Ask a Diagnostician
Native Microsoft System Utilities

Windows Tools Directory & Technical Workings

Detailed breakdown of all 12 native Windows diagnostic utilities, their internal mechanisms, launch triggers, required privileges, and troubleshooting procedures.

📊
taskmgr

1. Task Manager

How it works: Queries the Windows Kernel Object Manager and ETW (Event Tracing for Windows) every 1–2 seconds to report thread count, working set memory, GPU engine utilization, and I/O write bytes per second.

  • Executable: C:\Windows\System32\Taskmgr.exe
  • Keyboard Shortcut: Ctrl + Shift + Esc or Win + X
  • Key Diagnostic: Spot 100% CPU hogs, startup impacts, and terminate unkillable processes.
Step-by-Step Task Manager Guide →
🔬
resmon.exe

2. Resource Monitor

How it works: An enterprise diagnostic monitor exposing microsecond file handles, network TCP connections, hard page faults per second, and disk queue lengths.

  • Executable: C:\Windows\System32\perfmon.exe /res
  • Launch Command: Win + R > resmon
  • Key Diagnostic: Find which program has locked a file or folder under "Associated Handles".
Resource Monitor In-Depth →
📜
eventvwr.msc

3. Event Viewer

How it works: The central Windows event telemetry database (.evtx). Windows drivers, services, and hardware controllers write XML events into System, Application, and Security channels.

  • Executable: C:\Windows\System32\eventvwr.msc
  • Launch Command: Win + R > eventvwr.msc
  • Key Diagnostic: Filter Event ID 41 (Kernel-Power), 1001 (BugCheck), and disk sector errors.
Crash Analysis Guide →
🛡️
sfc /scannow

4. SFC & DISM Repair Utilities

How it works: System File Checker (SFC) calculates SHA-256 hashes of critical system binaries against clean copies in WinSxS. If WinSxS itself is corrupted, DISM rebuilds it via Microsoft Cloud Update servers.

  • Executable: C:\Windows\System32\sfc.exe & Dism.exe
  • Launch Command: Run Command Prompt as Administrator
  • Key Diagnostic: Repair corrupted DLLs, broken Windows updates, and blue screen file corruption.
SFC & DISM Repair Tutorial →
🧠
mdsched.exe

5. Windows Memory Diagnostic

How it works: Sets a pre-boot bootloader flag (in BCD) and restarts the computer outside the Windows GUI. Executes aggressive read/write stress patterns (MATS+, INVC, CHCKR) directly into DDR4/DDR5 silicon.

  • Executable: C:\Windows\System32\mdsched.exe
  • Launch Command: Win + R > mdsched.exe
  • Key Diagnostic: Verifies physical RAM integrity and detects faulty memory sticks.
RAM Diagnostic Walkthrough →
📈
perfmon /rel

6. Reliability Monitor

How it works: The Reliability Analysis Component (RAC) continuously monitors Windows and aggregates daily software installs, Windows Updates, driver updates, and crashes into a 1–10 Stability Index graph.

  • Launch Command: Win + R > perfmon /rel
  • Privileges: Standard User
  • Key Diagnostic: Spot exact dates when stability collapsed following a buggy driver or software update.
Reliability Monitor Guide →
🔌
devmgmt.msc

7. Device Manager

How it works: Directly manages the Windows Plug and Play (PnP) device tree, ACPI bus drivers, hardware interrupt requests (IRQ), and kernel driver services.

  • Executable: C:\Windows\System32\devmgmt.msc
  • Launch Command: Win + X > Device Manager
  • Key Diagnostic: Fix yellow exclamation marks, roll back broken GPU drivers, fix Error Code 43 & 10.
Device Driver Diagnostics →
💾
cleanmgr.exe

8. Disk Cleanup & Storage Sense

How it works: Inspects Windows update rollback archives, shadow copies, thumbnail caches, crash dump files, and the Windows.old directory to safely purge gigabytes of junk.

  • Executable: C:\Windows\System32\cleanmgr.exe
  • Launch Command: Win + R > cleanmgr /lowdisk
  • Key Diagnostic: Resolve red full C: drive warnings and purge lingering temporary update files.
Disk Cleanup Tutorial →
💻
powershell.exe

9. PowerShell Hardware Diagnostics

How it works: Communicates with Windows Management Instrumentation (WMI) and Common Information Model (CIM) to inspect NVMe drive health, battery cycles, motherboard firmware, and thermal sensors.

  • Core Cmdlet: Get-PhysicalDisk, Get-CimInstance
  • Launch Command: Win + X > Terminal / PowerShell (Admin)
  • Key Diagnostic: Battery health report generation and SSD SMART operational status check.
PowerShell Diagnostic Cmdlets →
🎮
dxdiag.exe

10. DirectX Diagnostic Tool (DxDiag)

How it works: Probes the Windows Display Driver Model (WDDM), Direct3D acceleration layers, VRAM allocation, display refresh rates, and HDCP audio endpoints.

  • Executable: C:\Windows\System32\dxdiag.exe
  • Launch Command: Win + R > dxdiag
  • Key Diagnostic: Debug game crashes, DirectX runtime initialization errors, and export comprehensive hardware specs.
DxDiag GPU Testing Guide →
⏱️
perfmon.msc

11. Performance Monitor

How it works: The industrial-strength metrics collector in Windows. Connects to hundreds of performance counters across processor cores, virtual memory commits, and disk IOPS with automated data collector sets.

  • Launch Command: Win + R > perfmon.msc
  • Key Feature: Generate a full system diagnostics health report in 60 seconds with perfmon /report.
  • Best for: Long-term performance bottleneck auditing.
Learn Performance Monitoring →
🔒
windowsdefender:

12. Windows Defender & Offline Scan

How it works: Real-time behavioral heuristics, AMSI (Antimalware Scan Interface), and deep kernel rootkit detection via Microsoft Defender Offline bootable environment.

  • Launch Command: Win + I > Privacy & Security > Windows Security
  • Special Capability: Offline scan boots into a lightweight WinPE environment to eliminate rootkits that evade live Windows.
  • Best for: Stubborn malware, coinminers eating 100% GPU/CPU.
Security & Rogue Process Guide →