Chapter 14
Performance and power management
“I feel the need, the need for speed.” That was the memorable line uttered by Tom Cruise’s character, Lieutenant Pete “Maverick” Mitchell, in the movie Top Gun. It’s also the guiding principle for many longtime Windows aficionados.
It’s true that raw speed can improve your productivity, especially for activities like editing and converting massive video files, which can take minutes on a high-powered workstation but can drag on for an hour or more on a low-end laptop. A speedy PC can even make life a bit more fun after the workday is over. Just ask any serious gamer how much time they’ve spent obsessing over frame rates.
But here’s the reality: Most of the time, Windows is an innocent bystander when it comes to making things go fast. The out-of-the-box performance of a PC running Windows 11 should be acceptable, assuming that the hardware you’re using is capable of the work you’re asking it to perform. A budget laptop with a low-power mobile processor will almost certainly struggle at a CPU-intensive task like video rendering, for example. But even a workstation-class PC can perform poorly if you have a problem with a major subsystem or if Windows is configured incorrectly.
Like its predecessors, Windows 11 offers two valuable tools for monitoring the performance of your system in real time: Task Manager and Resource Monitor. Task Manager has been a mainstay of Windows through many versions. As discussed in Chapter 5, “Installing and configuring apps,” you can use it for terminating recalcitrant processes and disabling unwanted startup programs. Task Manager also includes valuable performance-monitoring tools (more on that later in this chapter). To help zero in on performance issues with even more detail, you can use an advanced tool called Resource Monitor. In combination, these tools help you to keep an eye on CPU, memory, disk activity, and network usage.
What causes performance problems?
When people complain that their Windows PC is sluggish, they’re usually expressing frustration over having to wait unexpectedly. If a task is taking an unusually long time to complete, the cause of that poor performance is most likely one of the following factors (in no particular order):
Inadequate hardware resources Microsoft’s high compatibility requirements for Windows 11 PCs should ensure that baseline performance is acceptable. But more demanding tasks, such as digital media encoding, can push some systems to the breaking point. The performance-monitoring tools described in this chapter should help you identify areas where hardware resources are being overstressed.
Defective hardware Memory and disk errors are most obvious when they cause system crashes, but hardware-related problems can also cause performance to drag. Check with your hardware manufacturer to see what diagnostic tools are available.
Outdated or flawed device drivers PC and device makers are responsible for supplying drivers for the individual hardware components that go into their hardware. If you do a clean install, Windows might install a generic driver instead of one written specifically for that device. Many performance problems vanish immediately after a simple driver upgrade. (Don’t assume that a newer driver is automatically better than an older one, however; any driver update has the potential to cause new problems.)
Out-of-control processes or services Sometimes, a program or background task that normally runs just fine will spin out of control, consuming up to 100 percent of CPU time or grabbing increasing amounts of memory or other system resources. Of course, performance of all other tasks slows down or grinds to a halt. Knowing how to identify and kill this sort of process or service and prevent it from recurring is a valuable troubleshooting skill.
Malware Viruses, Trojan-horse programs, spyware, and other forms of unwanted software can wreak havoc on system performance. Be sure to check for the possibility that malware is present on a system that exhibits otherwise unexplained performance problems.
It would be wonderful if one could simply open Registry Editor, create a new DWORD value called MakeEverythingGoFaster, set its value to 1, and automatically send a system into overdrive. Alas, the most reliable strategy for optimal performance is far less magical: Use quality hardware, make sure all devices have correct and up-to-date drivers, have plenty of memory on board, maintain enough free disk space to allow for a large paging file, have a speedy internet connection, and keep your system abreast of enhancements and security fixes delivered via Windows Update.
Several of these measures are discussed elsewhere in this book. See, for example, Chapter 13, “Managing hardware and devices.” This chapter focuses on diagnosis, introducing tools that you can use to gather information about your system and identify any performance bottlenecks that might be present. It concludes with the subject of power management.
Viewing details about your system
For answers to basic questions about your operating system and computer, there’s no better place to start than the built-in system information tools, which display basic system details: the current Windows edition; processor type and installed memory; details about the computer name and network membership (domain or workgroup); and the current activation status.
Windows 11 offers multiple versions of this information. On a tablet or touchscreen-enabled system, you’ll probably use the Settings app. Open Settings > System > About to display details like those shown in Figure 14-1.
Figure 14-1 Go to Settings > System > About to display a page like this one, which includes basic details about the local PC along with the option to change its name.
A (slightly) faster way to get to the About page in Settings is via the Quick Link menu: Right-click Start (or press Windows key+X) and then click System. If File Explorer is open, you can reach the same destination by right-clicking This PC and clicking Properties. Regardless of how you get there, you’ll find useful information about the device and the current Windows installation. A copy button alongside either heading allows you to capture those details and paste them into an email or messaging app for support purposes.
For the most exhaustive inventory of system configuration details in a no-frills text format, Windows offers three tools that provide varying levels of technical information: System Information, Systeminfo, and a collection of PowerShell commandlets for Windows Management Instrumentation. We describe these tools in the following sections.
System Information
System Information—often called by the name of its executable, Msinfo32.exe—is a techie’s paradise. It displays a wealth of configuration information in a simple tree-and-details arrangement, as shown in Figure 14-2. You can search for specific information, save information, view information about other computers, and even view a list of changes to your system.
Figure 14-2 System Information is for viewing configuration information only; you can’t use it to configure settings.
To start System Information, begin typing system information in the search box or type msinfo32 at a command prompt.
You navigate through System Information much as you would through File Explorer: Click a category in the left pane to view its contents in the right pane. To search for specific information, use the Find What box at the bottom of the System Information window. (If the Find bar is not visible, press Ctrl+F, or click Edit and then clear the check box next to Hide Find.)
The Find feature is basic but effective. Here are a couple of things you should know:
Whenever you type in the Find What box to start a new search, Find begins its search at the top of the search range (which is the entire namespace unless you select Search Selected Category Only)—not at the current highlight.
Selecting Search Category Names Only causes the Find feature to look only in the left pane. When this check box is cleared, the text in both panes is searched.
Using the System Information tool, you can preserve your configuration information—which can be helpful when reconstructing a system—in several ways:
Save the details as a System Information (.nfo) file. You can view your saved information by opening the file using System Information on the same computer or on a different computer. To save information in this format, click File, Save. Saving this way always saves the entire collection of information.
Save all or part of the information as a plain-text file. To save information as a text file, select the category of interest and click File, Export. To save all the information as a text file, select System Summary before you export it.
You can print all or part of the information. Select the category of interest; click File, Print; and be sure that Selection is selected under Page Range. To print everything, select All under Page Range—and be sure to have lots of paper on hand. Depending on your system configuration and the number of installed applications, your report could top 100 pages. (Even better, consider “printing” to PDF and saving the results.)
Regardless of how you save your information, System Information refreshes (updates) the information immediately before processing the command.
Systeminfo
Systeminfo.exe is a command-line utility that displays information about your Windows version, BIOS, processor, memory, network configuration, and a few more esoteric items. Figure 14-3 shows sample output.
Figure 14-3 The command-line utility Systeminfo.exe provides an easy way to gather information about all your network computers in a single database.
To run Systeminfo, open a Command Prompt or PowerShell window, type systeminfo, and then press Enter. In addition to the list format shown in Figure 14-3, Systeminfo offers two formats that are useful if you want to work with the information in another program: Table (fixed-width columns) and CSV (comma-separated values). To use one of these formats, append the /fo switch to the command, along with the Table or Csv parameter. You also need to redirect the output to a file. For example, to store comma-delimited information in a file named Info.csv, enter the following command:
systeminfo /fo csv > info.csvUsing the /S switch, you can get system information about another computer on your network. (If your username and password don’t match that of an account on the target computer, you also need to use the /U and /P switches to provide the username and password of an authorized account.) When you’ve gathered information about all the computers on your network, you can import the file you created into a spreadsheet or database program for tracking and analysis. The following command appends information about a computer named Bates to the original file you created:
systeminfo /s Bates /fo csv >> info.csvWindows Management Instrumentation tools
Windows Management Instrumentation (WMI) is Microsoft’s comprehensive infrastructure for automating administrative tasks on servers and desktop computers running Windows. WMI uses the Common Information Model (CIM), an industry standard developed and maintained by the Distributed Management Task Force (DMTF), to help gather details about hardware, system configuration details, user accounts, and other management information on enterprise networks.
WMI commands can be scripted and are commonly used to collect information for use by enterprise management utilities, including System Center Operations Manager and Windows Remote Management. But WMI can also be used for basic management tasks on a single PC.
IT pros who’ve worked with Windows for long enough are probably familiar with the WMI Command-Line Utility, better known by the name of its executable, Wmic.exe. That utility is still available in Windows 11, although it’s officially deprecated in favor of native WMI cmdlets for use with PowerShell.
Type wmic at a command prompt, and the utility runs in console mode, wherein you can enter commands and view output interactively. Alternatively, you can add global switches or aliases, which constrain the type of output you’re looking for, and see the output in a Command Prompt window or redirect it to a file. For example, use the following command to produce a neatly formatted HTML file:
wmic qfe list brief /format:htable > %temp%\hotfix.html(Note that this command won’t work in a PowerShell session because PowerShell doesn’t recognize the %temp% variable.)
You can then open that file in a web browser to see a list of all installed updates on the current system. To see the full syntax for Wmic, open a Command Prompt window and type wmic /?. Official documentation for how to use this tool, including a list of aliases, verbs, switches, and commands, is at https://bit.ly/wmic-syntax.
For more information on PowerShell WMI cmdlets, see https://bit.ly/powershell-wmi.
Monitoring performance with Task Manager
When you need to analyze system performance, Task Manager’s Performance page is without peer. It gives you a quick overview of your system’s performance in real time, measured in multiple dimensions. The details and charts shown on the Performance page offer a continuously updated snapshot of CPU, GPU, memory, disk, and network usage, while the Processes page displays details about resource usage on a per-process basis. Together, these two displays can help you very quickly figure out why your system is performing more slowly than it should.
For details about Task Manager’s other essential functions, see “Managing programs and processes with Task Manager,” in Chapter 5, “Installing and configuring apps.”
To open Task Manager, use any of the following techniques:
Press Ctrl+Shift+Esc.
Right-click Start (or press Windows key+X) and then click Task Manager on the Quick Link menu.
Press Ctrl+Alt+Delete and then click Task Manager.
Figure 14-4 shows Task Manager’s Performance page as it appears on a PC running Windows 11 version 22H2, with icons that provide access to different pages running in a vertical column along the left side and a Settings menu option in the lower-left corner. (In Windows 11 version 21H2 and all versions of Windows 10, this information is arranged using tabs that run across the top of the Task Manager window, although the display of performance information is essentially identical in both versions.)
Figure 14-4 The Performance page of Task Manager gives you a big-picture view of resource usage.
It’s worth noting that the display shown here is from a fairly powerful Windows workstation: Each disk, network connection, and GPU gets its own page, complete with thumbnail graph; this arrangement allows you to monitor disk speeds on internal and external drives, for example, and to distinguish the performance of a discrete GPU from that of an integrated graphics processor.
The small thumbnail graphs at the left report current data in real time; clicking any of these thumbnails displays a more detailed page to its right, with a much larger version of the same graph and additional information below the graph.
Each graph shows 60 seconds’ worth of data, with updates at one-second intervals. In Figure 14-4, shown earlier, for example, the CPU graph shows a large spike caused by opening a graphics-intensive app, followed by several smaller spikes as other activities make demands on the CPU.
If that once-per-second sampling rate doesn’t provide the information you need, feel free to change it. Click the Settings icon in the lower-left corner of Task Manager and change the value under the Real Time Update Speed setting from its default, Normal, to High (updates every half-second) or Low (every four seconds). You can also click Paused if you want to study the most recent data without having it scroll off the graph to the left.
Here are some additional tweaks you can make to Task Manager when viewing the Performance page:
Double-click any thumbnail (or right-click a thumbnail and choose Summary View) to hide the full page and just show the pane of thumbnails. To return to normal view, double-click any thumbnail again, or use the right-click menu to clear the check box next to Summary View.
From that same right-click menu, choose Hide Graphs to show a data-only summary; right-click and choose Show Graphs to restore the performance thumbnails.
Double-click the large graph on the current page to display it in the Graph Summary View, which uses the full Task Manager window while hiding the thumbnail charts and additional data. Double-click the graph again to return to the normal display of performance data.
Click the See More menu (the three dots in the upper-right corner) and choose Copy to make a summary of data from the current page available on the Windows Clipboard.
As we discuss shortly, each page on the Performance page offers specific information about resource usage by the selected device or subsystem. But before we get to those details, let’s switch to the Processes page for a slightly different take on overall system performance.
The default view of the Processes page groups all running processes into three types: Apps, Background Processes, and Windows Processes. Figure 14-5 shows this page in action.
Figure 14-5 The Processes page of Task Manager allows you to look more closely at resource usage on a per-app basis.
In this default view, every process has its own entry; some apps group multiple processes under a single entry that can be expanded or collapsed. To the right of each entry, you can view resource usage for that process or group of processes, with values organized under four columns by default: CPU, Memory, Disk, and Network. Color coding highlights values that are using a higher-than-average share of the resource in that column.
The column headings on the Processes page summarize what percentage of that resource is in use by the system as a whole. To discover which apps or processes are using the most resources in that category, click the column heading. That action ungroups the processes and then sorts them in descending order by usage.
One feature that’s new in Windows 11 version 22H2 is an indicator for apps that are running in Efficiency Mode, which is Microsoft’s feature for tuning apps so that they’re power efficient and use fewer resources when running in the background. A leaf icon under the Status column means one or more processes in a group are running in Efficiency Mode; expand the group to see details for each process.
You can manually turn on Efficiency Mode for some apps (but not for core Windows processes) by selecting the app in the Processes pane and then clicking the Efficiency Mode button in the upper-right corner. Doing so reduces the base priority of the process to Low and sets the Quality of Service (QoS) mode to EcoQoS. Collectively, these settings reduce power usage and prevent background apps from interfering with higher-priority processes, such as an app you’re currently using in the foreground.
The remainder of this section examines individual pages on the Performance page, with details about what you can learn from each one.
CPU
Displaying the CPU details on the Performance page in Task Manager shows some basic information about your CPU. In the upper-right corner, above the performance graph, you can see the full name of the processor and its base speed. In the lower right, below the graph, are technical details about the processor, including the number of cores and logical processors, whether virtualization is enabled, and how much memory on the CPU is devoted to various caches (L1, L2, and L3).
Below the CPU graph, on the left, you can see total CPU utilization as well as the current CPU speed, which might be higher than the base speed shown elsewhere. This region also enumerates the number of processes, threads, and handles currently in use. Larger numbers mean a greater workload for the system; whether a given load is too much is something you can judge only after long-term monitoring.
By keeping this pane open as you work, you can see what the impact of a given activity is. For example, you might monitor CPU usage when encoding a video file to see whether the operation pins CPU usage at 100 percent; if so, that might be evidence that you need to consider upgrading your PC to one with a more powerful CPU and/or GPU that’s capable of doing the same work faster, generating less heat and allowing you to do other things while the task completes in the background.
Memory
Clicking the Memory thumbnail on Task Manager’s Performance page displays a snapshot of memory usage, as shown in Figure 14-6. Note that the total amount of memory available to this system—64 GB—is visible in the upper-right corner above the graph. Details about the physical memory itself (number of sticks and slots, for example) are shown below, alongside the amount of RAM in use and the amount available.
Figure 14-6 Use the Memory option on the Performance page to see how much of your system’s RAM is in use. If the value is at 100 percent, it’s time to close some apps to improve performance.
On this page, a detailed Memory Composition bar chart appears below the main graph. At first glance, it appears to be just an alternative view of the main Memory Usage chart, but hover the mouse pointer over any segment to see its real purpose. The ScreenTips that appear over each segment explain what each one represents, as shown in Figure 14-7.
Figure 14-7 Use the Memory Composition bar chart for a detailed look at memory usage.
There’s a fair amount of technical detail on the Memory page. Collectively, it offers a detailed picture of the total virtual address space, which includes physical memory and the paging file, which is one of the most misunderstood subsystems in Windows.
The paging file allows Windows to commit more memory for use by processes than is physically available. That magic happens via the Windows memory management subsystem, which maps memory into pages (each page is 4 KB in size on an x86 PC) and then maps those pages to physical memory while backing them up to the paging file, which is stored by default on the system disk.
The detailed information that appears at the bottom of the page when you choose the Memory option on Task Manager’s Performance page help explain how the paging file works:
In Use (Compressed) This value represents the amount of physical memory that is currently allocated to running processes, including Windows itself, drivers, and apps. Some of the code in those pages is compressed, allowing Windows to make more efficient use of scarce physical memory.
Available This value is the amount of physical RAM minus the amount currently in use.
Committed When a new Windows process starts, it reserves a block of memory for its own use. Committed RAM represents pages that have been allocated for that process. Those pages might be in physical RAM or in the paging file. The first number represents the total of all memory in use; the second is the Commit Size Limit, which is the sum of physical RAM and virtual memory available in the paging file.
Hardware reserved This total, which appears in the lower-right corner, includes hardware drivers that must remain in physical memory at all times and are not available to the memory manager. If you see two values in the upper right, above the Memory graph, the small total is calculated by subtracting this amount from the total physical RAM.
Cached This group represents pages that were previously used by an app or system process but are no longer in use. They remain in physical memory in case they are needed again, but can be moved to the paging file, freeing up the physical RAM, if necessary.
Two other values are shown on this page. The paged pool and non-paged pool represent memory used by the Windows kernel; the paged pool represents pages of memory that can be written to disk (paged) when no longer in use. The non-paged pool represents data that must remain in physical memory at all times and cannot be written to disk.
(For a full discussion of Windows memory management, see the documentation in the Windows Dev Center at https://bit.ly/windows-memory-management. Its discussion of virtual versus physical memory is especially useful. In addition, this long article by a community member, Sushovon Sinha, includes details that apply to both Windows 10 and Windows 11 memory management: https://bit.ly/physical-virtual-memory.)
Disk
The Disk details display, in graphic terms, the performance of all disks on the current system that are marked as nonremovable. (That excludes USB flash drives and SD cards but includes external hard drives and SSDs connected to a high-speed USB or Thunderbolt port, which are technically removable but are treated as if they’re fixed.)
Each disk gets its own entry on the left side of the Performance page, with details about the selected disk’s performance on the right, as shown in Figure 14-8. The top graph depicts the percentage of time the disk is busy processing read or write requests; the bottom graph shows the disk transfer rate.
Figure 14-8 The Disk options in Task Manager let you see the throughput of a fixed disk and determine whether a particular activity is causing a bottleneck.
The information below the Disk graph provides some details about the physical disk it represents, including the total capacity and formatted capacity, whether the disk is in use as a system disk, and whether it contains a paging file. The Read Speed and Write Speed measurements, in conjunction with the data on the smaller Disk Transfer chart, can help you determine the actual transfer speed of a disk and spot any issues with disk throughput.
Network
Each active network connection gets its own graph on Task Manager’s Performance page, showing network throughput for that connection. Figure 14-9 shows an example of a wired network connection in action.
Figure 14-9 This sort of variability in network performance is common and reflects the complexity of managing network connections.
This graph illustrates the performance of a wired network connection while downloading several large files from OneDrive. Although it’s not obvious at first glance, there are actually two separate lines: one for the speed at which data is being received from the other end of the network connection, and the other for the speed at which data is being sent. In the example shown here, the Send activity is working at a tiny fraction of the speed of the download, making its line so small as to be nearly invisible.
The Send and Receive values are displayed below the graph and change in real time with each sampling interval. It’s also worth noting that the scale of the graph changes with network activity, making it possible to see performance data even when network activity is using less than its full bandwidth.
Data below the graph shows some useful details of the current connection, including IPv4 and IPv6 addresses; for wireless connections, this block also shows the SSID name, signal strength, and which Wi-Fi standard is in use.
One well-hidden summary of networking activity is also available from this page. Right-click the graph and choose View Network Details to open a dialog that shows a table with cumulative data for all available network connections in the current session.
GPU
Performance details for graphics processing units (GPUs) are displayed in a collection of graphs that are noticeably more complex than the other subsystems on the Performance page. Figure 14-10 illustrates the full set for a discrete graphics adapter on a Windows 11 notebook.
Figure 14-10 Performance details for a GPU are mostly of interest to gamers and video professsionals trying to squeeze maximum performance out of a discrete graphics adapter.
The four graphs at the top measure the speed of rendering 3D graphics, copying data between video buffers, and encoding and decoding compressed video. The two lower graphs measure usage of dedicated GPU memory, which is installed on the video hardware itself, and shared video memory, which is allocated by Windows from the main pool of RAM used by Windows and apps.
As with the other details on the Performance page, this one includes information below the graph showing details about the video hardware in use, the driver version, and (particularly important when gaming or performing GPU-intensive rendering activities) the temperature of the GPU.
Using Resource Monitor to pinpoint performance problems
Like the Performance page in Task Manager, Resource Monitor gives you both instantaneous and recent-history readouts of key performance metrics. Also like Task Manager, Resource Monitor can show you, in excruciating detail, what each process is doing.
To open Resource Monitor, you can search for it from the Start menu or use its command line, perfmon /res, from a Command Prompt window. But the fastest way is to click its link on Task Manager’s Performance page. (In the original release of Windows 11, version 21H2, that link is at the bottom of the tab; in version 22H2, it’s hidden under the See More menu—the three dots to the right of the Run New Task button in the upper-right corner.) This option offers a natural way to investigate performance issues: Start with a quick glance at Task Manager’s Performance page and then, if you need more information, call on Resource Monitor.
Resource Monitor organizes information using tabs. The Overview tab provides charts that offer a visual snapshot of performance in real time in four areas: CPU, disk, network, and memory. Matching tables display details on a per-process basis for each of these four areas. (Unlike Task Manager, Resource Monitor doesn’t provide performance details for GPUs.) Figure 14-11 shows this tab in action, with two of the four detail tables collapsed and displaying only a summary heading.
Figure 14-11 The default view in Resource Monitor shows results for all processes. If any details are truncated, hover the mouse pointer over the item to see a ScreenTip showing its details.
Using the tabs along the top of the Resource Monitor window, you can switch to a different context and focus on a specific type of resource usage. The basic layout of each tab is similar and consists of a handful of common elements.
One or more tables contain details about the resource featured on that tab. The first table on each tab is called the key table; it contains a list of all processes currently using the selected resource, with a check box to the left of each process. The key table at the top of the Overview tab lists all running processes in a display that is similar to the Processes page in Task Manager.
Selecting one or more processes from the key table filters the data displayed in the tables that appear below it, showing only activity associated with that process. An orange heading appears at the top of each detail table, noting that the data display is filtered, and an additional orange line appears in the graphs on the right to show how much of that resource is in use by the selected process. Figure 14-12 shows the Resource Monitor Disk tab with the Windows Defender process (Msmpeng.exe) selected.
Figure 14-12 Selecting a process from the list at the top of the Resource Monitor window filters its output in the pane below.
The CPU, Disk, and Network tabs work in similar fashion, offering additional details mainly of use to programmers. (The Memory tab shows a map of current memory usage, without regard to the processes selected in the key table.)
Resource Monitor is overkill for most performance troubleshooting tasks. But it shines when you want to see exactly which process or file is responsible for an unexplained burst of activity. It’s also invaluable for tracking down the name and location of a specific file that Windows is using with a particular process and action.
Managing services
A service is a specialized program that performs a function to support other programs. Many services operate at a low level (by interacting directly with hardware, for example) and need to run even when no user is signed in. Windows manages services using a special system process called the Service Control Manager (Services.exe, also known as SCM). The SCM is run by the System account (which has elevated privileges) rather than by ordinary user accounts. This section covers how to view installed services; start, stop, and configure them; and install or remove them. We also take a closer look at some services used in Windows 11 and show you how to configure them to your advantage.
For the most complete view of services running on your computer, use the Services console. You can also view running services and perform limited management functions by using Task Manager. This section covers both tools.
Using the Services console
You manage services with the Services snap-in (Services.msc) for Microsoft Management Console, shown in Figure 14-13. To view this snap-in, type services in the search box and then click the Services app at the top of the results list. (You must have administrator privileges to gain full functionality in the Services console. Running it as a standard user, you can view service settings, but you can’t start or stop most services, change the startup type, or make any other configuration changes.)
Figure 14-13 Use the Services console to start, stop, and configure services.
The Extended and Standard views in the Services console (selectable by clicking a tab near the bottom of the window) have a single difference: The Extended view provides descriptive information of the selected service in the space at the left edge of the details pane. This space also sometimes includes links for starting, stopping, or pausing the selected service. Unless you need to constrain the console display to a small area of your screen, you’ll probably find the Extended view preferable to the Standard view.
The Services console offers plenty of information in its clean display. You can sort the contents of any column by clicking the column title, as you can with similar lists. To sort in reverse order, click the column title again. In addition, you can do the following:
Start, stop, pause, resume, or restart the selected service, as described in the following section.
Display the properties dialog for the selected service, in which you can configure the service and learn more about it.
Most essential services are set to start automatically when your computer starts, and the operating system stops them as part of its shutdown process. A handful of services that aren’t typically used at startup are set with the Automatic (Delayed Start) option, which starts the associated service after the rest of startup completes, making the startup process smoother. The Trigger Start option allows Windows to run or stop a service as needed in response to specific events; the File History service, for example, doesn’t run unless you enable the File History feature.
But sometimes you might need to manually start or stop a service. For example, you might want to start a seldom-used service on the rare occasion when you need it. (Because running services requires system resources such as memory, running them only when necessary can improve performance.) On the other hand, you might want to stop a service because you’re no longer using it. A more common reason for stopping a service is because it isn’t working properly. For example, if print jobs get stuck in the print queue, sometimes the best remedy is to stop and then restart the Print Spooler service.
Starting and stopping services
Not all services allow you to change their status. Some prevent stopping and starting altogether, whereas others permit stopping and starting but not pausing and resuming. Some services allow these permissions to only certain users or groups. For example, most services allow only members of the Administrators group to start or stop them. Which status changes are allowed and who has permission to make them are controlled by each service’s discretionary access control list (DACL), which is established when the service is created on a computer.
To change a service’s status, select it in the Services console. Then click the appropriate link in the area to the left of the service list (if you’re using the Extended view and the link you need appears there). Alternatively, you can use the Start/Stop/Pause/Restart controls on the toolbar or right-click and use the corresponding command.
You can also change a service’s status by opening its properties dialog and then clicking one of the buttons on the General tab. Taking the extra step of opening the properties dialog to set the status has only one advantage: You can specify start parameters when you start a service by using this method. This is a rare requirement.
Configuring services
To review or modify the way a service starts up or what happens when it doesn’t start properly, view its properties dialog. To do that, double-click the service in the Services console. Figure 14-14 shows an example.
Figure 14-14 Specify a service’s startup type on the General tab, where you can also find the actual name of the service (in this case, BTAGService) above its display name.
Setting startup options
On the General tab of the properties dialog (shown earlier in Figure 14-14), you specify the startup type:
Automatic The service starts when the computer starts.
Automatic (Delayed Start) The service starts after other auto-start services (plus a short delay) to improve startup performance and user experience. The SCM starts services configured using this option one at a time, honoring dependencies.
Manual The service doesn’t start automatically at startup, but it can be started by a user, program, or dependent service.
Disabled The service can’t be started.
The Trigger Start option cannot be configured manually from the Services console. Instead, you have to use SC (Sc.exe), a command-line program that communicates with the SCM. If you’d rather not tinker with the arcane syntax of this command, try the free Service Trigger Editor, available from Core Technologies Consulting, at https://bit.ly/servicetriggereditor.
Other startup options are on the Log On tab of the properties dialog, as shown in Figure 14-15. In general, there’s no reason to modify the settings shown here.
Figure 14-15 Settings shown on the Log On tab specify which user account runs the service.
Note
If you specify a sign-in account other than the Local System account, be sure that account has the requisite rights. Go to the Local Security Policy console (at a command prompt, type secpol.msc), and then go to Security Settings\Local Policies\User Rights Assignment and assign the Log On As A Service right to the account. This option is rarely necessary for services that are part of Windows, and a third-party app that requires this type of configuration typically does so as part of the installation process.
Specifying recovery actions
For various reasons—hardware not operating properly or a network connection being down, for example—a service that’s running smoothly might suddenly stop. By using settings on the Recovery tab of the properties dialog, you can specify what happens if a service fails. Figure 14-16, for example, shows the default settings for the Bluetooth Audio Gateway service.
Figure 14-16 Use the Recovery tab to specify what happens if a service fails.
You might want to attempt one recovery action the first time a service fails and then perform a different action on the second or subsequent failures. The Recovery tab enables you to assign a particular response to the first failure, the second failure, and all subsequent failures, from among these options:
Take No Action The service gives up trying. In most cases, the service places a message in the event log. (Use of the event log depends on how the service was programmed by its developers.)
Restart The Service The computer waits for the time specified in the Restart Service After box to elapse and then tries to start the service.
Run A Program The computer runs the program you specify in the Run Program box. For example, you could specify a program that attempts to resolve the problem or one that alerts you to the situation.
Restart The Computer Drastic but effective, this option restarts the computer after the time specified in the Restart Computer Options dialog elapses. In that dialog, you can also specify a message to be broadcast to other users on your network, warning them of the impending shutdown.
Viewing dependencies
Many services rely on the functions of another service. If you attempt to start a service that depends on other services, Windows first starts the others. If you stop a service upon which others are dependent, Windows also stops those services. Before you either start or stop a service, therefore, it’s helpful to know what other services your action might affect. To obtain that information, go to the Dependencies tab of a service’s properties dialog, as in the example shown in Figure 14-17.
Figure 14-17 The Dependencies tab shows which services depend on other services or drivers.
The outline controls in the Dependencies tab can be expanded to show dependents of the dependents.
Managing services from Task Manager
Using the Services page in Task Manager, you can start and stop services and view several important aspects of the services, both running and available, on your computer. You can also use this page as a shortcut to the Services console.
The Services page is shown in Figure 14-18.
Figure 14-18 By sorting on the Group column, you can see groups of related services together.
To start, stop, or restart a service, right-click its name on the Services page and then click Start, Stop, or Restart.
Using the Services page, you can also associate a running service with its process identifier (PID) and then further associate that PID with other programs and services being run under that PID. For example, the list of services in Figure 14-18, shown earlier, includes multiple services running with PID 1280. Right-clicking any of those services and then clicking Go To Details opens the Details page in Task Manager with the particular process (typically, Svchost.exe) highlighted.
Determining the name of a service
As you view the properties dialog for different services, you might notice that the service name (shown at the top of the General tab) is often different from the name that appears in the Services console (the display name) and that neither name matches the name of the service’s executable file. (Many services run as part of a service group, typically under a Host Process for Windows Services, Svchost.exe.) The General tab (shown earlier in Figure 14-14) shows all three names.
So how does this affect you? When you work in the Services console, you don’t need to know anything other than a service’s display name to find it and work with it. But if you use the Net or Sc command to start and stop services from a Command Prompt window, you might find using the actual service name more convenient; it’s often much shorter than the display name. You also need the service name if you’re ever forced to work with a service’s registry entries, which can be found in the HKLM\System\CurrentControlSet\Services\service subkey (where service is the service name).
And what about the executable name? You might need it if you have problems running a service; in such a case, you need to find the executable and check its permissions. Knowing the executable name can also be useful, for example, if you’re using Task Manager to determine why your computer seems to be running slowly. Although the Processes page and the Services page show the display name (under the Description heading), because of the window size, it’s sometimes easier to find the more succinct executable name.
Managing battery life on portable PCs
The modern portable PC is packed with feats of hardware engineering wizardry, miniaturizing powerful components to previously unheard-of sizes. On the software side, similar efforts have been successful in coaxing ever more battery life out of those designs. The upshot is you can now take a Windows PC on the road and do work that is nearly identical to what you can accomplish back at the office.
All that computing power comes at a price in battery life, however. And finding the right balance depends on what you’re trying to accomplish. Sometimes you want the full power of your PC, especially if you’re trying to accomplish a resource-intensive task on a tight schedule and you know that you’ll be back within range of AC power well before your battery is in danger of running out of juice. Under other circumstances, when the workload is light and you know it will be many hours before you’ll be able to recharge your device, you want to make that battery last as long as possible. Anything you do to extend the battery life of a portable device helps you avoid having to quit working because your battery gave up the ghost.
Being able to accomplish either goal requires mastering one essential skill first: the ability to quickly assess how much power capacity remains in the current session.
For a quick estimate of remaining battery life, hover the mouse pointer over the battery icon in the notification area. After a second or two, you should see a message with the remaining battery life, expressed as a percentage. (On a portable PC with more than one battery, such as the Surface Book line from Microsoft, each battery gets its own percentage, beneath an overall percentage that estimates the remaining battery life overall.)
If Windows has enough data to take a guess at how much time you’ll be able to continue working on the remaining battery power, you see that estimate as well. When the laptop is plugged into a charger, this display shows an estimate of the amount of time before the battery is fully charged.
In Windows 10, clicking the battery icon opens a flyout menu with detailed information about remaining power. In Windows 11, clicking the battery icon opens the Quick Settings menu, with the percentage of remaining battery at the bottom left. Click that value to open the Power & Battery page in Settings, where you see a much more detailed report, similar to the one shown in Figure 14-19.
Figure 14-19 This page in Settings offers a snapshot of recent battery usage, along with controls for helping to extend battery life for the current session.
The abbreviated bar chart to the right of the current battery status gives a snapshot of power usage over the past 24 hours, with each bar representing one hour’s power consumption (or charging). A yellow leaf icon over a bar means the device was in Battery Saver mode during that period. A green power plug icon means it was plugged in.
For much more detail about battery usage, click View Detailed Info, which takes you to the Battery Levels section at the bottom of the page. After running your portable PC on battery power for at least 24 hours, this section contains details similar to those shown in Figure 14-20.
Figure 14-20 After running your portable PC on battery power over the course of a full day or week, you can see which apps are most responsible for using the battery.
By default, the bar chart shown here displays the same data as in the smaller chart at the top of the page, but it gives you two crucial options for filtering that data.
Use the options on the menu to the right of the Battery Levels heading to toggle the scale of activity between 24 Hours and 1 Week; the values returned show activity on a per-app basis for all times during the selected period when your device was running on battery power.
In addition to that filter, you can use the Sort By menu to change the display of per-app usage information from Overall Usage (the default) to show only apps that are currently in use or those that are running in the background. You can also sort the list by name.
No matter how you slice it, that’s pretty powerful diagnostic information. Used properly, it can help you diagnose which apps are most responsible for draining your PC’s battery. Armed with that information, you can either choose not to use those apps when power saving is high on the agenda, or you can look for configuration changes in the apps at the top of the list (such as restricting background usage) to help reduce their hunger for power.
Battery Saver and other power management options
The Power & Battery page also includes some additional controls that allow you to change the way in which Windows uses the battery during the current session. From the Power & Battery page in Settings, you can use the Power Mode menu to choose one of three options: On systems running the original release of Windows 11, Balanced is the default; if you want to shift the performance-battery ratio, select Best Performance or Best Power Efficiency.
In Windows 10, this option was implemented as a slider control accessible from the taskbar. On PCs running Windows 11, the option moves to Settings. (On some PCs, these options appear in a slightly different fashion: Recommended, Better Performance, and Best Performance.)
What’s the difference? The most important change is the way the operating system throttles background apps, reducing their performance (and preserving battery life) at a slight cost to overall system performance.
Windows 11 also offers a Battery Saver feature, whose settings are available on the same page in Settings. While Battery Saver is on, Windows automatically adjusts the following settings:
The Mail, People, and Calendar apps no longer sync automatically.
Most apps that normally run in the background are blocked from doing so. OneDrive, for example, sends a notification that it has temporarily stopped syncing local changes to the cloud. You can override this action by clicking the Sync Anyway button.
Display brightness (one of the biggest factors in battery usage) is reduced by 30 percent. Hardware manufacturers can change this default setting, and you can override it using the Lower Screen Brightness While In Battery Saver check box.
All noncritical telemetry uploads are blocked.
All noncritical downloads from Windows Update are blocked.
While Battery Saver is enabled, Windows displays an overlay of a leaf on the battery icon in the taskbar, in Settings, and in the Battery flyout menu.
By default, Windows 11 automatically turns on Battery Saver when remaining battery life falls below 20 percent. Use the Battery Saver options on the Power & Battery page in Settings to change that threshold to a round percentage between 10 and 50; choose Always to make Battery Saver mode the default, or choose Never to continue running at your chosen power mode until you reach the Low or Critical battery level.
To adjust those settings, you need to use the old-style Power Options in Control Panel. In Settings, type Edit Power Plan in the search box. Click the resulting option and then click Change Advanced Power Settings; finally, expand the Battery heading to see the options to specify the Low and Critical battery levels. At those two settings, you can ask Windows to show a notification or perform an action. For example, you might ask to see a notification when remaining battery level drops to 10 percent and have Windows automatically hibernate when it reaches 5 percent.
Monitoring long-term battery life and capacity
Over time, if you’re paying attention, you develop an instinctive sense for how long your battery will last and when you should begin looking in earnest for a power outlet. Windows 11 allows you to generate a battery report that gives you a more precise measurement of your battery’s history. The report also allows you to observe the decline in battery capacity that inevitably occurs over time. To generate a battery report, open a Command Prompt or PowerShell window and run the command powercfg /batteryreport. That action generates a file in the current folder called Battery-report.html; double-click that file to view the report in a browser window.
That report provides a wealth of information about the current system and its battery health. The Installed Batteries section, for example, lists the manufacturer’s name and serial number of the battery; it also displays how many power cycles the battery has undergone and lists its current Full Charge Capacity compared to its Design Charge Capacity. Calculating the ratio of those two numbers tells you how much battery life your system has lost over time.
The Battery Life Estimates section shows how much Windows estimates your battery life to be for each recent session, based on observed battery use measurements; an average value appears at the bottom of the list.
Configuring power options from the command line
If your work entails managing power settings for multiple systems and users, you’ll find the powercfg command-line utility invaluable. With powercfg, you can query and set power schemes and parameters, export power settings to a file, import the file on remote systems, and more. (Many powercfg actions work only in an elevated Command Prompt or PowerShell window.) Even if your concerns are only with your own systems, you might find powercfg /batteryreport, powercfg /energy, and powercfg /sleepstudy useful. These commands generate reports that are not available via the interactive power-management features described earlier in this section.
To generate a list of commands available with powercfg, open a Command Prompt or PowerShell window and type powercfg /?. For syntax details and usage examples of any powercfg command, type powercfg /? command.
Power management on desktop systems
Even when your PC isn’t dependent on a battery, paying attention to power management has benefits. Allowing a PC or tablet to sleep or hibernate cuts the amount of power it consumes, which translates into monetary savings for you and a benefit for society at large.
The most obvious of these settings are available in Settings > System > Power & Battery, under the Screen And Sleep heading. The options here specify the amount of idle time before the screen goes dark and the amount of time before the system goes to a lower-power setting called sleep. On a portable computer, there are separate settings that apply when running on battery power and when plugged in, as shown in Figure 14-21. (On desktop PCs, there are only two options to choose from.)
Figure 14-21 On this page, you can minimize the amount of power a computer uses even when it’s plugged into AC power full time.
For each option, the choices in the drop-down menu range from 1 minute (probably more annoying than most people will accept) to 5 hours (useful if you want the computer to sleep only when you’re away for a long time). To disable either option, choose Never from the drop-down menu.