Windows Task Manager: Processes, Services, Users, and Details Tabs Explained

Task Manager is the built-in Windows utility for viewing and controlling what is running right now: applications and background processes, service states, per-user sessions, and live CPU, memory, disk, and network usage. Open it with Ctrl+Shift+Esc, by right-clicking the taskbar or Start button, or by running taskmgr. Each tab has a specific job — and just as important for troubleshooting, specific things it cannot do, which is where technicians get tested.

The tabs at a glance

Windows 10 and 11 Task Manager organizes into these tabs (Windows 11 moved them to a left-hand rail, same functions):

• Processes — friendly, grouped view of apps and background processes with per-process CPU, memory, disk, network, and GPU columns. The everyday “what is eating this machine” view.
• Performance — live graphs for CPU, memory, disk, Wi-Fi/Ethernet, and GPU; also shows uptime, slot usage, and link speed.
• App history — cumulative resource usage over time, primarily for Store/UWP apps.
• Startup apps — enable or disable programs that launch at sign-in, with a measured “startup impact.” (This replaced the old msconfig Startup tab — see msconfig, Clean Boot, and Safe Mode.)
• Users — every signed-in user session and the resources each consumes, with per-session actions.
• Details — the raw process list: every process by executable name and PID (process identifier), with fine-grained controls.
• Services — all installed services and their running/stopped state, with basic start/stop control.

Services tab: what it can and can’t do

The Services tab lists each service’s name, PID, description, status, and group. Right-click a service and you can Start, Stop, or Restart it — enough for a quick bounce of a stuck service.

What it cannot do is change how a service behaves at boot. Startup type (Automatic, Automatic (Delayed Start), Manual, Disabled) is not exposed anywhere in Task Manager. To change it, use the Services console: the link at the bottom of the tab (“Open Services”) or run services.msc, then open the service’s Properties and set the Startup type dropdown. So if a stopped service needs to start automatically at every boot, the workflow is: notice it in Task Manager, but make the actual change in services.msc — a step that comes up constantly when repairing Windows Update after a malware infection. Knowing which tool owns which setting is exactly the discrimination the exam wants.

Users tab: disconnect vs sign off

On a machine — or a shared server accessed over RDP (Remote Desktop Protocol) — with multiple user sessions, the Users tab shows each session and its resource footprint. Expanding a user reveals the processes running in that session. Two right-click actions look similar and behave very differently:

Action	Session state	Running programs	When to use
Disconnect	Session detaches but stays alive on the machine	Keep running; user can reconnect and resume	User stepping away briefly; freeing the console/display without losing work
Sign off	Session is terminated	Forcibly closed; unsaved work lost	Reclaiming all session resources; stuck or abandoned sessions

Disconnect is the gentle option: the user’s applications continue running server-side, and reconnecting later restores the desktop exactly as left. Sign off (log off) ends everything in the session. An administrator who wants to tidy up a session without destroying the user’s open programs chooses Disconnect; choosing Sign off in that situation is the classic wrong answer because it deletes the very work the user wanted preserved.

Details tab: surgical process control

The Details tab is the power-user view — one row per process, identified by image name and PID. This matters because modern applications are rarely a single process. Browsers are the textbook case: one parent broker process spawns a child process per tab or per site. In the Processes tab these appear as one grouped entry; in Details you see each child individually with its own PID.

That granularity enables surgical fixes. If one browser tab is frozen but five others are fine, you do not end the parent process or use End process tree — either would take down every tab. Instead, identify the specific frozen child process (match its PID or resource signature — a hung child often shows abnormal or zero CPU with high memory) and use End task on that single process. The parent and the other children keep running, and the browser typically just reports that one tab crashed.

Other right-click tools on Details worth knowing:

• Set priority — adjusts how the scheduler ranks the process for CPU time (Realtime down to Low). Temporary; resets when the process restarts.
• Set affinity — restricts a process to specific logical processors. Uncheck cores, and Windows will schedule that process only on the ones left checked.
• Analyze wait chain — shows what a hung process is waiting on.
• Open file location / Properties — quick legitimacy checks on a suspicious executable before escalating to malware removal.

Affinity is the answer to a specific recurring problem: a legacy single-threaded application hammering CPU and starving other software on a many-core workstation. Pinning it to, say, two of the eight logical processors via Set affinity contains its impact without modifying, reconfiguring, or replacing the application. Like priority, affinity set here does not persist across process restarts — fine for diagnosis and containment, but note it for the user if they need it long-term.

How the 220-1202 exam tests this

Task Manager questions sit in the heavily weighted Operating Systems domain — the full 220-1202 study guide shows how the domains break down, and practice-question sets return to this tool constantly.

• A scenario where a technician must change a service’s startup type and the Services tab can’t do it — the expected next step is opening services.msc.
• An RDP/multi-user scenario asking how to free session resources while preserving the user’s running programs — Disconnect, not Sign off.
• A frozen-browser-tab scenario testing whether you kill the single child process from Details rather than the parent or the process tree.
• A legacy single-threaded app monopolizing CPU, asking which Task Manager feature limits it to specific logical processors — Set affinity (with Set priority as the distractor).

Quick reference

• Open Task Manager: Ctrl+Shift+Esc, right-click taskbar/Start, or run taskmgr.
• Services tab: start/stop/restart only — startup type lives in services.msc.
• Users tab: Disconnect keeps the session’s programs alive; Sign off terminates them.
• Details tab shows every process with its PID — end a single frozen child process, not the parent, to save the rest of the app.
• Set affinity = which logical processors a process may use; Set priority = how urgently it gets CPU time. Neither persists after the process restarts.
• Startup programs are managed on Task Manager’s Startup apps tab, not msconfig, on Windows 10/11.
• Processes tab groups related processes for readability; Details ungroups them for control.