Windows Essentials

Windows editions

A Windows edition is a variant of the same Windows version with a different set of features and license terms. Every Windows 11 edition runs on the same code; the edition, set by the product key or license, decides which features are switched on. For a technician the edition matters because it answers questions like "can this laptop join the domain?" before you try.

Home is for consumers; Pro adds what a small business needs; Enterprise adds advanced security and management features for large organizations; Education is the Enterprise feature set for schools. Maximum memory also differs: Home supports up to 128 GB of RAM (random access memory), Pro up to 2 TB. Pro for Workstations is Pro for high-end hardware: up to 6 TB of RAM and four processor sockets, and support for the Resilient File System (ReFS).

Windows 10 had the same editions. It reached end of support on October 14, 2025, so new installations should be Windows 11.

Upgrading an edition

Moving from Home to Pro does not need a reinstall. Under Settings > System > Activation, Upgrade your edition of Windows lets you enter a Pro product key or buy an upgrade; Windows unlocks the extra features after a restart, and files and apps stay. Organizations move Pro devices to Enterprise the same way, often automatically through a Microsoft 365 subscription. Going down (Pro to Home) is not an in-place change; it needs a clean installation.

Settings and Control Panel

Windows has two places for configuration. Settings (Win+I) is the modern app, organized in categories: System, Bluetooth & devices, Network & internet, Personalization, Apps, Accounts, Time & language, Gaming, Accessibility, Privacy & security and Windows Update. The Control Panel is the older configuration interface, made of separate applets, that Windows still includes for settings that have not moved to Settings yet. Start it with Win+R and control.

Microsoft has been moving options from Control Panel into Settings for years, one release at a time, and many Control Panel links now open the matching Settings page. At the time of writing, a technician still regularly uses these Control Panel applets, most of which also start directly by their file name:

When you cannot find a setting in either place, type its name in the Start menu search: it searches both.

File Explorer

File Explorer (Win+E) is where users manage files, and where a technician first changes two defaults. By default, Windows hides file extensions and hidden files. In Windows 11, turn them on under View > Show: File name extensions and Hidden items. The Folder Options dialog (the See more menu, ⋯ > Options) has more, including "Hide protected operating system files", which is best left on.

Hidden extensions are a security problem, not just an inconvenience: an attachment named invoice.pdf.exe shows as invoice.pdf with extensions hidden, and looks harmless. Hidden items matter for troubleshooting, because folders such as AppData in the user profile, where applications keep their settings and caches, are hidden. You can also type a path or a variable such as %appdata% in the address bar to go straight there.

Task Manager

Task Manager is the Windows tool that shows what is running right now and how much CPU (central processing unit), memory, disk and network each process uses, and lets you end tasks, manage startup programs and control services. Open it with Ctrl+Shift+Esc, or from the Ctrl+Alt+Del screen when the desktop is not responding. In Windows 11 the pages are in a navigation pane on the left:

Processes

Running apps and background processes with their CPU, memory, disk and network use. Sort a column to find the process slowing the PC down; End task closes a hanging program.

Performance

Live graphs for CPU, memory, disks, network and GPU (graphics processing unit), plus facts such as installed memory, uptime and whether virtualization is enabled. Resource Monitor (resmon), with more detail, opens from here.

App history

Resource use over time for Microsoft Store apps.

Startup apps

Programs that start at sign-in, with their startup impact. Disabling unneeded entries is the classic fix for a slow startup.

Users

Signed-in users and what each one runs; you can disconnect or sign out a session.

Details

Every process with its process ID (PID), status and user; here you can set priority or end a whole process tree.

Services

Background services with their status; start, stop or restart them, or open the full Services console.

What processes, PIDs and services are is explained in Processes and Threads; why one busy process makes the whole PC feel slow is in CPU Scheduling.

Event Viewer

Task Manager shows the present; Event Viewer (eventvwr.msc) shows the past. It is the Windows tool for reading the event logs, in which Windows, its services and applications record errors, warnings and other events with a time, source and event ID. When a user says "it crashed yesterday afternoon", this is where the evidence is. Under Windows Logs you find:

• Application: events from programs, such as application crashes.
• System: events from Windows itself, drivers and services: a driver that failed to load, a service that did not start, an unexpected shutdown.
• Security: audit events such as successful and failed sign-ins. Reading it requires administrator rights.
• Setup and Forwarded Events: installation events, and events collected from other computers.

Each event has a level: Critical, Error, Warning, Information or Verbose. The Security log uses Audit Success and Audit Failure instead. Logs contain thousands of events, most of them harmless, so the skill is filtering: right-click a log and choose Filter Current Log to select levels, a time range, event sources or event IDs. A few IDs are worth knowing:

A filter is just a selection over records. The same logic in a few lines, applied to a small exported log:

# (time, log, level, source, event ID) as exported from Event Viewer
events = [
    ("08:02", "System", "Information", "EventLog", 6005),
    ("08:03", "System", "Error", "Service Control Manager", 7000),
    ("09:41", "Application", "Error", "Application Error", 1000),
    ("10:15", "Security", "Audit Failure", "Security-Auditing", 4625),
    ("10:15", "Security", "Audit Failure", "Security-Auditing", 4625),
    ("10:16", "Security", "Audit Success", "Security-Auditing", 4624),
    ("11:30", "System", "Warning", "disk", 153),
    ("13:07", "System", "Critical", "Kernel-Power", 41),
    ("13:08", "System", "Error", "EventLog", 6008),
    ("13:09", "System", "Information", "EventLog", 6005),
]


def filter_log(events, log, levels):
    """Like 'Filter Current Log': one log, only the chosen levels."""
    return [e for e in events if e[1] == log and e[2] in levels]


problems = filter_log(events, "System", {"Critical", "Error"})
for time, log, level, source, event_id in problems:
    print(f"{time}  {level:<8}  {event_id:>5}  {source}")

failed = sum(1 for e in events if e[4] == 4625)
print(f"Failed sign-ins (4625): {failed}")

08:03  Error      7000  Service Control Manager
13:07  Critical     41  Kernel-Power
13:08  Error      6008  EventLog
Failed sign-ins (4625): 2

Read it as a technician would: a service failed at startup (the event itself names which one), and at 13:07 the PC went down without a clean shutdown, confirmed a minute later by event 6008. The next questions are whether that was a power cut or a crash (look for a crash dump and the events just before 13:07) and whether it happens again. The warning from disk is worth a note in the ticket too. See OS Troubleshooting.

The Microsoft Management Console

The Microsoft Management Console (MMC) is the Windows framework that hosts administrative tools, called snap-ins, in a common window. Each ready-made console is saved as an .msc file, so you can start it by name from Win+R, a command prompt or the Start menu. You can also build your own console: run mmc, choose File > Add/Remove Snap-in, and save the result.

Most of these change the system, so they ask for administrator approval through User Account Control. Disk Management is explained in Disks, Partitions and Volumes, local users and groups in Users, Permissions and Access Control.

msconfig and msinfo32

Two older tools that are still useful. System Configuration (msconfig) controls how Windows starts: on the Boot tab you can set Safe boot for the next restarts, and on the Services tab "Hide all Microsoft services" followed by "Disable all" gives a clean boot, which shows whether a third-party service causes a problem. (Its Startup tab only points to Task Manager nowadays.) Remember to undo these settings afterward, or the PC keeps starting in the diagnostic mode.

System Information (msinfo32) is a read-only report of the whole system: Windows version and build, processor, installed memory, firmware version, BIOS mode (UEFI, the Unified Extensible Firmware Interface, or legacy BIOS, the Basic Input/Output System), Secure Boot state, drivers, and much more. It is the quickest way to answer "what exactly is in this PC?", and it can be exported to a file for a ticket.

The Windows Registry

The Windows Registry is the hierarchical database in which Windows, drivers and applications store their configuration. Almost every setting you change in Settings, Control Panel or Group Policy ends up as a value in the registry. It is organized like a file system: keys (like folders) contain subkeys and values, and each value has a name, a type (such as REG_SZ for text or REG_DWORD for a 32-bit number) and data. At the top are five root keys (often loosely called hives; strictly, a hive is a part of the registry stored in its own file, such as NTUSER.DAT):

• HKEY_LOCAL_MACHINE (HKLM): settings for the whole computer: hardware, drivers, services, installed software. Changing it requires administrator rights.
• HKEY_CURRENT_USER (HKCU): settings of the signed-in user, loaded from the file NTUSER.DAT in their profile.
• HKEY_USERS, HKEY_CLASSES_ROOT (file associations) and HKEY_CURRENT_CONFIG complete the set.

The Registry Editor is regedit. From the command line, reg query reads a key. This one lists the programs that start automatically when the current user signs in:

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    OneDrive    REG_SZ    "C:\Users\ana\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background

In daily work you rarely edit the registry by hand. Settings, Group Policy and management tools write it for you, safely and consistently.

Workgroup or domain

Every Windows PC belongs either to a workgroup or to a domain, and that decides where accounts and rules come from.

A PC joins a domain under Settings > Accounts > Access work or school, or in System Properties (sysdm.cpl) > Computer Name > Change. Joining requires a domain account with permission to add computers, and a PC that can reach a domain controller, which in practice means the right DNS (Domain Name System) server. Many organizations now join PCs to Microsoft Entra ID, the cloud directory, instead of or in addition to an on-premises domain.

Group Policy

Group Policy is the Windows feature that applies configuration settings and security rules to computers and users from a central definition, so that an administrator does not have to configure each PC by hand. Settings are grouped in Group Policy Objects (GPOs), each with two halves: Computer Configuration, applied when the computer starts, and User Configuration, applied when a user signs in. Password rules, mapped drives, a locked-down Control Panel and the desktop wallpaper can all come from Group Policy.

Local Group Policy is edited on one PC with gpedit.msc. Domain Group Policy is managed on a server with the Group Policy Management Console and linked to Active Directory sites, the domain and organizational units (OUs). When settings conflict, the order in which policies are applied decides:

Domain members refresh Group Policy in the background about every 90 minutes, with a random offset of up to 30 minutes, and some settings only take effect at the next restart or sign-in. When you have just changed a policy and want to test it, or suspect a PC is not getting it, two commands do the work (run from a command prompt; see Windows Command Line and PowerShell):

gpupdate /force
gpresult /r

gpupdate /force reapplies all policies now. gpresult /r shows which GPOs were applied to the computer and the user, and which were filtered out and why; run it elevated to see the computer part.

Which tool for which task

Much of the daily work of a Windows technician, and many exam questions, come down to knowing where to go: