A+ Certification (220-1002) Chapter 12

Processes tab features(Win8/10):

- Just a list of processes which shows Apps, Background processes, and Windows processes

How do you get to the Registry Editor?

- regedit from search bar or command line

What are Threads?

Bits of programs that are fed into the CPU.

What is a subkey to a subkey called?

a Value - They define aspects of the subkey

What differences are there in task manager for Win8/10?

- App history - Startup - Details - Networking tab is merged into the performance tab

Task manager: Processes tab(Win7)

- Applications are comprised of processes which is why they are in this tab - Can right-click a process and select go-to process to see which process(or processes) are running the application - By default the task manager shows the current user's username. - To see all user processes, click show processes from all users. - Can set priority to a process - Can create a dump file to debug a program

What should you do before editing a registry?

- Backup the registry from regedit. File>Export...>save as a .reg file on USB drive

What tabs are available in resource monitor? What does each one tell you?

- CPU: Enables you to start or suspend any process without killing it. - Memory: Breaks down memory into specific types. - Disk: Breaks disk activity down by PID. - Network: Shows network activity by PID, open connections, much more.

App history tab features(Win8/10):

- Collects recent statistics on CPU usage and network usage - Click options>show history for all processes to see usage for all processes.

How do you access the task manager(Win8/10)?

- Ctrl-Shift-Esc - Right-click Start>Select Task Manager

How can you start a service in windows 7

- From CLI type net start <service name> - Can stop a service by typing net stop <service name>

List the five main subgroups in Registry Editor called root keys

- HKEY_CLASSES_ROOT - HKEY_CURRENT_USER - HKEY_LOCAL_MACHINE - HKEY_USERS - HKEY_CURRENT_CONFIG

Details tab features(Win8/10):

- Inherited functionality from the old processes tab - Lists the processes by executable name, PID, status, the user running them, CPU/memory use, and description - Can use a debugging tool called analyze wait chain for identifying why a program is frozen

Processes tab features(Win7):

- Name - The processes are named after its executable file, which usually ends in .exe but can also end with other extensions - Username - Identify who started the process. A username of system indicates it was started by Windows. - Process identifier(PID) - Should be used over the process name(view>select columns>PID checkbox)

How can you get to performance monitor?

- Search "performance monitor" in search on taskbar - Control Panel>System and security>Administrative tools

Where can you find resource monitor?

- Search "resource monitor" in search on taskbar - Control Panel>System and security>Administrative tools - Task manager>Performance tab>Resource Monitor

Performance tab features(Win7):

- See how hard the CPU and RAM are working to see what total usage is and what programs need to be adjusted to stabilize the system usage.

Networking and users tab features(Win7):

- See network use at a glance and see which users' accounts are currently logged on to the local machine

Services tab features(Win7):

- Services can help reveal what services are needed for a process to run. - Can stop or start them and go to associated processes - Open Services applet from start>search bar>"services.msc"

What is set affinity for in task manager(Win7)

- Sets a process to a CPU core - A reason to do this would be to run an older program that may not run well with others.

Task manager: Applications Tab(Win7)

- Shows all running applications on the system. - Handy tools in application: - End Task - Switch To - brings any application to the front - New Task - Runs program if you know the executable

Performance tab features(Win8/10):

- Similar to Win7 - Can right-click graphs of CPU utilization to change graph to logical processors to see each processor graph

What is the boot process of UEFI systems?

- Simply runs bootmgr directly - Windows keeps bootmgr in a special System Reserved partition. - The partition is named EFI system partition with the bootmgr being named bootmgr.efi. - When bootmgr starts it reads data from Boot Configuration Data (BCD), which contains information about various operating systems installed on the system as well as instructions for how to load(bootstrap) them. - Once an OS is selected bootmgr loads a program called winload.exe which redies your system to load the OS kernel (called ntoskrnl.exe) itself. - The system loads into memory the hardware abstraction layer, the system registry, and the drivers for any boot devices before the OS takes over.

What kind of data does a Value store?And what does each value represent/mean?

- String: Can put any for of data in these as this is the most flexible value. - Binary: Nothing more than strings of ones and zeros. - DWORD: Like binary values but are limited to exactly 32 bits - QWORD: Like binary values, but are limited to exactly 64 bits.

Startup tab features(Win8/10):

- Used to designate what programs you want/don't want opening on boot - Msconfig can be used for this too

What is the boot process of BIOS?

- Uses boot order to scan hard drive for a master boot record (MBR). - The MBR holds a small bit of file system boot code that scans the partition table for the system partition and loads its boot sector. - The boot sector in turn contains code that does nothing but point the boot process toward a file called bootmgr in Windows Boot Manager - The BIOS looks for the MBR, which finds the boot code to launch the OS

What process occurs when starting a program?

- Windows loads the program into RAM as a process once it is started. - The CPU reads the process and f=the process tells the CPU which chunks of code to run

How do you access the task manager(Win7)?

- ctrl-shift-esc - Start>Search>'taskmgr'>*Enter - Ctrl-alt-delete>Task Manager

Tools in editing registry in CLI and what they do

- reg - Full registry editing tool. - View registry keys and values - Import/export some or all of registry - Compare versions of registry - Type reg /? Brings up list of 12 specific operations - regsvr32 - Can modify registry by only adding (Or registering) dynamic link library (DLL) files as command components in the Registry.

What is a service?

A class of processes that because of the nature of their job, doesn't require a window, running 'invisibly' in the background providing a large number of support roles.

What is an application?

A number of processes running and appearing in a window(or full screen) when you open them and end when closed.

For Task Manager, what happens to other processes when a priority is set?(Win7)

Brings other processes to a crawl(slows them down bruh)

ODBC

Coding standard that enables programmers to write databases and the applications that use them in a way they can query ODBC on how to locate and access a database without any concern about what application or OS is used.

What can you use to troubleshoot programs, manually install programs, or tweak programs to work a certain way?

Component services

What is the HKEY_LOCAL_MACHINE for?

Contains all the data for system's non-user specific configurations. - Every device and program on the computer.

What is the HKEY_CLASSES_ROOT for?

Defines class objects used by Windows, which are named groups that define what you can do with an object it represents.

What are files?

Executable files waiting on a mass storage device.

Regarding performance monitor, what are data collector sets?

Group of counters you can use to make reports.

What is a registry?

Huge database, part of every installed Windows system, stores everything about a PC, including information on all the hardware, network information, user preferences, file type, passwords, desktop color, etc. - Almost any configuration of the system involves editing the registry

What is the HKEY_CURRENT_CONFIG for?

If HKEY_LOCAL_MACHINE has more than one option, such as two different monitors, this root key defines which one is currently being used. - Typically this root key is never touched.

Will Microsoft allow you to kill a process tree if it includes an important system process

No!!!

What can you use to configure ODBC?

ODBC Data Source Administrator

Regarding performance monitor, what are objects and counters?

Object - System component that is given a set of characteristics and can be managed by the OS as a single entity. Counter - Tracks specific information about that object

What tool enables you to inspect anything happening on a system to help diagnose problems?

Performance monitor

What tool can you use to see how your system is running over time?

Performance monitor.

What is the default tab for task manager in Win8/10?

Processes

How to revert registry changes

Right click the file and hit "Merge" and import the file that was exported.

What is the HKEY_USERS for?

Stores all personalized information here.

What is the HKEY_CURRENT_USER for?

Stores current user settings here.

When are you editing the registry?

Whenever you are using any settings or control panel or basically any other utility.

What do you use to stop running processes? What about in Powershell CLI?

taskkill <name or PID> /f(force process to end) - Use kill for powershell CLI

What do you use to lists all of the running processes on a local or remote system?

tasklist