware

Self-check answers

1. A — Ctrl+Shift+Esc opens Task Manager directly; Ctrl+Alt+Delete requires a second click.
2. A — Event Viewer reads Windows event logs for root cause analysis.
3. A — HKLM contains system-wide configuration applying to all users on the machine.
4. A — Services.msc is the Windows Services console for managing background service state and startup type.
5. A — WSUS centralizes update approval and deployment for Windows endpoints across an organization.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top