Lesson 3: Windows GUI Tools and Settings

Windows has a lot of administrative tools.

That is not because technicians are supposed to memorize twenty ways to open a console.

Different tools expose different parts of system state.

The useful question is:

What am I trying to prove?

Then choose the smallest tool that can answer it.

Task Manager: what is consuming resources now?

Task Manager provides a fast view of active state.

Useful areas include:

• Processes for running applications and processes;
• Performance for CPU, memory, disk, network, and GPU trends;
• Startup for applications configured to launch with the user/session;
• Users for active sessions;
• Services for service state and related process context.

If a user says "Windows is slow," Task Manager can help answer whether CPU, memory, disk, or one process is under pressure.

It does not automatically tell you why.

Observation first.

Visual reference

See the system before you troubleshoot it

reference sheetCross-Platform Support Surfaces

Event Viewer: what did Windows record over time?

Event Viewer exposes recorded system, application, security, and other events depending on configuration.

A problem may happen while nobody is watching.

Example:

02:00 scheduled task starts
02:01 service crashes
02:02 application reports error

Task Manager at 10:00 may look normal.

The event history preserves the earlier sequence.

Logs are evidence from Windows' point of view. One event is not a verdict.

Disk Management: what storage objects does Windows see?

Disk Management shows disks, partitions, volumes, drive letters, unallocated space, and basic storage state.

Classic case:

firmware: new drive detected
Device Manager: device present
File Explorer: drive missing
Disk Management: disk visible, no mounted usable volume

The drive did not disappear.

The failure is farther up the storage stack.

Device Manager: what hardware and driver state does Windows report?

Device Manager exposes detected hardware and associated driver/device state.

Useful questions:

• Is the device detected?
• Is Windows reporting a driver or device problem?
• Which driver/provider/version is associated with it?
• Did the device disappear entirely?

A warning icon says Windows is reporting a problem.

It does not prove the physical device is dead.

Task Scheduler: what is Windows intentionally launching later?

Task Scheduler exposes scheduled tasks and triggers.

If CPU use spikes every night at exactly 2:00 AM, timing matters.

An approved maintenance task scheduled for 2:00 AM is a much stronger first explanation than "high CPU means malware."

Performance Monitor and Resource Monitor answer different depth questions

Performance Monitor is useful for counters and trends over time.

Resource Monitor gives a detailed live view of CPU, memory, disk, and network activity.

Task Manager may tell you disk activity is high.

Resource Monitor can help identify the process and file activity involved.

Performance Monitor can help show whether the pattern repeats.

System Information establishes the platform baseline

System Information can expose Windows version, hardware/platform information, firmware details, components, and resources.

It is useful before making compatibility claims.

"Looks like a new laptop" is weak evidence for TPM, UEFI, or platform support.

Read the actual state.

System Configuration changes diagnostic startup behavior

System Configuration can expose selected boot and startup diagnostic settings.

Use it deliberately.

Changing service or startup state can create new symptoms.

Do not disable half the system because clean boot sounds like a universal fix.

Know what variable you are isolating.

Certificate Manager exposes trust and identity objects

Certificate Manager can expose user certificate stores and related trust material.

That becomes relevant when certificates are missing, expired, or required by an application or authentication flow.

Do not delete certificates casually.

Trust problems can become much harder after destructive cleanup.

Local Users and Groups exposes local identity structure

On supported editions, Local Users and Groups helps inspect or manage local accounts and group membership.

Membership matters because authorization and privileges may depend on groups.

A user authenticating successfully does not prove they are authorized for a resource.

Group Policy Editor exposes local policy

On supported editions, Group Policy Editor exposes local policy state.

Managed environments may also apply centrally controlled policy.

If a setting returns after policy refresh, the local Settings page may not be the authoritative owner.

Identify the policy source before fighting the symptom.

Registry Editor exposes low-level configuration

Registry Editor is useful when an approved procedure specifically requires registry inspection or change.

It is also easy to damage a system by changing keys without understanding the dependency.

This course uses supplied state or disposable VMs for registry work.

A random registry tweak from a forum is not a support methodology.

Disk Cleanup and drive optimization solve different storage-maintenance problems

Disk Cleanup or current storage-cleanup surfaces help identify removable temporary or system-generated files under supported workflows.

Disk Defragment and Optimize Drives exposes storage optimization behavior.

Do not carry an old rule like "defragment every drive weekly" into modern storage blindly.

Hard drives and solid-state drives have different maintenance behavior. Windows may optimize them differently.

The durable question is:

What storage technology is present, what maintenance action is Windows proposing, and why?

File Explorer Options improve evidence about files

Technicians may enable hidden files and file extensions when the task requires it.

Compare:

report.pdf
report.pdf.exe

If extensions are hidden, the second name can be visually misleading.

Showing extensions improves evidence about file identity.

Power Options can create hardware-looking symptoms

Windows power behavior includes:

• hibernate;
• sleep/suspend/standby;
• power plans;
• lid-close action;
• fast startup;
• USB selective suspend.

A USB device that disappears only after idle time may have a hardware problem.

It may also be affected by power management.

Read the configured policy before replacing the device.

Settings and Control Panel are responsibility surfaces

A+ expects recognition of Windows configuration areas such as:

• Internet Options;
• Devices and Printers;
• Programs and Features;
• Network and Sharing Center;
• System;
• Windows Defender Firewall;
• Mail;
• Sound;
• Device Manager;
• Indexing Options;
• Administrative Tools / Windows Tools;
• Accessibility / Ease of Access;
• Time and Language;
• Update and Security or current Windows Update/security surfaces;
• Personalization;
• Apps;
• Privacy;
• Devices;
• Network and Internet;
• Gaming;
• Accounts.

The exact layout changes between releases.

Do not memorize screen coordinates.

Learn which responsibility belongs to each surface.

Worked case: nightly CPU spike

Evidence:

Task Manager: high CPU around 02:00
Task Scheduler: approved job starts 02:00
Event Viewer: task launch recorded 02:00
Resource use: returns to normal after completion

Strong interpretation:

The recurring CPU spike correlates with the scheduled maintenance task.

Could malware cause high CPU? Yes.

Does this evidence make malware the strongest first explanation? No.

Worked case: drive missing in File Explorer

Evidence:

firmware: detects drive
Device Manager: device present
Disk Management: disk visible, unallocated / no mounted volume
File Explorer: no drive letter

The failure boundary is Windows storage configuration, not physical detection.

Do not replace the SSD because Explorer does not list it.

Build a question-to-tool map

For each support question, identify:

question
GUI tool / Settings surface
evidence expected
state-changing risk
what the result does not prove
next tool only if needed

Include at least Task Manager, Event Viewer, Disk Management, Device Manager, Task Scheduler, Performance Monitor, Resource Monitor, System Information, System Configuration, Certificate Manager, Local Users and Groups, Group Policy, Registry Editor, Disk Cleanup, drive optimization, File Explorer Options, Power Options, Firewall, and Network settings.

Before you move on

Opening every console is not thoroughness.

It is noise.

A good Windows technician chooses the view that exposes the current boundary with the least unnecessary change.

Next we apply the same rule to the command line, where some commands only inspect state and others can erase or reconfigure it.