How to Use Windows 11 Task Manager to Fix a Slow or Frozen PC

Set expectations, though. Trimming startup apps speeds up sign-in and frees memory and CPU in the first few minutes after boot, especially when you disable High-impact items. It won't make a fast PC faster once everything has loaded.

Quietening background apps with Efficiency mode

Efficiency mode is an action, not a page. It tells Windows to give a process less priority and run it in a power-saving way: it lowers the process's base priority and applies a low-power quality-of-service level called EcoQoS, so Windows can schedule it on efficient cores and at lower clock speeds. The result is less battery drain and more CPU left for what you're actually doing.

Right-click a process on the Processes or Details page and choose Efficiency mode, or select it and click the button in the command bar. A leaf icon appears in the Status column, and the same menu turns it off again.

Use it on background apps that keep chewing CPU while you work, such as sync clients or a browser with many tabs. Don't use it on the app in front of you, because it will feel slower. For grouped apps you may need to expand the group and apply it to individual child processes, and some core Windows processes can't be put into Efficiency mode at all because throttling them would hurt the whole system. Some apps put their own background processes into this mode, so a leaf icon you didn't set is normal.

The pages you'll use less often

Details

Details is the power-user view, closest to the classic Windows 7 Processes tab. Every executable gets its own row with its PID (process ID), status, user name, CPU, memory and architecture. Right-click a row and you get the advanced actions: End process tree; Set priority and Set affinity to control scheduling and which CPU cores a process may use; Analyze wait chain to see which process a hung app is waiting for; and Create memory dump file, which saves a .dmp file you can open in Visual Studio or WinDbg to debug a hang or leak.

For developers, the most useful trick here is the Command line column. Right-click the column header, choose Select columns and add it. It shows the exact arguments each process was started with, which makes it easy to tell apart five copies of dotnet.exe or node.exe.

App history

App history shows resource use over time rather than right now: CPU time and network usage for each app since the counters were last reset. It's the place to find which app quietly used gigabytes of data on a metered connection. Delete usage history resets the counters.

Users

Users shows resource consumption per signed-in account, which matters on shared PCs and Remote Desktop servers. An administrator can right-click another user to Disconnect or Sign off that session. Signing someone off closes their apps without saving, so warn them first.

Services

Services lists Windows services with their name, PID, description, status and group, and lets you Start, Stop or Restart one from the right-click menu. For startup type and recovery options, click Open Services to launch the full services.msc console.

Settings

Here you choose the default start page, the real-time update speed, the theme, and window behaviour such as Always on top. If you mostly open Task Manager to manage startup apps, make that the default page.

When Task Manager won't end a process

Usually the process belongs to another user or to the system and needs administrator rights, or it is protected, as critical Windows processes and some antivirus engines are. Try End process tree on the Details page, or taskkill /f from an elevated prompt. If it still refuses, it is protected on purpose.

That is a good thing. Ending apps you opened is safe apart from losing unsaved work, but ending Windows processes such as csrss.exe, wininit.exe or svchost.exe can crash or restart Windows. Task Manager warns you before ending the critical ones.

On rights: if your account is an administrator, Task Manager already runs elevated when you open it normally. From a standard account, run taskmgr from an elevated terminal, or search for Task Manager, right-click it and choose Run as administrator.

Fixing "Task Manager has been disabled by your administrator"

This message means a policy is blocking Task Manager. Microsoft's troubleshooting article names two causes: a Group Policy setting, or registry values that block it.

On a work or school PC, stop here and contact IT. Your organisation set the policy deliberately, and domain or Intune policy will simply re-apply it. On your own PC, use one of these two fixes.

Local Group Policy (Pro, Enterprise and Education)

1. Press Win+R, type gpedit.msc, and press Enter.
2. Go to User Configuration > Administrative Templates > System > Ctrl+Alt+Del Options.
3. Open Remove Task Manager and set it to Not Configured or Disabled.
4. Run gpupdate /force, or sign out and back in.

Registry (every edition, including Home)

Check for the blocking value, then delete it. The HKLM line needs an elevated prompt.

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /f

Setting the value to 0 works too. Restart or sign out afterwards.

If you never set this policy yourself, run a full Microsoft Defender scan before anything else. Some malware disables Task Manager precisely so you can't see or kill it.

Doing the same from the command line

Everything above can be scripted, which is what you want on remote machines, on Server Core, or for a fix you'll repeat.

Command Prompt

:: List all processes
tasklist

:: Find a process by name
tasklist /fi "imagename eq chrome.exe"

:: Show which services run inside each svchost.exe
tasklist /svc

:: Processes using more than ~500 MB (value is in KB)
tasklist /fi "memusage gt 500000"

:: End by name, forcefully, including child processes
taskkill /im notepad.exe /f /t

:: End by PID
taskkill /pid 1234 /f

For the rest of the everyday commands, see the C# Corner list of Command Prompt basic commands.

PowerShell

# Top 10 processes by memory (working set) in MB
Get-Process |
    Sort-Object WorkingSet64 -Descending |
    Select-Object -First 10 Name, Id,
        @{ n = 'MemMB'; e = { [math]::Round($_.WorkingSet64 / 1MB) } }

# Top 10 by total CPU time (seconds since start, not a live percentage)
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, Id, CPU

# Live CPU percentage per process, like the Processes page
Get-Counter '\Process(*)\% Processor Time' -SampleInterval 2 |
    Select-Object -ExpandProperty CounterSamples |
    Sort-Object CookedValue -Descending |
    Select-Object -First 10 InstanceName, CookedValue

# Stop a process
Stop-Process -Name notepad -Force

# Startup entries and running services
Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location
Get-Service | Where-Object Status -eq 'Running'

One trap: the % Processor Time counter is per logical processor, so a busy process on an 8-thread CPU can report up to 800. Divide by the number of logical processors before comparing it with Task Manager.

From C#

.NET exposes the same data through System.Diagnostics.Process, which is handy for watchdog services and build tools that need to clean up stuck child processes.

using System.Diagnostics;

foreach (var p in Process.GetProcesses()
                         .OrderByDescending(p => p.WorkingSet64)
                         .Take(5))
{
    Console.WriteLine($"{p.ProcessName,-25} PID {p.Id,6}  {p.WorkingSet64 / 1024 / 1024} MB");
}

// Kill a hung tool and everything it spawned
foreach (var p in Process.GetProcessesByName("node"))
{
    p.Kill(entireProcessTree: true);
}

Kill(entireProcessTree: true) is the code equivalent of End process tree, and it's the right default for tools like node that spawn their own children.