Mostrando entradas con la etiqueta MS Windows. Mostrar todas las entradas
Mostrando entradas con la etiqueta MS Windows. Mostrar todas las entradas

13/3/11

Page Cache, the Affair Between Memory and Files

Previously we looked at how the kernel manages virtual memory for a user process, but files and I/O were left out. This post covers the important and often misunderstood relationship between files and memory and its consequences for performance.

Two serious problems must be solved by the OS when it comes to files. The first one is the mind-blowing slowness of hard drives, and disk seeks in particular, relative to memory. The second is the need to load file contents in physical memory once and share the contents among programs. If you use Process Explorer to poke at Windows processes, you’ll see there are ~15MB worth of common DLLs loaded in every process. My Windows box right now is running 100 processes, so without sharing I’d be using up to ~1.5 GB of physical RAM just for common DLLs. No good. Likewise, nearly all Linux programs need ld.so and libc, plus other common libraries.

Happily, both problems can be dealt with in one shot: the page cache, where the kernel stores page-sized chunks of files. To illustrate the page cache, I’ll conjure a Linux program named render, which opens file scene.dat and reads it 512 bytes at a time, storing the file contents into a heap-allocated block. The first read goes like this:
Read from Page Cache
After 12KB have been read, render‘s heap and the relevant page frames look thus:
Non-Mapped File Read
This looks innocent enough, but there’s a lot going on. First, even though this program uses regular read calls, three 4KB page frames are now in the page cache storing part of scene.dat. People are sometimes surprised by this, but all regular file I/O happens through the page cache. In x86 Linux, the kernel thinks of a file as a sequence of 4KB chunks. If you read a single byte from a file, the whole 4KB chunk containing the byte you asked for is read from disk and placed into the page cache. This makes sense because sustained disk throughput is pretty good and programs normally read more than just a few bytes from a file region. The page cache knows the position of each 4KB chunk within the file, depicted above as #0, #1, etc. Windows uses 256KB views analogous to pages in the Linux page cache.

Sadly, in a regular file read the kernel must copy the contents of the page cache into a user buffer, which not only takes cpu time and hurts the cpu caches, but also wastes physical memory with duplicate data. As per the diagram above, the scene.dat contents are stored twice, and each instance of the program would store the contents an additional time. We’ve mitigated the disk latency problem but failed miserably at everything else. Memory-mapped files are the way out of this madness:
Mapped File Read
When you use file mapping, the kernel maps your program’s virtual pages directly onto the page cache. This can deliver a significant performance boost: Windows System Programming reports run time improvements of 30% and up relative to regular file reads, while similar figures are reported for Linux and Solaris in Advanced Programming in the Unix Environment. You might also save large amounts of physical memory, depending on the nature of your application.

As always with performance, measurement is everything, but memory mapping earns its keep in a programmer’s toolbox. The API is pretty nice too, it allows you to access a file as bytes in memory and does not require your soul and code readability in exchange for its benefits. Mind your address space and experiment with mmap in Unix-like systems, CreateFileMapping in Windows, or the many wrappers available in high level languages. When you map a file its contents are not brought into memory all at once, but rather on demand via page faults. The fault handler maps your virtual pages onto the page cache after obtaining a page frame with the needed file contents. This involves disk I/O if the contents weren’t cached to begin with.

Now for a pop quiz. Imagine that the last instance of our render program exits. Would the pages storing scene.dat in the page cache be freed immediately? People often think so, but that would be a bad idea. When you think about it, it is very common for us to create a file in one program, exit, then use the file in a second program. The page cache must handle that case. When you think more about it, why should the kernel ever get rid of page cache contents? Remember that disk is 5 orders of magnitude slower than RAM, hence a page cache hit is a huge win. So long as there’s enough free physical memory, the cache should be kept full. It is therefore not dependent on a particular process, but rather it’s a system-wide resource. If you run render a week from now and scene.dat is still cached, bonus! This is why the kernel cache size climbs steadily until it hits a ceiling. It’s not because the OS is garbage and hogs your RAM, it’s actually good behavior because in a way free physical memory is a waste. Better use as much of the stuff for caching as possible.

Due to the page cache architecture, when a program calls write() bytes are simply copied to the page cache and the page is marked dirty. Disk I/O normally does not happen immediately, thus your program doesn’t block waiting for the disk. On the downside, if the computer crashes your writes will never make it, hence critical files like database transaction logs must be fsync()ed (though one must still worry about drive controller caches, oy!). Reads, on the other hand, normally block your program until the data is available. Kernels employ eager loading to mitigate this problem, an example of which is read ahead where the kernel preloads a few pages into the page cache in anticipation of your reads. You can help the kernel tune its eager loading behavior by providing hints on whether you plan to read a file sequentially or randomly (see madvise(), readahead(), Windows cache hints). Linux does read-ahead for memory-mapped files, but I’m not sure about Windows. Finally, it’s possible to bypass the page cache using O_DIRECT in Linux or NO_BUFFERING in Windows, something database software often does.

A file mapping may be private or shared. This refers only to updates made to the contents in memory: in a private mapping the updates are not committed to disk or made visible to other processes, whereas in a shared mapping they are. Kernels use the copy on write mechanism, enabled by page table entries, to implement private mappings. In the example below, both render and another program called render3d (am I creative or what?) have mapped scene.dat privately. Render then writes to its virtual memory area that maps the file:
Copy On Write
The read-only page table entries shown above do not mean the mapping is read only, they’re merely a kernel trick to share physical memory until the last possible moment. You can see how ‘private’ is a bit of a misnomer until you remember it only applies to updates. A consequence of this design is that a virtual page that maps a file privately sees changes done to the file by other programs as long as the page has only been read from. Once copy-on-write is done, changes by others are no longer seen. This behavior is not guaranteed by the kernel, but it’s what you get in x86 and makes sense from an API perspective. By contrast, a shared mapping is simply mapped onto the page cache and that’s it. Updates are visible to other processes and end up in the disk. Finally, if the mapping above were read-only, page faults would trigger a segmentation fault instead of copy on write.

Dynamically loaded libraries are brought into your program’s address space via file mapping. There’s nothing magical about it, it’s the same private file mapping available to you via regular APIs. Below is an example showing part of the address spaces from two running instances of the file-mapping render program, along with physical memory, to tie together many of the concepts we’ve seen.
Virtual To Physical Mapping
This concludes our 3-part series on memory fundamentals. I hope the series was useful and provided you with a good mental model of these OS topics. Next week there’s one more post on memory usage figures, and then it’s time for a change of air. Maybe some Web 2.0 gossip or something. Sphere: Related Content

6/12/10

Game Design: The Tools You Need

AndrewParsons | 4 Dec 2010 | 10:27 PM

In my last blog post about Imagine Cup, I mentioned that we provide you all the tools you need to get started on your own Game Design, so I thought I’d fill you in on what you need, and where you can get it all from.

XNA Game Development
Building games in XNA is incredibly easy, and getting the technology set up is just as straightforward.

Firstly, you need a PC – preferably with a decent graphics card. Particularly when talking about 3D games, where we take advantage of Direct 3D shading and other capabilities, you need a card supporting DirectX 9 and up (I just don’t want someone puzzling over why their shading isn’t working like I was when I ran a hands on lab with a laptop with a not-so-great graphics card).

Next up, you need Windows. Yes, the developer tools you’ll need only run on Windows. Shock, horror. And to make matters even more specific, XNA 4.0 will only run on Windows Vista or Windows 7. Again, from experience having a student turn up with a Mac, running Bootcamp and only having Windows XP installed, it’s a sad day when you can’t install the actual tool you need to build your own awesome games because you’re using an OS that’s, in technology years, ancient.

(Ah, and this is why you shouldn't write blog posts at 2am on a Saturday... thanks to one of my awesome student buddies back in Oz, I have been corrected. You CAN install the standalone version of XNA 4.0 on Windows XP - it's just when you install it as part of the WP7 tools that you'll hit the problem. Thanks Michael!)

And we’re halfway there.

Next – the actual development environment. For XNA 4.0, you should install Visual Studio 2010. If you can’t get your hands on the proper version of Visual Studio (and more on that in a moment), you can always get the Express version of Visual C# 2010 for free. Whether you get the free-to-everyone Express, or one of the professional level versions of Visual Studio, you’ll be armed with one of the best development environments I’ve ever worked in, and will allow you to create applications for Windows, web, Xbox 360, Phone and more, along with supporting technologies like web services and WCF services.

And that’s it for getting it all set up and ready – the final piece in the puzzle is XNA itself. The latest version is XNA Game Studio 4.0 which allows you to build games and game components for Windows, Xbox 360 and Windows Phone 7.

When XNA is installed, it adds in the XNA .NET Framework extensions, and integrates into Visual Studio or Visual C# Express, including project templates and the extras you need for things like debugging, deploying and project management of multiple project types. It will also install a Device Center for managing connections to actual Xbox 360 and Phone hardware.

As an “optional” extra, if you want to develop for Windows Phone 7, you’ll need to install the Windows Phone 7 tools, including emulator. I put quotes around optional, because the easiest way you’ll get XNA 4.0 installed is to download the WP7 developer tools.

Silverlight Development
You can build Silverlight games for the web browser, or for Windows Phone 7, in a couple of different ways: Visual Studio or Expression Studio. If you’re content building your games in Silverlight in Visual Studio, follow the above instructions until you have Visual Studio installed, and you’re done. You don’t need any extras unless you want to build Silverlight WP7 games, in which case you’ll need the WP7 developer tools as well.

The other way to build Silverlight applications and games is to use Expression Studio, specifically Expression Blend. Blend allows you to do more “design” orientated solutions, than development heavy ones. And, of course, you’re able to leverage the power of both tools in the one solution, going back and forth between them as best suits your needs.

Getting the Tools
So, that’s all you need. But how do you get it? Hopefully, it’s just as easy to get your hands on everything you need, as it is running through the list of what you need.

If you’re a student, you can get Visual Studio 2010 Professional and Expression Studio 4 Ultimate for free at DreamSpark: www.dreamspark.com

If you’re faculty, you can get Visual Studio 2010 Professional and Expression Studio for free at Faculty Resource Center: www.facultyresourcecenter.com

If you’re a university, college, school, and want to setup Visual Studio in your labs, you can get Visual Studio 2010 Ultimate and Expression Studio through MSDNAA: www.msdnaa.net

If you’re not in the academic space but still want to try your hand at game development, you can either buy Visual Studio 2010, or get Visual C# 2010 Express at our main Express website: http://www.microsoft.com/express/downloads/

Getting XNA and the Phone tools, head over to the App Hub and download everything in one go: http://create.msdn.com/en-us/home/getting_started If you’re just after the XNA Game Studio addin without Expression, etc, you can use the Microsoft Download Center: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=9ac86eca-206f-4274-97f2-ef6c8b1f478f

Deployment
One last note. If you’re building games for the Xbox 360 or Windows Phone 7, you need to be able to connect to your devices. XNA Creator Club and membership to the Windows Phone 7 Marketplace are what you need. Students get access to both for free through the DreamSpark program. Sphere: Related Content

5/12/10

The .NET Developer's Guide to Windows Security

Summary
The Home Page for "The .NET Developer's Guide to Windows Security"

Table of Contents

Preface
Acknowledgements

Part 1: The Big Picture

Item 1: What is secure code?
Item 2: What is a countermeasure?
Item 3: What is threat modeling?
Item 4: What is the principle of least privilege?
Item 5: What is the principle of defense in depth?
Item 6: What is authentication?
Item 7: What is a luring attack?
Item 8: What is a non privileged user?
Item 9: How to develop code as a non admin
Item 10: How to enable auditing
Item 11: How to audit access to files

Part 2: Security Context

Item 12: What is a security principal?
Item 13: What is a SID?
Item 14: How to program with SIDs
Item 15: What is security context?
Item 16: What is a token?
Item 17: What is a logon session?
Item 18: What is a window station?
Item 19: What is a user profile?
Item 20: What is a group?
Item 21: What is a privilege?
Item 22: How to use a privilege
Item 23: How to grant or revoke privileges via security policy
Item 24: What is WindowsIdentity and WindowsPrincipal?
Item 25: How to create a WindowsPrincipal given a token
Item 26: How to get a token for a user
Item 27: What is a daemon?
Item 28: How to choose an identity for a daemon
Item 29: How to display a user interface from a daemon
Item 30: How to run a program as another user
Item 31: What is impersonation?
Item 32: How to impersonate a user given her token
Item 33: What is Thread.CurrentPrincipal?
Item 34: How to track client identity using Thread.CurrentPrincipal
Item 35: What is a null session?
Item 36: What is a guest logon?
Item 37: How to deal with unauthenticated clients

Part 3: Access Control

Item 38: What is role based security?
Item 39: What is ACL based security?
Item 40: What is discretionary access control?
Item 41: What is ownership?
Item 42: What is a security descriptor?
Item 43: What is an access control list?
Item 44: What is a permission?
Item 45: What is ACL inheritance?
Item 46: How to take ownership of an object
Item 47: How to program ACLs
Item 48: How to persist a security descriptor
Item 49: What is Authorization Manager?

Part 4: COM(+)

Item 50: What is the COM authentication level?
Item 51: What is the COM impersonation level?
Item 52: What is CoInitializeSecurity?
Item 53: How to configure security for a COM client
Item 54: How to configure the authentication and impersonation level for a COM app
Item 55: How to configure the authentication and impersonation level for an ASP.NET app
Item 56: How to implement role based security for a managed COM app
Item 57: How to configure process identity for a COM server app

Part 5: Network Security

Item 58: What is CIA?
Item 59: What is Kerberos?
Item 60: What is a service principal name SPN?
Item 61: How to use service principal names
Item 62: What is delegation?
Item 63: What is protocol transition?
Item 64: How to configure delegation via security policy
Item 65: What is SSPI?
Item 66: How to add CIA to a socket based app using SSPI
Item 67: How to add CIA to .NET Remoting
Item 68: What is IPSEC?
Item 69: How to use IPSEC to protect your network

Part 6: Misc

Item 70: How to store secrets on a machine
Item 71: How to prompt for a password
Item 72: How to programmatically lock the console
Item 73: How to programatically log off or reboot the machine
Item 74: What is group policy?
Item 75: How to deploy software securely via group policy

Code Samples
Download them here.

How to read online
See the table of contents below, and click on any subject you want to read!

Note that editing has been disabled due to spam. Thanks to all the good people who have helped fix typos, and of course all the fine folks who helped port the final version of the book into this wiki!

And yes, the entire contents of the book is here for your reference, free of charge. But please support my publisher and my family by picking up a hardcopy from your nearest bookstore ! If you're looking for classroom training on these topics, see the Pluralsight training page at PluralSight.com/courses . Thanks! Sphere: Related Content

What is a Token

A token is a kernel object that caches part of a user's security profile, including the user SID, group SIDs, and privileges (WhatIsAPrivilege). WhatIsSecurityContext discusses the basics of how this cache is normally used, but there's a bit more to it: A token also holds a reference to a logon session (WhatIsALogonSession) and a set of default security settings that the kernel uses.

Tokens are propagated automatically as new processes are created. A new process naturally inherits a copy of the parent's process token. Even if the thread that creates the process is impersonating, the new process gets a copy of the parent's process token, not the thread token, which usually surprises most people who are new to impersonation (WhatIsImpersonation). If you want to start a new process running with some other token, see HowToRunAProgramAsAnotherUser.

The .NET Framework provides two classes that allow you to work with tokens: WindowsIdentity and WindowsPrincipal (WhatIsWindowsIdentityAndWindowsPrincipal). If you ever want to look at the token for your process, call the static method WindowsIdentity.GetCurrent. This method returns a WindowsIdentity instance that wraps the token that represents the thread's security context. Normally this will give you the process token, unless your thread happens to be impersonating (a rare exception that you can read about in WhatIsImpersonation). This function is the way to discover your program's security context as far as the operating system is concerned: It answers the question, Who am I? which is very helpful when trying to diagnose security problems such as being denied access to ACL-protected resources like files. I'd recommend including this user name with any errors that you log.
// here's a simple example of a log that includes
// information about the current security context
void logException(Exception x) {
IIdentity id = WindowsIdentity.GetCurrent();
log.WriteLine("User name: {0}", id.Name);
log.WriteLine("Exception: {0}", x.Message);
log.WriteLine(x.StackTrace);
}

The vast majority of information in a token is immutable, and for good reason! It would be crazy to allow an application to add new groups to its token, for example. But you can change a couple things: You can enable or disable any privileges that happen to be in your token (HowToUseAPrivilege), and you can control the default owner and DACL (WhatIsAnAccessControlList). This latter feature allows your process (or another process running in the same security context, say a parent process) to control the owner and DACL that will be applied to all new kernel objects, such as named pipes, mutexes, and sections, whenever a specific DACL is not provided explicitly to the creation function. For example, these defaults will be used if you call the Win32 function CreateMutex and pass NULL for the LPSECURITY_ATTRIBUTES argument, which is the normal and correct procedure. If you ever need to change these default settings, call the Win32 function SetTokenInformation, but this will be very rare. You see, by default the operating system will set up your token so that the default DACL grants you and SYSTEM full permissions, which is very secure indeed. Usually the only time you want to deviate from this is if you’re going to share an object between two processes running under different accounts, such as between a service process that runs as a daemon (WhatIsADaemon) and a service controller process launched by the interactive user. In that case, see HowToProgramACLs to learn how to programmatically build your own DACL.

Tokens never expire. This makes programmers happy (it would be weird if all of a sudden your process terminated because its token timed out), but it can be dangerous in some cases. For example, nothing stops a server from holding onto client tokens indefinitely once those clients have authenticated. A server running with low privilege is good but keeping a bunch of client tokens in a cache negates all that goodness because an attacker that manages to take over the server process can use the cached client tokens to access resources (WhatIsImpersonation). Fortunately, Kerberos tickets do expire (WhatIsKerberos), so if any of those tokens had network credentials (WhatIsDelegation), they won't be valid forever.

Occasionally you might want to pass tokens between processes. Say you have factored a server into two processes, a low-privileged process listening on an untrusted network (the Internet) and a high privileged helper process that you communicate with using some form of secure interprocess communication such as COM. If you've authenticated a client in your listener process and want your helper process to see the client's token, you can pass it from one process to another by calling the Win32 API DuplicateHandle. You can obtain the token handle from a WindowsIdentity via its Token property (if you have an IIdentity reference, you'll need to cast it to WindowsIdentity first).

At some point you might think about passing a token (or its wrapper, a WindowsIdentity) from one machine to another. This is a big no-no in Windows security. A token only has meaning on the machine where it was created, because the groups and privileges in it were discovered based on the combination of a centralized domain security policy and the local security policy of the machine. Local groups and privilege definitions differ across machines, and domain security policy changes if you cross domain boundaries. Even if the operating system were to provide a way to serialize a token for transmission to another machine (it does not), using this "imported" token would lead to incorrect access control decisions! Thus, if a client (Alice, say) has authenticated with a process on one machine, and you want another machine to see Alice's security context, Alice must authenticate with that other machine. Either she can do this directly or you can delegate her credentials (WhatIsDelegation). In other words, the only way to get a token for Alice on a given machine is to use her credentials to authenticate with a process running on that machine.

While I'm on the subject of the machine sensitive nature of tokens, I should mention that you must never use a token on one machine to perform an access check on an object located on another. For example, resist the temptation to load the security descriptor (WhatIsASecurityDescriptor) for a remote object onto another machine and perform an access check against it using a local token. A token for Alice on machine FOO doesn't have exactly the same groups and privileges it would have if it were produced on machine BAR, so using a token from FOO in access checks against BAR's resources is a very bad idea and is a gaping security hole. The correct procedure is to authenticate with a process on the machine hosting the resource and have that process perform the access check. In other words, keep the access checks on the same machine as the resources being protected. Sphere: Related Content

4/12/10

25 Cool Windows 7 Keyboard Tricks That Will Impress Your Friends

Anyone working professionally with a computer has their hands on the keyboard most of the time. Reaching for the mouse can be an annoying disturbance and personally I often turn over my mouse in such situations. An easy solution is to simply keep the hands on the keyboard and complete as many tasks as possible with keyboard shortcuts only.

Apart from making you work more efficiently and faster, you can also impress your friends or colleagues by being able to work without a mouse. This article describes some cool Windows 7 keyboard tricks to get you started. In the end you might never want to take your hands off the keyboard again.

For your convenience, more keyboard shortcut resources are attached at the bottom.

Note that some of these shortcuts will only work if Windows Aero is enabled. If Aero effects are disabled on your computer, it might not be powerful enough to support resource intensive graphical features. The visual effects may also have been disabled to increase overall performance. If you wish to enable Aero nevertheless, have a look at my recent article explaining How To Enable and Troubleshoot Aero Effects in Windows 7.

Aero Shortcuts
•[Windows] + [Spacebar] (Aero Peek)
Make all open windows transparent to view gadgets and icons on desktop
•[Windows] + [D] (Aero Peek)
Show or hide the desktop.
•[Windows] + [Home] (Aero Shake)
Minimize all but selected window. Reverse by clicking the key combination again.
•[Windows] + left arrow OR [Windows] + right arrow (Aero Snap)
Dock selected window to the left or right half of your screen.
•[Windows] + up arrow OR [Windows] + down arrow (Aero Snap)
Maximized and restores the selected window.
•[Windows] + [SHIFT] + up arrow OR [Windows] + [SHIFT] + down arrow (Aero Snap)
Maximizes and restores selected window in vertical dimension only.
•[Windows] + [Tab] (Aero Flip)
Launch 3D representation of open windows and click [Tab] key again to flip through them.

Windows & Taskbar
•[Alt] + [Ctrl] + [Tag] + left/right/up/down arrow
Flip window.
•[Alt] + [Tab]
Cycle through open windows
•[Windows] + [T] OR [Windows] + [SHIFT] + [T]
Move focus to front or back of taskbar. Press [T] again while holding the [Windows] key to cycle through items in the taskbar from left to right or, with [SHIFT] button held too, from right to left.
•[Windows] + [B]
Puts focus on the ‘show hidden icons’ button on the system tray.
•[Windows] + [1] THROUGH [Windows] + [9]
Launch first through ninth icon on taskbar, including items pinned to taskbar.
•[Windows] + [SHIFT] + [1] THROUGH [Windows] + [SHIFT] + [9]
Starts new instance of respective taskbar icon.
•[Windows] + [Ctrl] + [1] THROUGH [Windows] + [Ctrl] + [9]
Cycles through multiple instances of the respective icon.
•[Windows] + [Alt] + [1] THROUGH [Windows] + [Alt] + [9]
Opens jump list for respective icon

Multiple Monitors
•[Windows] + [SHIFT] + right arrow OR [Windows] + [SHIFT] + left arrow
Move selected window from one monitor to another. They will remain in the same relative location.
•[Windows] + [P]
Select presentation display mode

Magnifier
•[Windows] + [+] OR [Windows] + [-]
Activates Windows Magnifier to zoom in or out of screen.
•[Ctrl] + [Alt] + [D]
Switch to docked mode.
•[Ctrl] + [Alt] + [L]
Switch to lense mode
•[Ctrl] + [Alt] + [F]
Switch from docked or lens mode back to full screen mode.
•[Ctrl] + [Alt] + [I]
Invert colors.
•[Windows] + [Esc]
Exist magnifier views.

Other
•[Windows] + [G]
Cycle through desktop gadgets.
•[Windows] + [X]
Launches Windows Mobility Center. Especially useful if you’re working on a laptop

Can’t get enough? The following articles describe lots of additional keyboard tricks and shortcuts to make use of:
The Essential Keyboard Shortcuts to whip your Windows
How To Launch Any Windows App At The Touch Of A Button by Jorge
Speed up Firefox Browsing with Keyboard Shortcuts
The most Essential Keyboard Shortcuts for Firefox
Some Cool Keyboard Tricks That Few People Know About by Tina
The Essential Keyboard Shortcuts to Tame your Google Calendar
The most Essential Keyboard Shortcuts for Google Reader

Which cool keyboard tricks did we miss and which ones are your favorites? Sphere: Related Content

Taking A Closer Look At Windows Resource Monitor

What is your computer doing in there? On the exterior it is a mass of plastics and metals, roughly pressed together to provide your PC with a protective case. But is it protecting your PC from the outside, or is it protecting you from the strange and arcane things happening inside your PC?

Perhaps it is time to find out exactly what your computer is up to – particularly if your computer is behaving badly. There are many third-party tools that can clean, scrub, and protect your PC, but none of those will help you better understand what’s going on. A program that can help you understand what is going on ships with every Windows PC. It’s called Windows Resource Monitor. Let’s take a look at what it can tell us.

Opening Windows Resource Monitor
Of course, we need to open Windows Resource Monitor before we can do anything. Windows Resource Monitor is a feature that was added in Vista and carries over to Windows 7. As far as I can gather, the only way to open it is through the Windows Task Manager - so press CTRL-ALT-DEL and open it.
Once Task Manager is open, go to the Performance tab. In the lower right hand corner is a button labeled Resource Monitor. Click it, and you’re ready to go!

The Basics
Windows Resource Monitor will, by default, open up to the Overview tab. This provides general, but useful, information about your computer. The best way to start becoming acquainted with Windows Resource Monitor is probably the graphs on the right side of the Overview tab. There are graphs here for your processor, hard disk, network and memory. These graphs will tell you how much of each is being used.
A computer at idle should display each graph as nearly flat. There may be minor spikes in usage, typically due to background processes, but these spikes should be few and they shouldn’t significantly consume system resources.

Other usage scenarios will result in distinct patterns. For example, it is normal to see high disk activity and high network usage when you are downloading a file. It is also normal to see high disk activity while your virus scanning software is operating.

Sudden (or not-so-sudden), unexplained spikes are not normal. They may be the result of bloatware (unwanted programs that come pre-installed in your system), an inefficient antivirus program, a program that did not close correctly or even malware.

A Deeper Look At CPU Usage
Open the CPU tab of Windows Resource Monitor. When you do so, the graphs on the right will change. You’ll now be shown a graph for each core Windows detects (or two graphs for each core if you have an Intel processor with Hyper-Threading enabled). The total CPU usage graph remains, as well.

But the most important information here is not the graphs. What you’ll need to take a closer look at is the text information under the labels of Processes and Services. A process is an active application, while a service is a background application that conforms to special rules (it can run automatically on boot, it can run when no user is logged on, etc).
When it comes to checking out processor usage, however, you’ll organize both using the same tactic. Simply organize the processes or services by the average CPU value. Tada! You now know what programs are taking up your processor’s power. Please note that common processes and services can sometimes appear under odd names in Windows Resource Monitor. Be sure to Google an unknown program and identify it before you close it.

Analyzing Memory Usage
The way your computer uses its short-term memory (RAM) is important to overall performance. If you’re running low on available memory you’ll find that your computer’s performance becomes sluggish.

RAM usage can be found under the Memory tab. A new, useful line graph appears at the bottom of Windows Resource Monitor. This graph shows you how much memory is in use, how much is on stand-by (containing active data, but not actively in use) and how much is completely free.
Ideally you’ll want to see some free memory on this graph. The real problem, however, comes when your in-use memory fills up most of the graph. This means you simply don’t have any RAM left to use! You can free up memory by organizing processes by their Working memory share and shutting down memory hogs. If your system has limited memory, however, you may simply need to add more memory to your PC.

Hard Disk & Network Usage
Most users underestimate the effect their hard drive can have on overall system performance. The speed with which you can download files, install programs, transfer information, and open programs can all be affected by your hard drive’s performance. Sometimes a program, such an anti-virus scanner, will bombard your hard disk with requests for information.
Opening up the Disk tab will show you the Processes with Disk Activity display. This shows you all the active processes that are consuming your hard disk’s time. You’ll usually see a few common Windows processors, like System and svchost.exe, listed here. But you may also see other programs. This may clue you in as to why programs are loading slowly.

Finally, take a look at the Network tab. You will again see a Processes with Network Activity display, which is very useful for tracking down programs that are making unwanted network connections (although nasty malware is often programmed to dodge Windows Resource Monitor or disguise itself as a more innocent process). You can also analyze your active network connections using the TCP connections display.

Conclusion
Familiarzing yourself with Windows Resource Monitor is a great idea. It is a very effective program that can tell you a lot about why your computer is behaving well or poorly. You can track down runaway programs and close them, and you can also see if a hardware upgrade is necessary to use the programs you prefer.

COMMENTS:
- Ctrl + Shift + Esc will open Task Manager (XP, Vista and Windows 7) without having to go through Ctrl + Alt + Del. This appears to be disabled on some brand name machines, but will work for most people.
- You can also type Resource Monitor (or just resmon,as resmon.exe) directly into the searchbox in the Start Menu to open it directly, funny thing is lot of windows 7 users doesn't know about this built-in utiity. Sphere: Related Content