How to read Windows Task Manager: essential processes
Summoning the Task Manager (Ctrl + Alt + Delete, then clicking on the Task Manager option) is one of the first steps in many Windows troubleshooting guides. The next step, in most cases, is to kill this or that task, or shut down an app that’s gone unresponsive. What exactly should be switched off is usually obvious, so the whole process doesn’t take much time. Right-click > End task > enjoy the computer’s performance back to normal.
But what are all those lines and names above and below the task you’re ending? If you’ve ever had this question and thus far couldn’t be bothered to look for an answer, read on: this post is a concise and fairly comprehensive account of the essential Windows processes that you, as a Windows user, should know about.
Windows Task Manager: overview
Typically, Windows Task Manager has several sections:
- Apps. This section lists programs you have launched, one way or another. Usually, whatever’s in here is easily recognizable.
- Background processes. Things can look trickier in this one: some processes you can attribute to a piece of software installed in the system, like those of antivirus suites and cloud storage services, and some are puzzling. Not to worry: if everything’s fine with your computer, you don’t have to pay them much attention.
- Windows processes. This section gives a glimpse of what’s going on under the hood when you’re working or playing on your computer.
Essential Windows processes in Task Manager
It’s good to know what processes in the Windows section of the Task Manager’s table underpin the system.
- Service Host (svchost.exe). This is a host process that enables services running from DLL files instead of EXE files. Do not worry if there are many of those in the table, it’s normal.
- Local Security Authority Subsystem Service (lsass.exe). This one is enforcing security policies in the system, from user authentication through password changes to access token generation.
- Client Server Runtime Process (csrss.exe). This process handles critical Windows subsystems that manage user interface.
- Windows Logon Application (winlogon.exe). As the name implies, it is a gatekeeper that manages logins, logouts, and loads user profiles.
- Windows Explorer (explorer.exe). The name actually doesn’t cover everything this process handles: it’s not only the Explorer but also the desktop, taskbar, and Start menu that are governed by it.
- Desktop Window Manager (dwm.exe). This is a separate process for desktop that manages visual effects like window transparency, taskbar thumbnails, and high-resolution themes.
- Task Host (taskhostw.exe). In addition to enabling operation from DLLs (like the svchost.exe), this one also triggers scheduled tasks and handles Windows services that need to run dynamically.
- Windows Defender Antivirus Service (MsMpEng.exe). The name of this process is self-explanatory: it manages Windows Defender, the basic protection provided by Microsoft as part of the deal (more on the topic: Cybersecurity for the masses: best practices and tools)
- Windows Update Service (wuauclt.exe / usoclient.exe). These processes check for and install Windows updates, if any.
As you understand, none of the processes listed above should be ended forcefully, unless there’s a very valid reason to. The rule of thumb in such matters is to look up what the process does (if it’s not on this list), and then decide whether you can kill it or not.
In case you’d like to spend some time tinkering with your Windows on a more intimate level, here’s a collection of system optimization tools that could help you in this endeavor:
