How to Check Your Motherboard Model Number on Your Windows PC

Whether you need to update drivers, want to check hardware compatibility, or you’re just curious, it’s way easier to check your motherboard model number with these simple tricks than it is to crack open your computer case to check the board itself. Read on as we show you how to check your motherboard model number from the comfort of your keyboard.

Why Do I Want To Do This?

There are a variety of situations where knowing your motherboard’s model number is important: upgrading your drivers, buying new hardware (you’ll need the proper expansion slots for card-based upgrades and the right memory DIMMS for memory upgrades, etc.), and checking the capabilities of your board if you’re considering upgrading the entire thing.

If you kept the paperwork that came with your computer (or the individual components if you built it yourself) you can often times reference that. Even then, it’s best to check to make sure the documentation is correct. Rather than open the case and search for the model number, it’s easy to use tools within Windows to check things out.

Checking Your Model Number via CMD.exe

If you’re comfortable using the command line, you can easily check a variety of motherboard and hardware stats using the handy Windows Management Instrumentation Command-line (WMIC) a command-line interface for Microsoft’s powerful WMI tool.

With the WMIC we can entry the query baseboard to check motherboard stats and then additional specific query modifiers like get Manufacturer, Model, Name, PartNumber, slotlayout, serialnumber, poweredon to get more detailed information about the motherboard. Let’s check our motherboard’s manufacturer, model number, and serial number using WMIC.

Open up the command prompt in Windows via either the run dialog (WIN+R) or via the search in the start menu; enter cmd.exe into either, no need to run it as an administrator. Enter the following text at the command line.

wmic baseboard get product,Manufacturer,version,serialnumber

This will return the following data.

The above information checks out for our system: the manufacturer is MSI, the board is the Z87-G45 (MS-7821), and while the WMIC tool attempted to check the serial number apparently, alas, MSI left that particular bit unfilled for whatever reason. None the less, the WMIC tool functioned just as it should, and without opening the case or using any third party tools we have the basic information we’re looking for.

Checking Your Model Number via Speccy

If you’d prefer a GUI-based way to check your motherboard’s model number (as well as a method that yields more information at a glance than the WMIC tool), the free tool Speccy by Piriform (the folks that brought us CCleaner) is a handy app to have around.

Grab a free download here and then fire it up.

Not only will it tell your model number, as seen above, but if you click on the Motherboard entry in the left hand navigation column, you can check even more information about the motherboard like the chipset and voltage settings.

---

Have a pressing tech question, hardware releated or otherwise? Shoot us an email at ask@howtogeek.com and we’ll do our best to answer it.

How to Create Encrypted Zip or 7z Archives on Any Operating System

Zip files can be password-protected, but the standard Zip encryption scheme is extremely weak. If your operating system has a built-in way to encrypt zip files, you probably shouldn’t use it.

To gain the actual benefits of encryption, you should use AES-256 encryption. 7z archives support this natively, but you can also encrypt Zip files with AES-256 encryption.

Zip 2.0 Legacy Encryption vs. AES Encryption

There are actually two types of Zip file encryption. The older Zip 2.0 encryption is extremely insecure, while the newer AES encryption is fairly secure.

Unfortunately, many pieces of software — particularly operating systems with built-in support for Zip files — don’t support the newer AES encryption standard. This means that using the Zip password-protection features found in Windows XP, current versions of Mac OS X, and even typical Linux desktops won’t give you securely encrypted Zip files. Even some third-party utilities are reluctant to switch to AES for their Zip encryption as it means those AES-encrypted zip files will then be incompatible with the built-in Zip features in Windows, Mac OS X, and other software.

It’s still possible to get AES encryption with Zip files — but such files will require third-party software to view, anyway. You may just want to use a different archive format, such as 7z. The 7z archive format requires strong AES-256 encryption. Whenever you create a password-protected 7z file, you know that it’s securely encrypted. Really, 7z is great — it came out on top in our file-compression benchmarks. It’s generally on the top of other file compression benchmarks we’ve seen, too.

Windows – 7-Zip

Windows offers a built-in way to create Zip files. Windows XP even offered a way to password-protect and encrypt these Zip files. However, Windows XP used the extremely insecure “standard” zip file encryption algorithm. Even if you’re still using Windows XP, you shouldn’t use this feature. Later versions of Windows dropped the password-protection option entirely.

Nearly every popular encryption utility offers this features. We like 7-Zip, which is completely free and open-source, so it won’t try to nag you for any money.

With 7-Zip installed, you can select some files in a File Explorer or Windows Explorer window, right-click them, and select 7-Zip > Add to archive. Be sure to select the “Add to archive” option, as it gives you the ability to set a password. If you don’t see the menu option here, you can also open the 7-Zip application directly and use it to create an archive.

7-Zip will create a 7z archive by default, but you can also choose Zip. If you do opt to go with Zip, be sure to select the AES-256 encryption method instead of the weaker ZipCrypto method. Enter your password into the provided boxes and click OK to create your encrypted archive file.

Mac – Keka

Mac OS X also provides an easy way to create Zip files from a Finder window, but there’s no way to encrypt a zip file with the graphical user interface. The zip command included with Mac OS X does offer a way to encrypt zip files without using any third-party software. However, like the password-protection feature built into Windows XP, it uses the old and insecure standard zip encryption scheme. If you really wanted, you could use the “zip -e” command in a Terminal on a Mac. However, we strongly recommend against this.

As on Windows, you’ll once again need a third-party file compression app for secure compression. Keka seems to be one of the most well-loved file compression and decompression apps for Mac, and we can recommend it. However, even Keka doesn’t use AES for encrypting Zip files by default. You can get the currently-in-beta version of Keka and enable a hidden option to do this, or just use the standard version of Keka and create encrypted 7z files instead.

Launch Keka, select 7z, and enter a password for your archive. (If you select Zip, be sure you have the correct version of Keka and that you’ve enabled the hidden option above to get the secure encryption.)

Drag and drop one or more files you want to compress onto the Keka window and they’ll be compressed into a 7z file encrypted with the password you provided. You’ll need the password to access the file’s contents in the future.

Linux – File Roller with p7zip-full

The standard Archive Manager (File Roller) application included with Ubuntu and other GNOME-based desktop environments does have an option to create password-protected zip files. However, the underlying zip command used still uses the old, weak encryption instead of strong AES encryption. Thankfully, File Roller can be used to create encrypted 7z archives.

To enable this option, you’ll first need to install the p7zip-full package. (On some Linux distributions, it may just be called p7zip instead.) For example, on Ubuntu, you can either open the Ubuntu Software Center, search for p7zip-full and install it, or open a Terminal window and run the sudo apt-get install p7zip-full command.

Once you have, you can create encrypted 7z files directly from the File Roller window. Select some files in a file manager window, right-click them, and select Compress — or open the Archive Manager application directly and use it to create a new archive.

In the Compress window, be sure to select the 7z archive format. Click the Other Options header and provide a password. The password will be used to unlock your archive later.

---

There are many different software programs for creating password-protected archives, but — whatever you use — be sure it’s using secure encryption. The problem with Zip encryption isn’t purely theoretical. The web is full of tools that can “recover” a password-protected zip file that was created using the old encryption scheme. “Recover” is a less-scary word for breaking and removing the encryption.

How to Check Your BIOS Version and Update it

You probably shouldn’t update your BIOS, but sometimes you need to. Here’s how to check what BIOS version your computer is using and flash that new BIOS version onto your motherboard as quickly and safely as possible.

Be very careful when updating your BIOS! If your computer freezes, crashes, or loses power during the process, the BIOS or UEFI firmware may be corrupted. This will render your computer unbootable — it’ll be “bricked.”

How to Check Your BIOS Version in Windows

Your computer’s BIOS version is displayed in the BIOS setup menu itself, but you don’t have to reboot to check this version number. There are several ways to see your BIOS version from within Windows, and they work the same on PCs with a traditional BIOS or a newer UEFI firmware.

To use a command, open a Command Prompt window — press Windows Key + R, type cmd into the Run dialog, and press Enter. Run the following command:

wmic bios get smbiosbiosversion

You’ll see the version number of the BIOS or UEFI firmware in your current PC.

You can also find your BIOS’s version number in the System Information window. On Windows 7, you can search the Start menu for System Information to find it. On Windows 8, it’s more hidden — but you can still launch the System Information panel on Windows 8.

The BIOS version number is displayed on the System Summary pane. Look at the BIOS Version/Date field.

How to Update Your BIOS

Different motherboards use different utilities and procedures, so there’s no one-size-fits-all set of instructions here. However, you’ll perform the same basic process on all motherboards.

First, head to the motherboard manufacturer’s website and find the Downloads or Support page for your specific model of motherboard. You should see a list of available BIOS versions, along with any changes/bug fixes in each and the dates they were released. Download the one you want to update to. You’ll probably want the newest BIOS version unless you want an older one for a specific reason.

If you purchased a pre-built computer, head to the computer manufacturer’s website, look up the computer model, and look at its downloads page. You’ll find any available BIOS updates there.

Your BIOS download probably came in an archive — usually a .zip file. Extract the contents of that file. You’ll find some sort of BIOS file — in the screenshot below, it’s the E7887IMS.140 file.

The archive should also contain a README file that will walk you through updating to the new BIOS. You should check out this file for instructions that apply specifically to your hardware, but we’ll try to cover the basics that work across all hardware here.

You’ll need to choose one of several different types of BIOS-flashing tools depending on your motherboard and what it supports. The BIOS update’s included README file should recommend the ideal option for your hardware.

Some manufacturers offer a BIOS-flashing option in their BIOS, or as a special key-press option when you boot the computer. You copy the BIOS file to a USB drive, reboot your computer, and enter the BIOS or UEFI screen. From there, you choose the BIOS-updating option, select the BIOS file you placed on the USB drive, and the BIOS updates to the new version.

You generally access the BIOS screen by pressing the appropriate key while your computer boots — it’s often displayed on the screen during the boot process and will be noted in your motherboard or PC’s manual. Common BIOS keys include Delete and F2. The process forentering a UEFI setup screen on a Windows 8 PC is a bit different.

There are also more traditional DOS-based BIOS-flashing tools. You’d create a DOS live USB drive and copy the BIOS-flashing utility and BIOS file to that USB drive. You’d then reboot your computer and boot from the USB drive. In the minimal DOS environment, you’d run the appropriate command — often something like flash.bat BIOS3245.bin — and the tool would flash the new version of the BIOS.

The DOS-based flashing tool is often provided in the BIOS archive you download from the manufacturer’s website, although you may have to download it separately. Look for a file with the .bat or .exe file extension.

In the past, this process was performed with bootable floppy disks and CDs. We recommend a USB drive because it would probably be the easiest method on modern hardware.

Some manufacturers provide Windows-based flashing tools, which you run on the Windows desktop to flash your BIOS and then reboot. We don’t recommend using these, and even many manufacturers who provide these tools usually caution against using them. For example, MSI “strongly recommends” using their BIOS-based menu option instead of their Windows-based utility in the README file of the sample BIOS update we downloaded.

Flashing your BIOS from within Windows can result in more problems. All that software running in the background — including security programs that may interfere with writing to the computer’s BIOS — could cause the process to fail and corrupt your BIOS. Any system crashes or freezes could also result in a corrupted BIOS. It’s better to be safe than sorry, so you should use a BIOS-based flashing tool or boot to a minimal DOS environment to flash your BIOS.

---

That’s it — after you run the BIOS-flashing utility, you’ll reboot your computer and immediately begin using the new BIOS or UEFI firmware version. If there’s a problem with the new BIOS version, you may be able to downgrade it by downloading an older version from the manufacturer’s website and repeating the flashing process.

How to Bypass and Reset the Password on Every Operating System

Passwords can be reset or bypassed on every operating system. On Windows, Linux, and Mac OS X, you can gain access to a computer’s unencrypted files after resetting the password — the password doesn’t actually prevent access to your files.

On other devices where you can’t gain access to the files, you can still reset the device and gain access to it without knowing a password. These tricks all require physical access to the device.

Windows

Resetting a password without an official tool is fairly simple. For example, the Offline NT Password & Registry Editor works well for this. First, you’ll need to boot from a special disc or USB drive — either a live Linux system or a specialized Offline NT Password & Registry Editor boot disc. The tool can edit the Windows registry, allowing you to clear the password associated with the user account. You can then boot into Windows and log into the account without a password.There are many ways to reset a Windows password. Windows allows you to create a password reset disk that can reset your password in an approved way — create a disk first and you can use it if you ever need it.

Even if you’re using Windows 8 with a Microsoft account, you can always reset the password of the built-in Administrator account to gain access.

To protect against this, you could password-protect your BIOS and restrict booting from external devices. Someone with physical access to the PC could reset the BIOS password to bypass this.Encrypting your Windows system drive with something like BitLocker would prevent the registry from being accessed and modified with this tool — encryption is the only good protection.

Linux

We’ll use Ubuntu as a concrete example here. Ubuntu offers a recovery mode in its default Grub boot menu — select Advanced options for Ubuntu and select Recovery mode. You’ll see the boot menu while booting your computer — if you don’t, you can hold the Shift key as you boot and the menu will appear.  You can easily boot directly to a root shell prompt from here.

This option isn’t necessary, as you can just press the e button to edit Ubuntu’s boot options and boot directly to a root shell prompt from within the main Grub menu. You’ll then be able to use the root shell to reset and change passwords on the system. If the Grub boot menu is locked and password-protected, you can still boot to Linux live media and change your password from there.

Once again, encryption would prevent your system from being accessed and modified without your encryption passphrase. We used Ubuntu as an example, but almost every Linux distribution uses Grub and few people set a Grub password.

Mac OS X

Macs have a built-in password reset tool, and it’s very easy to access. This option is available in recovery mode. You’ll need to restart your Mac by clicking the Apple menu and selecting Restart. Press and hold the Command + R keys as the computer boots and it will boot into recovery mode.

Click the Utilities menu in recovery mode, select Terminal, type resetpassword into the terminal, and press Enter. You’ll see the Reset Password utility, which allows you to reset the password of a any user account on the Mac. You can also access this tool from a Mac OS X installation disc.

To prevent your Mac’s password from being reset, you could enable FileVault disk encryption on your Mac, set a firmware password inside recovery mode, or both.

Chrome OS

Your Chromebook’s user account password is your Google account password. You could reset your Google account password on the web to regain access.

Let’s say you have a Chromebook you want to use, but you can’t sign in. Perhaps you’ve forgotten the Google password associated with the device. Perhaps an old Google account is considered the device’s owner account. In this scenario, you can boot the Chromebook to the sign-in screen and press Ctrl + Shift + Alt + R at the same time. You’ll be prompted to factory reset your Chromebook with Powerwash. After you reset it, you can log in with another Google account and that Google account will be considered the owner account. This will erase all data on the device, but most Chromebook data is synced online.

There’s no way to gain access to a user’s files without their password on a Chromebook — those files are encrypted by default.

Android

If you don’t have this information either, you may be able to bypass the lock screen in other ways. This should be easy on a device with USB debugging enabled, as you can connect it to a computer and manipulate it over USB with adb — that’s why USB debugging is disabled by default.If you forget your Android’s lock screen code, you can reset it. Try an incorrect password, PIN, or pattern a few times and you’ll eventually see a “Forgot password,” “Forgot PIN,” or “Forgot pattern” option. You can then regain access to your device by entering the username and password of the Google account associated with your device.

You can’t bypass the lock screen without your Google account password unless there’s a hole open in the device — for example, USB debugging. If you want to use the device, you can stillperform a factory reset from recovery mode — this will set the device back to its factory state, wiping the data on it . You can then log in and set up the device with another Google account.

iOS

RELATED ARTICLE

iPhones, iPads, and iPod Touches are also built without a way to reset the password. Unlike on Android, you can’t just reset the device’s password with your Apple ID information. If you forget your iOS device’s password, you’ll have to perform a factory reset. However, if you’re syncing the device to an Apple ID and you still remember your Apple ID password, all your device’s data can be restored afterward thanks toiCloud backups.

You can do this in several ways. If you’ve set up Find My iPhone, you can visit the iCloud websiteand erase your device from there. If you’ve backed up your device to iTunes on a computer, you can connect the device to your computer and restore your device from an iTunes backup.

If you don’t have access to Find My iPhone and you’ve never backed up the device to iTunes, you can still reset the device using recovery mode. Turn off the device, press and hold the Home button, and then connect the device’s USB cable to your computer. If it doesn’t turn on automatically, turn it on. iTunes will tell you it’s detected a device in recovery mode and allow you to restore it to factory default settings.

---

Passwords keep honest people honest, and they ensure people can’t gain access to your device without knowing the tricks or looking them up. But, if someone has physical access to your device and wants to bypass the password, there’s nothing you can do to stop them. Even encrypting your files will only protect your personal data — they can always wipe the encrypted data and start over fresh.

Using Process Monitor to Troubleshoot and Find Registry Hacks

In today’s edition of Geek School we’re going to teach you how to use Process Monitor to actually accomplish troubleshooting and figuring out registry hacks that you would not know about otherwise.

SCHOOL NAVIGATION

Process Monitor is one of the most impressive tools that you can have in your toolkit, as there is almost no other way to see what an application is actually doing under the hood. It is the only way to know what files are being written to by which process, and where things are stored in the registry, and which files are accessing them.

We’ll start off with today’s lesson by looking at how to find registry keys using Windows setting dialogs and Process Monitor, and then we’ll go through an actual troubleshooting scenario that we encountered on one of our computers in the lab, and easily solved using Process Monitor.

Using Process Explorer to Find Registry Keys for Common Settings

Everybody has clicked a checkbox or changed the value of a drop-down box at some point, but have you ever wondered where those values are actually stored? Many applications, and virtually everything in Windows, is stored in the Registry… somewhere.

For today’s example we’re going to use the first option on the first pane of Taskbar and Navigation Properties, which is a dialog that should exist in all versions of Windows. So now our mission is to figure out where that setting is actually stored in the registry. You can follow along with this particular setting, or you can try one of the other settings on the same dialog — or anywhere else you’d like to find the hidden setting location for.

The first thing you’ll want to do whenever trying to capture a set of data is to launch Process Monitor, and then change the setting. At that point you can stop Process Monitor from continuing to capture events, so the list doesn’t get out of control. (Hint: the File menu has the option, or it’s the third icon from the left).

Now that we’ve got a ton of data in the list, it’s time to filter the list to reduce the number of rows that we’re going to have to look through. Since we’re looking at a registry value that is being changed, we’ll need to filter by “RegSetValue”, which is what Windows uses to actually set a registry key to a new setting. Use the “Include” option to show only those events.

Your list should now be limited to just registry keys that were changed, so it’s time to take a look at the events and try to figure out which registry key it might be. Since we’re checking the “Lock the Taskbar” setting, and one of the registry keys being set includes the word “Taskbar” in the name, that’s a good place to start. Right-click on the path and choose to Jump To the location.

Process Monitor will open up the Registry Editor and highlight the key in the list. Now we need to make sure that this is actually the right key, which is pretty easy to figure out. Take a look at the setting, and then take a look at the key. Right now the setting is on, and the key is set to 0.

So change the setting, hit Apply on the dialog, and then use the F5 key to refresh the Registry Editor window. In our case we definitely picked the right setting, so now you can see that the TaskbarSizeMove value is set to 1.

If you didn’t pick the right value, you won’t see a change when you do the setting test again. So go and find the next logical one, and start over.

Troubleshooting Problems with Process Monitor

It’s not really possible to illustrate in a single article how to troubleshoot any problem with Process Monitor, or any other tool for that matter. There are just way too many combinations of issues that could possibly go wrong.

What we can do, however, is show how we actually used Process Monitor to troubleshoot a real problem that actually happened to one of our test computers. We had been installing some crapware, and then decided to try and clean the computer up. The problem was an entry in the Uninstall Programs panel that just wouldn’t go away.

Every time you would click to Change so you could remove it, you’d get an error that said “An error occurred while trying to uninstall AwfulApp. It may have already been uninstalled. Would you like to remove AwfulApp from the Programs and Features list?”.

That would have been great, except we then got an error that said “You do not have sufficient access to remove OutfoxTV from the Programs and Features list. Please contact your system administrator.”

The first thing to do was try the uninstall process again with Process Monitor running, which captured an enormous amount of data. This time we decided to use the Find feature (CTRL + F) to quickly find what we were looking for in the list. You could also use a Filter if you wanted, but this seemed simple, and luckily it worked the first time.

After taking a look at the first item in the list, we noticed an error: Windows was attempting to access the registry keys related to the uninstaller, but they weren’t actually in the registry in the first spot that Windows was looking. If you look a couple of keys down though, you’ll see a RegOpenKey event with a SUCCESS result for something under HKLM\Software\Wow6432Node.

Doing a search by that registry key very quickly landed us at the source of the problem: an ACCESS DENIED message when Windows tried to do the cleanup for the list using the RegDeleteKey operation. Interesting!

The first thing to do was use the Jump To feature to find the key in the registry and take a look.

Sure enough, look at all those registry keys over there! No wonder it is still appearing in the list.

Just to be sure, we opened up the C:\Program Files\ directory to see if any of the files were still around, but clearly the app had been wiped off the PC already.

The solution was very simple: we just manually deleted the registry key that Windows had problems deleting. If we had received an access denied message, we could have used the Permissions setting to make sure that we have access and tried again.

Luckily the delete worked immediately, and our Uninstall Programs list was now clear.

These are just a few of the many ways that you can use Process Monitor – it is an extremely important and useful utility that will take some time to master, but once you do, it can really help you solve many problems.

Next Lesson

Starting on Monday with the next lesson, we’ll examine many of the other utilities in the SysInternals Toolkit, including some of the powerful command line tools.

Lesson 2: Understanding Process Explorer

This lesson in our Geek School series covers Process Explorer, perhaps the most used and useful application in the SysInternals toolkit. But how well do you really know this utility?

Process Explorer, a task manager and system monitor application, has been around since 2001, and while it used to even work on Windows 9x, the modern versions only support XP and above, and they’ve been continually updated with features for modern versions of Windows. It’s the defacto standard for dealing with troubleshooting processes.

So What Can Process Explorer Do?

Some of the better features include the following, although this is by no means an exhaustive list. This application has many features, and many of those are buried deep within the interface. Amazingly it’s also a very small file.

• The default tree view shows the hierarchical parent relationship between processes, and displays using colors to easily understand processes at a glance.
• Very accurate CPU usage tracking for processes.
• Can be used to replace Task Manager, which is especially useful on XP, Vista, and Windows 7.
• Can add multiple tray icons to monitor CPU, Disk, GPU, Network, and more.
• Figure out which process has loaded a DLL file.
• Figure out which process is running an open window.
• Figure out which process has a file or folder open and locked.
• View complete data about any process, including threads, memory usage, handles, objects, and pretty much anything else there is to know.
• Can Kill an entire process tree, including any processes started by the one you choose to kill.
• Can Suspend a process, freezing all its threads so they do nothing.
• Can see which thread in a process is actually maxing out the CPU.
• The latest version (v16) integrates VirusTotal into the interface so you can check a process for viruses without leaving Process Explorer.

Any time you have a problem with an application, or something keeps freezing on your computer, or maybe you are trying to figure out what a particular DLL file is used for, Process Explorer is the tool for the job.

Understanding The Tree View

When you first launch Process Explorer, you are presented with a lot of visual data right away – there is a hierarchical tree view of the processes running on your computer, including CPU and RAM usage using numerical values for each process. There are some little mini activity graphs running at the top in the toolbar, showing you the CPU usage, which can be clicked on to display in a separate window.

There’s definitely a lot going on, and it would be easy to be overwhelmed by everything on the screen.

The initial display gives you a set of columns that include:

• Process – the file name of the executable along with the icon if one exists.
• CPU – the percentage of CPU time in the last second (or whatever the update speed is set to)
• Private Bytes – the amount of memory allocated to this program alone.
• Working Set – the amount of actual RAM allocated to this program by Windows.
• PID  - the process identifier.
• Description – the description, if the application has one.
• Company Name – this one is more useful than you think. If something isn’t quite right, start by looking for processes that aren’t by Microsoft.

You can customize these columns and add many other options, or you can just click on any of the columns to sort by that field. If you’ve ever used Task Manager before, you’ve probably sorted by Memory or CPU, and you can do that here as well.

Clicking on Process will flip between sorting by the process name, or going back to the default tree view, which is very useful once you get used to it.

The view is updated once per second, but you can go to View -> Update Speed and customize how often it updates, the lowest being 0.5 seconds and the top level being 10 seconds. If you are using it for troubleshooting the default value is probably fine, but if you want to use it as a CPU monitor sitting in the system tray, 5 or 10 seconds might use less CPU while it runs in the background.

You can also pause the view under the same sub-menu, or by simply hitting the Space bar. This will freeze the view as a snapshot in time, which can be useful if you are trying to identify a process that starts and quickly dies, or if you have decided to sort by CPU usage and all the rows keep jumping around.

In the case of a quickly closing process, however, you would want to add extra columns to the default view for anything you might need to know, because clicking on a defunct process in the list won’t show much in the details view if the process isn’t running, even if you paused everything.

Understanding All Those Colors

There are definitely a lot of colors in a typical Process Explorer list, which can be a little confusing for the beginner geek. It’s really important to learn what all these colors mean, because they aren’t there just for show — they each mean something important.

Whenever you can’t remember what one of the colors means, you can go to Options -> Configure Colors on the menu to pull up the Color Selection dialog. This is basically a quick cheat sheet to what everything means. Keep reading, since we’re going to explain it here as well.

Based on the colors in the picture above, here is what each of the selected items mean (the others aren’t really important).

• New Objects (Bright Green) – When a new process shows up in Process Explorer, it starts out as bright green.
• Deleted Objects (Red) – When a process is killed or closes it will usually flash red right before deleting.
• Own Processes (Light Blueish) – Processes running as the same user account as Process Explorer.
• Services (Light Pink) – Windows Service processes, although it’s worth noting that they might have child processes that are launched as a different user, and those might be a different color.
• Suspended Processes (Dark Gray) – When a process is suspended it can’t do anything. You can easily use Process Explorer to suspend an application. Sometimes crashed apps will briefly show up in gray while Windows is handling the crash.
• Immersive Process (Bright Blue) – This is just a fancy way of saying that the process is a Windows 8 application using the new APIs. In the screenshot earlier you might have noticed WSHost.exe, which is a “Windows Store Host” process that runs Metro apps. For some reason Explorer.exe and Task Manager will also show up as immersive.
• Packed Images (Purple) – these processes might contain compressed code hidden inside of them, or at least Process Explorer thinks that they do by using heuristics. If you see a purple process, make sure to scan for malware!

Since there is obviously some overlap between these different scenarios, the colors will be applied in an order of precedence. If a process is a service and is suspended, it will display in dark gray because that color is more important.

From what we’ve learned while researching, the order is Suspended > Packed > Immersive > Services -> Own Processes.

Verifying Application Identity

One really useful option that we’re surprised isn’t enabled by default is found at Options -> Verify Image Signatures.

This option will check the digital signature for each executable file in the list, which is an invaluable troubleshooting tool when you are looking at some suspicious application that is running in the list.

The vast majority of reputable software should be digitally signed at this point. If something isn’t, you should look very carefully at whether you should be using it.

Taking Action on a Process

You can quickly take action on any process by right-clicking on it and choosing from one of the options, or by using the shortcut keys if you prefer. Those options include:

• Window – has options including Bring to Front, which can be useful to help identify the window associated with a process. If there are no windows for that process, it will be grayed out.
• Set Priority – you can use this to configure the priority of a process. This is mostly useful for taming a runaway process that you don’t want to kill.
• Kill Process – just like you’d imagine, this quickly kills that process.
• Kill Process Tree – This kills not just the item in the list, but also the children of that parent process.
• Restart – spectacularly useful while testing, this just kills the process and then restarts it. It’s worth noting that killing processes might result in lost data.
• Suspend – this handy option is great for troubleshooting when a process is out of control. You can simply suspend the process rather than kill it, and check to see if anything is out of whack.
• Check VirusTotal – this is a new option that we’ll explain further along. It’s quite handy really, as it checks the process for viruses.
• Search Online – this will just search the web for the name of the process.

And obviously if you open up Properties that will take you to even more useful information about the process, much of which we’ll get into in the next lesson. 

Note: we tested out the Temp option but did not have any idea what it does.

Running as Administrator

While you don’t absolutely have to run Process Explorer as Administrator, without doing so many of the useful features won’t work, and you won’t be able to see as much information about each process.

If you are running on Windows XP or 2003, you will need to be running as an account that has full Administrator rights to use most of the features. This is probably not a problem for most people, because XP gave the default account full privileges anyway, but if you are trying to use this at work without administrator access, it won’t work quite as well.

Since most of our readers are using Windows 7, 8.x, or even Vista, you’ll probably be familiar with running an application as Administrator. It’s really easy… just right-click and choose the option from the menu.

Fun fact: Process Explorer actually uses the Debug Programs privilege, which goes a long way to explain why it is so powerful.

Forcing Process Explorer to Always Open as Administrator

If you want to make sure that Process Explorer always opens as Administrator without having to remember to right-click on it, you can force it by either making a special shortcut that requires Administrator mode, or by opening up the Properties for procexp.exe, going to Compatibility, and then choosing the option for “Run this program as an administrator”.

Either way will work just fine, or you could also just disable UAC if you prefer, which makes everything run as administrator all the time. We’re not recommending that, but you can do it.

Using Process Explorer to Replace Task Manager

Process Explorer has long been used as a powerful replacement for the previously anemic Task Manager application in every version of Windows prior to Windows 8, and assuming you want some real power in your hands, it works really well as a replacement in that version too.

Note: Windows 8’s Task Manager is greatly improved from previous versions. It’s still not as powerful as Process Explorer, but it’s probably easier for regular people to use. So don’t change mom’s computer to default to Process Explorer.

To make Process Explorer replace Task Manager, all you have to do is choose the Options -> Replace Task Manager option from the menu. That’s it.

Once you’ve done that, using CTRL + SHIFT + ESC or right-clicking on the Taskbar will both launch Process Explorer rather than Task Manager. Easy, right?

Warning: if you do replace Task Manager, make absolutely certain that you’ve put Process Explorer in a place that you won’t be accidentally moving or deleting the file. Otherwise you’ll be stuck with a system that can’t launch any Task Manager.

Using Process Explorer as an Awesome Tray Icon Monitor

One of the best features of Process Explorer is the ability to minimize it into the system tray, but instead of just a single icon, it can minimize into a full set of icons that can monitor CPU, I/O, Disk, Network, GPU, and RAM, or any combination of them. You can configure them to display separately, or not at all, if you prefer.

To set this up, open up the Options menu, go to the Tray Icons section, and then click to enable each of the tray icons that you would like to see.

You could just run Process Explorer every time you start running your computer, and then minimize it to the system tray so it will always be there for you. And, of course, if you used the option to replace Task Manager, you can quickly access it any time with a shortcut key – though you might want to use the “Allow Only One Instance” option to make sure you don’t open a bunch of separate windows.

Using Process Explorer to Quickly Search VirusTotal

If you are working on a problem PC and want to figure out if a process is a virus, you can save yourself some time by using Process Explorer version 16 or above, because they’ve added VirusTotal integration directly into the application. Just right-click on anything in the list to see the option.

The first time you run it, you’ll be asked to accept the VirusTotal terms of use, but after you do so, you will see the VirusTotal results show up right there in the list.

You can click on the result to go to VirusTotal and see the details.  It’s a great new addition to one of the best utilities ever.