Wednesday, October 7, 2026

WINDOWS | SEE WHAT YOUR COMPUTER IS ACTUALLY DOING — How Task Manager, Processes, Threads, CPU, Memory, and Services Turn Windows Into a System You Can Investigate



You don't really understand a computer when you

can open applications, browse the web, install software, and change settings.

You understand it when you can look inside the operating system and explain what the computer is doing.

Windows gives you a remarkable place to begin.

Open Task Manager and you can see applications, background processes, CPU usage, memory usage, performance graphs, users, services, and other information about the running system. Microsoft describes Task Manager as a built-in Windows solution for monitoring application and process performance and resource usage.

That makes Task Manager more than a troubleshooting screen.

It is a window into the operating system.

And this is where our practical Windows learning begins.

WINDOWS IS NOT JUST THE DESKTOP

When most people think of Windows, they picture:

  • the Start menu
  • desktop icons
  • folders
  • windows
  • taskbar
  • applications

Those are the visible parts.

Underneath them is a large operating system coordinating:

  • processes
  • threads
  • memory
  • CPU time
  • storage
  • devices
  • networking
  • security
  • services
  • users
  • permissions
  • system resources

Microsoft describes a Windows process as an executing program with its own virtual address space, program modules, environment information, security context, and at least one thread. Threads are the units that Windows schedules for execution on processors.

So instead of thinking:

I opened an app.

start thinking:

I asked Windows to create and manage computational work.

That change in perspective is the beginning of systems thinking.

Your first Windows laboratory: Task Manager

You don't need expensive software to begin.

Windows already provides a useful investigation tool:

Task Manager

Depending on your Windows version, you can open it by:

  • pressing Ctrl + Shift + Esc
  • searching for Task Manager
  • using the Windows taskbar/context menus where available

The exact interface varies between Windows versions, but the underlying data comes from Windows system sources. Microsoft documents Task Manager's major views as including processes and performance information.

Open it.

Don't immediately start terminating things.

Instead, observe.

You're entering the operating system's control room.

WHAT YOU ARE LOOKING AT

The Processes view presents a list of running applications and background processes together with resource information.

You may see columns such as:

  • CPU
  • Memory
  • Disk
  • Network
  • GPU
  • Power usage

The exact columns and grouping can vary by Windows version and configuration.

The important question is not:

“Which number is highest?”

It is:

What does each number represent?

That is how you turn a monitoring tool into a learning tool.

APPLICATIONS VS PROCESSES

Suppose you open a web browser.

You might expect Task Manager to show:

Browser

But modern applications can be composed of multiple processes.

Microsoft gives Microsoft Edge as an example: the browser can have different processes associated with tabs, network and audio services, extensions, and other functionality.

This means:

One visible application ≠ necessarily one process.

That is an important idea.

A modern application may deliberately divide work across processes for reasons involving:

  • stability
  • security
  • isolation
  • architecture
  • performance
  • different responsibilities

So when you see several related processes, don't automatically assume something is wrong.

You may be looking at the application's architecture.

PROCESS: THE RUNNING PROGRAM

Microsoft's simplest description is useful:

A process is an executing program.

But for serious understanding, go deeper.

A Windows process contains an execution environment.

It has things such as:

  • a virtual address space
  • executable code
  • loaded modules
  • system-resource handles
  • security information
  • environment information
  • at least one thread
  • a process identifier

So imagine opening a program.

Windows doesn't merely throw its code onto the CPU.

It establishes an environment in which that program can execute.

PID: THE PROCESS'S IDENTITY

Look at Task Manager's Details view.

You can enable columns that provide additional information.

One important value is the:

PID — Process Identifier

It is an identifier associated with a running process.

For example:

Process          PID
--------------------
example.exe      4280
another.exe      6152
system.exe        900

The number itself isn't important.

The concept is.

Windows needs a way to distinguish one running process from another.

That identity becomes useful when monitoring, troubleshooting, scripting, administration, and programming against the operating system.

THREADS: THE WORK INSIDE THE PROCESS

Now we go one level deeper.

A process contains one or more threads.

A thread is the basic unit Windows schedules for processor execution.

Think of it like this:

APPLICATION
     ↓
PROCESS
     ↓
THREAD
     ↓
CPU

A process provides the environment.

The thread provides the executable flow of work.

This distinction is extremely important.

Your CPU doesn't simply receive:

“Run Chrome.”

It receives executable work associated with threads belonging to processes.

Microsoft's CPU-analysis documentation explicitly states that processes themselves are not directly scheduled onto processors; threads owned by processes are scheduled.

WHY THREADS EXIST

Imagine a program that needs to:

  • respond to your clicks
  • update its interface
  • download data
  • process files
  • perform calculations

If all of that work had to happen through one sequential execution path, the application could become unresponsive whenever one operation took a long time.

Multiple threads can allow different work to proceed concurrently.

Conceptually:

PROCESS
│
├── UI THREAD
├── NETWORK THREAD
├── COMPUTATION THREAD
└── BACKGROUND THREAD

This is simplified; real application architecture can be much more complicated.

And more threads do not automatically mean better performance.

Microsoft explicitly warns that poorly designed multithreaded applications can suffer performance problems.

That is an important lesson:

Concurrency is a capability, not a guarantee of speed.

NOW WATCH THE CPU

Go to:

Task Manager → Performance → CPU

You should see a graph showing processor activity.

You're now looking at the result of the operating system scheduling threads onto processor resources.

Windows uses processor time-sharing because there are generally more runnable threads than available processors. The scheduler determines which threads run and when.

So when the CPU graph rises, don't merely say:

“The CPU is working harder.”

Ask:

Which threads are generating that work?

Then:

Which processes own those threads?

Now you're investigating rather than guessing.

MULTITASKING IS AN ILLUSION—AND SOMETIMES REAL

Suppose your computer has several programs open.

It appears that everything is running simultaneously.

On a single processor, the operating system rapidly switches between runnable threads, creating the appearance of simultaneous activity.

On a multiprocessor system, multiple threads really can execute simultaneously across available processors.

So modern multitasking combines two ideas:

Time-sharing

and

Parallel execution

The operating system coordinates both.

CONTEXT SWITCHING

Suppose Thread A is executing.

Windows needs Thread B to run.

The system has to preserve enough of Thread A's execution state and restore the state needed for Thread B.

That transition is a:

Context switch

Microsoft describes context switching as part of Windows processor scheduling.

You can think of it like changing workers at a workstation.

The system needs to preserve:

“Where was this worker in the job?”

and restore:

“Where was the other worker when they last stopped?”

Context switching is necessary.

But it also has overhead.

This is one reason why simply creating huge numbers of threads is not a magic performance strategy.

LOOK AT LOGICAL PROCESSORS

Go back to:

Task Manager → Performance → CPU

Depending on your Windows version, you can change the graph to show Logical processors.

Microsoft specifically recommends this view when you want to see how processor load is distributed.

You may see something like:

CPU 0   ███████████████████
CPU 1   ███
CPU 2   ████
CPU 3   ███
CPU 4   ██
CPU 5   ███
CPU 6   ██
CPU 7   ███

This tells a much richer story than one overall CPU percentage.

One workload may be heavily concentrated on one logical processor.

Another may distribute work across many.

That difference can explain why adding more cores doesn't necessarily make every program proportionally faster.

A REAL INVESTIGATION

Now do this yourself if you have a Windows computer available.

Open Task Manager.

Step 1 — Find the busiest process

Go to Processes.

Click the CPU column to sort by CPU consumption.

Microsoft recommends this approach when investigating high CPU usage.

Don't kill the process.

Identify it.

Ask:

What application or service is this?

Step 2 — Observe before deciding

If CPU usage is high, wait.

Does it remain high?

Or does it drop?

A temporary spike can be normal. Microsoft distinguishes temporary CPU spikes from sustained high utilization when troubleshooting performance.

This teaches you an important diagnostic principle:

A measurement is evidence, not automatically a diagnosis.

Step 3 — Open the Performance view

Look at CPU utilization.

Then look at the logical processors if your system provides that option.

Ask:

Is the workload distributed or concentrated?

Step 4 — Look at memory

Go to:

Performance → Memory

Now you're connecting today's lesson to the virtual-memory lesson we just studied.

The process uses a virtual address space.

Its pages can be resident in physical memory.

Windows reports memory-related information through Task Manager and other performance tools.

Now you can start connecting:

PROCESS → MEMORY → CPU

rather than studying those concepts separately.

GO DEEPER: DETAILS VIEW

Return to:

Task Manager → Details

This is where Windows begins to look less like a consumer interface and more like an operating-system administration tool.

You can inspect processes individually.

You can add columns.

Microsoft notes that Task Manager allows columns to be added in its Details view, including information such as thread counts.

Now you can begin asking questions such as:

  • What is this process?
  • What is its PID?
  • How much CPU is it using?
  • How much memory?
  • How many threads?
  • Which user owns it?
  • Is it a system process?
  • Is it associated with an application?
  • Why is it running?

These are the beginnings of Windows administration and troubleshooting.

SERVICES ARE DIFFERENT FROM ORDINARY APPLICATIONS

Open:

Task Manager → Services

Services are background components designed to perform functions without necessarily requiring a visible application window.

Examples can include components involved in:

  • networking
  • updates
  • security
  • printing
  • device support
  • system functionality

Do not randomly disable services.

A service can be part of another application or part of Windows itself.

Instead, learn to identify and understand them first.

This is a recurring principle in systems administration:

Understand before changing.

FROM TASK MANAGER TO REAL WINDOWS ADMINISTRATION

Task Manager is only the beginning.

Windows provides a much larger collection of administrative and diagnostic tools.

You will eventually encounter tools such as:

  • Resource Monitor
  • Performance Monitor
  • Event Viewer
  • Services
  • Device Manager
  • Computer Management
  • PowerShell
  • Command Prompt
  • Windows Terminal
  • Registry Editor
  • System Configuration
  • Task Scheduler
  • Windows Security
  • Sysinternals

These are not random utilities.

Together, they provide different windows into the operating system.

And this is why Windows deserves to be taught as a platform, not merely as something you click.

YOUR NEXT TOOL: RESOURCE MONITOR

Windows also includes Resource Monitor.

Microsoft's troubleshooting guidance recommends Resource Monitor as another way to inspect CPU consumption and system activity.

You can launch it by searching for:

Resource Monitor

or by using:

resmon

Resource Monitor takes you deeper into system activity.

This is where you'll begin seeing relationships between resources rather than simply seeing an application list.

AND THEN: PROCESS MONITOR

When you are ready to go deeper, Microsoft Sysinternals provides Process Monitor, commonly called Procmon.

This is a major step up from Task Manager.

Microsoft describes Process Monitor as an advanced Windows monitoring tool that shows real-time:

  • file-system activity
  • Registry activity
  • process activity
  • thread activity

It also provides detailed event information and filtering.

This is the sort of tool that lets you ask questions such as:

What exactly is this process doing?

rather than merely:

How much CPU is it using?

That distinction is enormous.

WINDOWS IS BECOMING A LAB

Notice what just happened.

We started with:

CPU

Then connected it to:

Processes

Then:

Threads

Then:

Task Manager

Then:

Memory

Then:

Services

Then:

Resource Monitor

Then:

Process Monitor

This is the kind of learning path we will use for substantial platforms.

We are not memorizing Windows features.

We are using Windows to understand computer systems.

THE WINDOWS MENTAL MODEL

Keep this model:

                         WINDOWS
                            │
       ┌────────────────────┼────────────────────┐
       │                    │                    │
   PROCESSES             MEMORY               SERVICES
       │                    │                    │
    THREADS           VIRTUAL MEMORY       BACKGROUND WORK
       │                    │
       └──────────────┬─────┘
                      │
                   CPU / I/O
                      │
             PHYSICAL HARDWARE

And around all of it:

security + users + permissions + drivers + networking + storage

Windows is therefore not just a graphical interface.

It is an operating environment coordinating software and hardware.

WHY THIS CHANGES HOW YOU USE A COMPUTER

Suppose someone tells you:

“Your computer is slow.”

Before learning this material, you might recommend:

“Buy more RAM.”

Now you can investigate.

Maybe:

  • one process is consuming CPU;
  • one thread is dominating execution;
  • memory pressure is high;
  • storage is saturated;
  • an application is waiting for I/O;
  • a background service is doing heavy work;
  • the workload is poorly parallelized;
  • a driver is misbehaving;
  • or the machine is simply handling a demanding workload normally.

You don't have to guess.

You can investigate.

That is the capability we are building.

A SMALL WINDOWS SYSTEMS PROJECT

Here's your first practical Windows project.

Project: Build a Computer Performance Investigation Habit

Whenever your Windows computer feels unusually slow:

1. Open Task Manager.

2. Check CPU.

Ask:

What process is consuming the CPU?

3. Check Memory.

Ask:

Is memory usage unusually high?

4. Check Disk.

Ask:

Is storage activity unusually high?

5. Check Network.

Ask:

Is network activity related to what I am doing?

6. Check the process.

Ask:

What exactly is this process?

7. Observe for several moments.

Ask:

Is this sustained or temporary?

8. Investigate before changing anything.

That last step is the most important.

You are developing a professional troubleshooting habit:

OBSERVE → IDENTIFY → MEASURE → HYPOTHESIZE → TEST → VERIFY

WHERE THIS WINDOWS CHAPTER IS GOING

This is only Chapter 1.

We have established Windows as a real computing platform and used Task Manager as our first laboratory.

The deeper Windows path can progressively take you through:

Chapter 1

SEE WHAT YOUR COMPUTER IS ACTUALLY DOING

Processes, threads, CPU, memory, Task Manager and system observation.

Chapter 2

UNDERSTAND WINDOWS PROCESSES AND SERVICES

Process architecture, services, startup behavior, users, sessions and system/background processes.

Chapter 3

MASTER WINDOWS MEMORY

Virtual memory, working sets, page faults, memory pressure, allocation and memory diagnostics.

Chapter 4

INVESTIGATE WINDOWS PERFORMANCE

CPU, disk, memory, network, bottlenecks, Resource Monitor and Performance Monitor.

Chapter 5

UNDERSTAND WINDOWS FILES AND STORAGE

File systems, paths, volumes, partitions, permissions, storage performance and disk management.

Chapter 6

CONTROL WINDOWS FROM THE COMMAND LINE

Command Prompt, Windows Terminal, PowerShell and command-line administration.

Chapter 7

UNDERSTAND WINDOWS SECURITY

Accounts, permissions, UAC, credentials, Defender, isolation and security boundaries.

Chapter 8

MANAGE WINDOWS SERVICES AND TASKS

Services, scheduled tasks, startup systems and background automation.

Chapter 9

DIAGNOSE WINDOWS WITH SYSINTERNALS

Process Explorer, Process Monitor, Autoruns and other advanced investigation tools.

Chapter 10

AUTOMATE WINDOWS ADMINISTRATION

PowerShell, scripts, system information, process management and repeatable administration.

Chapter 11

BUILD WINDOWS TROUBLESHOOTING CAPABILITY

Turn observations, measurements and system evidence into systematic diagnoses.

Chapter 12

TURN WINDOWS KNOWLEDGE INTO PRACTICAL VALUE

System administration, technical support, troubleshooting, automation, maintenance and other legitimate service capabilities.

That is what it means to teach a platform as a platform.

We are not waiting until some distant point in the curriculum to start using Windows.

Windows has now become a real learning environment.

And the same principle will apply to other major platforms as their subjects naturally arise.

What you should be able to do now

After this chapter, you should be able to open Windows Task Manager and look at a running computer differently.

You should be able to distinguish:

Application → Process → Thread → CPU

and begin connecting that to:

Process → Virtual Memory → Physical RAM

You should also understand that Task Manager is not merely a place to “end task.”

It is an observation instrument.

Use it to see the system before you try to change the system.

That is the beginning of learning Windows as a computing platform—and the beginning of learning how to investigate computers rather than merely operate them. 


Image: LifeWire 

at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)