Windows Administration Tools

Lesson 12 · Windows Administration Tools · Download .docx

Objectives

Use Task Manager, Event Viewer, and msconfig for system administration
Manage Windows Registry hives and understand their scope
Configure services and update deployment with Services.msc and WSUS

Key terms

Ctrl+Shift+Esc: Direct keyboard shortcut to open Task Manager immediately.
Event Viewer: eventvwr.msc — reads System, Application, and Security event logs.
msconfig: System Configuration — manages startup programs and boot options including Safe Boot.
Disk Management: diskmgmt.msc — creates, formats, and manages disk partitions graphically.
HKLM: HKEY_LOCAL_MACHINE — registry hive storing machine-wide settings for all users.
HKCU: HKEY_CURRENT_USER — registry hive storing settings for the currently logged-in user.
Services.msc: Windows Services console for starting, stopping, and configuring background services.
Resource Monitor: resmon.exe — detailed per-process CPU, memory, disk, and network usage.
WSUS: Windows Server Update Services — centralizes Windows update approval and deployment.
Performance Monitor: perfmon.exe — records system metrics over time in configurable data collector sets.
regedit: Windows Registry Editor — direct editing of the registry; back up before changes.
sfc /scannow: System File Checker — must run elevated; repairs corrupted Windows system files.

The concept

TASK MANAGER AND RESOURCE MONITOR

Ctrl+Shift+Esc opens Task Manager directly. Ctrl+Alt+Delete opens the Windows security screen first. Task Manager's Performance tab shows real-time CPU, memory, disk, and network graphs. Its Startup tab shows which programs launch at login and their startup impact score. For deeper per-process analysis, Resource Monitor (resmon.exe) shows disk I/O operations by file name, network connections with remote IPs, and memory handles for each process — essential for diagnosing resource hogs.

EVENT VIEWER

Event Viewer organizes Windows logs by category. The System log records OS events like service failures and hardware errors. The Application log captures application crashes, including the faulting module and exception code. The Security log records login attempts, policy changes, and access events when auditing is enabled. When troubleshooting, filter by Error and Critical levels in the relevant log and correlate timestamps with when the problem occurred.

THE WINDOWS REGISTRY

The registry is a hierarchical database of configuration settings. HKEY_LOCAL_MACHINE (HKLM) stores machine-wide settings applying to all users — hardware, installed software, and system configuration. HKEY_CURRENT_USER (HKCU) stores per-user settings like application preferences and desktop configuration. Always back up a registry key (File → Export) before editing. Incorrect changes can prevent Windows from booting.

SERVICES AND UPDATES

Services.msc lists all registered Windows services. Each service can be started, stopped, or set to Automatic, Manual, or Disabled startup type. WSUS (Windows Server Update Services) downloads updates from Microsoft once and distributes them to all enterprise clients, allowing IT to approve updates, defer problematic ones, and maintain consistent patch levels across hundreds of machines without each device downloading individually.

Worked examples

Example 1: A user's PC has become slow over time. Diagnostic approach: open Resource Monitor and check the CPU, Memory, and Disk tabs. Identify any process with consistently high disk I/O or memory usage. If a service is using excessive CPU, open Services.msc to check its description and consider whether it is necessary. Check the Startup tab in Task Manager and disable high-impact unnecessary startup programs.

Example 2: An admin needs to prevent Windows from updating automatically on 200 workstations during production hours. Solution: deploy WSUS. Configure clients to point to the WSUS server via Group Policy. In WSUS console, configure automatic approval for security updates only; require manual approval for feature updates. Schedule deployment to run outside business hours.

Common mistakes

Editing the registry without exporting a backup first — a mistake can prevent Windows from booting.
Confusing HKLM (all users, machine-wide) with HKCU (current user only).
Using Task Manager when Resource Monitor is needed — Task Manager's process view lacks disk I/O and network details.
Confusing Services.msc (service configuration) with msconfig (boot and startup) — both manage startup behavior but differently.
Assuming WSUS manages all software updates — WSUS handles Windows and Microsoft product updates; app store apps are separate.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. Task Manager is opened quickly with:

2. Event Viewer is used to:

3. HKLM (HKEY_LOCAL_MACHINE) stores:

4. Services.msc allows you to:

5. WSUS allows IT admins to:

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top