Installing and Configuring Operating Systems

An operating system manages the processor, memory, storage, and devices so applications can run. It also provides the user interface and organizes files. Choosing one involves the applications, hardware, and management features a user needs.

Recognize the operating system

Windows is Microsoft's desktop OS. Apple supplies macOS with Macs. Linux is a kernel distributed with other software as systems such as Ubuntu, Debian, and Fedora. ChromeOS is Google's Linux-based system for Chromebooks. Apple's iOS and iPadOS and Google's Android serve mobile devices. A familiar-looking file or app is not enough to establish compatibility across these systems.

Choose features through the edition

Windows 11 Home suits everyday personal use. Pro adds domain and Microsoft Entra ID join, the local Group Policy Editor, Local Users and Groups, incoming Remote Desktop hosting, and full BitLocker management. Home can connect to an RDP host and supports Device encryption on eligible hardware, but those features do not make it a Pro computer.

Education and Pro Education serve schools; Enterprise adds organizational management and security features. Pro for Workstations supports high-end hardware. Pro does not make ordinary apps faster just because it is a higher edition. Home supports up to 128 GB of RAM, Pro 2 TB, and Pro for Workstations and Enterprise 6 TB.

An N edition omits certain media technologies. If a verified media or video-call app depends on them, install the Media Feature Pack through Optional features. The matching non-N edition avoids that extra dependency.

Separate version from edition

Run winver for the version and build. Windows 11's annual releases use names such as 25H2 and 26H2; 26H2 became available September 29, 2026. Home, Pro, Pro Education, and Pro for Workstations versions normally receive 24 months of servicing; Enterprise and Education receive 36. Thus 24H2 Home and Pro ended servicing in October 2026 while Enterprise and Education continue to October 2027.

Windows 10's regular support ended October 14, 2025. Enrolled consumers can receive security-only ESU coverage through October 12, 2027; commercial ESU is licensed annually. Continued startup is different from continued security servicing. Check the installed edition and version against the vendor's life cycle.

Match the processor and drivers

Windows 11 is 64-bit: x64 or Arm64. Most 32-bit Windows apps run on 64-bit Windows, but 16-bit apps do not. Drivers must match the OS architecture; an x64 application running through emulation on Arm does not make an x64 driver usable there. A 32-bit address space contains about 4 GB of addresses, which limits usable memory.

Work through an office request

A firm needs company sign-in, incoming RDP, and BitLocker management on 32 GB laptops. Home misses those features; Pro meets them without requiring the workstation edition. Next check application and driver architecture, then the installed version's servicing dates. On the desktop, Windows 11 offers Snap layouts and a centered taskbar that can be aligned left; Start search helps find tools when layouts or display languages differ.

The installation method determines what happens to existing apps, settings, and data. Decide what must stay before choosing media or changing firmware.

Check readiness

Windows 11 requires a compatible 64-bit processor at 1 GHz or faster with at least two cores, 4 GB RAM, and 64 GB storage. It also needs UEFI firmware with Secure Boot capability, TPM 2.0, DirectX 12 graphics with WDDM 2.0, and a 720p display larger than about 23 cm diagonally. Business applications can require more RAM, storage, or graphics capability than these OS minimums. Home and Pro personal setup require internet access and a Microsoft account.

Use PC Health Check to identify an unmet requirement. Open tpm.msc for TPM status and msinfo32 for BIOS Mode and Secure Boot State. A firmware TPM may be called Intel PTT or AMD fTPM. A missing TPM report can mean it is disabled; an unsupported processor needs a different decision. Secure Boot verifies trusted startup software; the TPM protects cryptographic keys.

Choose what stays

• A clean install replaces the target installation. Restore data and reinstall apps afterward.
• An in-place upgrade keeps files, settings, and most apps while moving to a newer version.
• A repair install reinstalls Windows while retaining files and apps. Windows 11 offers a Windows Update repair in System > Recovery.
• Reset this PC reinstalls Windows. "Keep my files" preserves personal files but removes apps; "Remove everything" removes personal files too. Cloud download and local reinstall choose the source of Windows files.

A Windows 10 Home-to-Windows 11 Home upgrade is a version change. Home-to-Pro is an edition change through Activation. Pro-to-Home and 32-bit-to-64-bit changes need a clean install. Some supported Enterprise or Education downgrades to Pro preserve apps and settings. After a feature upgrade, Go back is normally available for 10 days while the old installation files remain.

Protect the work before starting

Check that a backup opens, record licenses, save the BitLocker recovery key, and confirm app and driver compatibility. Obtain any required storage driver before Setup. Check free space, connect laptop power, and disconnect unneeded peripherals. Firmware and TPM changes can trigger a recovery-key request.

Pick media and a deployment method

Create Microsoft's installation USB with a drive of at least 8 GB; creation erases that USB. Boot its UEFI entry from the one-time boot menu for a clean install. To upgrade from a running Windows session, mount an official ISO and run setup.exe. Recovery partitions and cloud reset provide other recovery sources.

For many PCs, a tested image reproduces a prepared system. PXE starts a machine from a network deployment service. Autopilot provisions a registered device with organizational settings and apps; it is not the same operation as copying a full disk image. For multiboot, install Windows first and Linux second so the Linux bootloader can detect Windows.

Apply the checks

A supported PC has sufficient RAM but reports Legacy BIOS Mode. Back up and save its recovery key, validate the MBR-to-GPT conversion plan, then coordinate conversion with the switch to UEFI. Enable the available TPM and Secure Boot and verify startup before the upgrade. Turning on firmware features does not make an unsupported CPU eligible.

Setup needs both a suitable boot mode and a suitable target disk. Reading the layout helps you distinguish the user's data volume from the small partitions Windows needs to start and recover.

Understand the layout

A partition is a region of a physical disk. A volume provides storage organized by a file system and may have a letter such as C:. The partition table records the disk layout.

MBR works with legacy BIOS. It supports four primary partitions, or three plus an extended partition containing logical drives. With 512-byte sectors its addressing limit is about 2.2 TB, exactly 2 TiB. Its main boot information sits in the first sector.

GPT supports much larger disks, up to 128 partitions in Windows, checksums, and a backup partition table. A normal Windows 11 system boots in UEFI mode from GPT. Selecting the legacy entry for a USB installer can put Setup in the wrong mode even when the computer supports UEFI.

On unallocated space, UEFI Windows Setup normally creates an EFI System Partition, a 16 MB Microsoft Reserved partition, the NTFS Windows partition, and a Recovery partition. The EFI partition uses FAT32 and stores boot files. The Windows volume receives C:; the other three normally have no letter. Their small size does not make them spare space.

Run a clean installation

1. Confirm the backup and identify the target disk by size and hardware details. Disconnect unrelated data disks when practical.
2. Boot official installation media through its UEFI entry. Select the language, region formats, and keyboard layout.
3. Enter the product key or use the existing digital license, and select the licensed edition.
4. Choose the clean-install option. Delete old partitions only on the confirmed target when replacing its entire contents. Select the resulting unallocated space and continue.
5. Let Setup copy files and restart. Continue into the installed system instead of starting the USB installation again.

If no drive appears, load the manufacturer's storage-controller driver from USB. RAID or Intel VMD controllers may require it. Changing the controller mode after installation can prevent startup.

Read the capacity correctly

A drive sold as 1 TB contains about one trillion bytes. Windows divides by 1,073,741,824 for the value it labels "GB," so the drive appears near 931 GB. A model holding 1,000,204,886,016 bytes appears as 931.5 GB. That difference comes from decimal and binary units, before considering the small system partitions.

Complete first-run setup

The out-of-box experience, or OOBE, collects the region, keyboard, network, device name, account, and privacy settings, then offers a Windows Hello PIN. Personal Home and Pro setups use a Microsoft account; organizational setups can use their work or school identity. Check the keyboard before setting a password: a different layout changes the characters typed.

Finish with activation, Windows Update, manufacturer drivers, and a Device Manager check for unknown or failing devices. Set the time zone and language, prepare the user's accounts, reinstall apps, restore files, and test them. A desktop that appears after Setup has finished only the operating-system part of the handover.

Windows divides configuration between the modern Settings app and classic Control Panel applets. Start search is useful when an option has moved or a computer uses a different display language.

Find the right area

Press Win+I for Settings. System > About identifies the device, processor, RAM, edition, and version. System also holds display, sound, storage, recovery, and power. Bluetooth & devices manages peripherals; Network & internet manages connections; Apps manages installed and default apps. Accounts, Time & language, Accessibility, Privacy & security, Personalization, Gaming, and Windows Update hold the remaining everyday controls.

Run control for Control Panel. Direct commands provide reliable shortcuts: appwiz.cpl opens Programs and Features, powercfg.cpl opens Power Options, sysdm.cpl opens System Properties, and ncpa.cpl opens network adapters. Other applets include Sound, User Accounts, Devices and Printers, Indexing Options, Internet Options, and File Explorer Options. The Mail applet manages classic Outlook profiles when that software is installed. Windows Tools groups administrative utilities.

Make file types visible

File Explorer can show extensions, hidden items, and protected system files through its View options. An extension identifies a file type; the icon and the first part of a name can be misleading. If "delivery.pdf" becomes delivery.pdf.exe when extensions are shown, it is an executable program. Do not open a suspicious attachment. Showing protected system files exposes critical files; it does not make them safe to remove.

Understand power behavior

Sleep retains the session in powered RAM. Hibernate saves it to hiberfil.sys and powers off. A sudden loss of RAM power can lose unsaved work; a laptop with hibernation available normally hibernates at a critical battery level. Fast startup signs out users but hibernates the kernel during shutdown. Restart reloads Windows fully and is the useful first action when a driver or system state seems stuck.

Control Panel's power plan controls timeouts, lid and button behavior, and advanced settings such as USB selective suspend. Windows 11's power mode is a separate choice under System > Power & battery. If a USB scanner disconnects when idle, check its behavior and relevant power settings; changing the whole laptop to maximum performance is a much broader change.

Match settings to the situation

A Public network profile limits discovery and sharing, appropriate on an untrusted connection. Private enables trusted-network discovery and sharing rules. Choosing Private does not make an unfamiliar network trustworthy. Metered connections limit some background data use.

Time & language controls time zone, region formats, display language, and keyboards. Win+Space switches keyboard layouts. A wrong clock can disrupt sign-in and certificate checks; a wrong layout can change a password's typed characters. Check the visible layout before resetting an account.

For a camera that works in one app but not another, inspect that app's camera permission in Privacy & security. For a file opening in the wrong program, change its default app. These checks connect the symptom to a particular setting instead of changing unrelated preferences.

A slow PC needs evidence about the resource under pressure and the program using it. A brief spike just after sign-in differs from sustained high use during ordinary work.

Start with Task Manager

Press Ctrl+Shift+Esc. Processes shows apps and background processes with CPU, memory, disk, and network use. Sort the relevant column to find the largest user. Performance shows totals and graphs, uptime, and hardware details. Details gives executable names, process IDs, and priorities. Users shows other signed-in sessions; Services links processes to services. App history provides usage history for supported apps.

Suppose Performance shows 11.4 of 12 GB memory in use. Processes shows an editing app using 5 GB and a browser using 3 GB. Ask what work is open, save it, close unnecessary files or tabs, and observe memory again. Sustained normal workloads that exceed available memory justify considering more RAM. A single large process is a clue to investigate, not permission to terminate it blindly.

End task stops a current process and can discard unsaved work. Startup apps > Disable prevents automatic launch at sign-in but leaves the running copy alone. These actions solve different problems. Check the name, publisher, and file location of unfamiliar processes; critical Windows processes must keep running.

Choose more detail or a longer view

Resource Monitor (resmon.exe) connects processes to particular disk files and network activity. Under CPU > Associated Handles, search a file name to find the process holding it open. Close that file through the app when possible.

Performance Monitor (perfmon.msc) records counters over time through data collector sets. It suits a slowdown that occurs only at certain times. System Information (msinfo32) supplies the system model, BIOS Mode, Secure Boot state, RAM, drivers, and other inventory facts for a ticket. It is not a live performance trace.

Compare Safe Mode and a clean boot

System Configuration (msconfig) offers Normal, Diagnostic, and Selective startup. Its Boot tab can select Safe boot; that setting persists until cleared. Its Services tab has Hide all Microsoft services, and its Startup tab directs you to Task Manager.

A clean boot tests interference from third-party services and startup apps. Record the original states, hide Microsoft services before disabling third-party ones, disable the startup apps being tested, restart, and reproduce the problem. If it disappears, re-enable a group of items, restart, and test again. Keep security-related changes within the organization's support procedure.

With one faulty item among 16 independent services, halving the suspect group can isolate it in four test rounds after the baseline test. Multiple interacting faults do not follow that simple count. Restore the recorded service and startup-app states and clear Safe boot when the investigation ends. Selecting Normal startup alone does not necessarily restore startup apps disabled in Task Manager.

Windows management tools expose hardware, services, events, and settings that everyday preferences do not show. Choose the console by the object you need to inspect.

Open a focused console

Microsoft Management Console, or MMC, hosts snap-ins, often opened through .msc names. compmgmt.msc groups Event Viewer, Shared Folders, Device Manager, Disk Management, Services, Task Scheduler, and other tools. Run mmc to build a custom collection with Add/Remove Snap-in. Reading facts and making system changes can require different rights.

Event Viewer (eventvwr.msc) organizes Windows Logs into Application, Security, Setup, System, and Forwarded Events. An event includes time, source, Event ID, level, and a message. Start with the time the user observed the fault, filter the relevant log, and read the source and message together.

Kernel-Power Event 41 records an unclean restart; a power loss, crash, or forced restart can produce it. It does not identify the failed component. Repeated Disk Event 7 bad-block errors warrant preserving data and investigating the drive. Random warnings unrelated in time need a different explanation from a repeating error that matches the symptom.

Manage devices, services, and tasks

Device Manager (devmgmt.msc) lists hardware. A yellow warning symbol calls for reading Properties > Device status and its code. A down arrow means disabled. Unknown hardware may need its driver; Hardware Ids help identify the exact device. The Driver tab provides update, rollback, disable, and uninstall controls.

Services (services.msc) manages background programs. Automatic starts at boot, Delayed Start waits, Manual starts on request, and Disabled prevents startup. Recovery actions control what happens after failure. Restarting Print Spooler can restore printing, but stored jobs can remain. Cancel stuck jobs through the queue; an approved queue-clearing procedure stops the service, removes the spool files, and starts it again.

Task Scheduler (taskschd.msc) separates the trigger, action, and conditions. A task may be due at 18:30 but wait because its condition requires AC power. Check the conditions before assuming the schedule is wrong.

Inspect identity and policy settings

Pro and higher editions provide lusrmgr.msc for local accounts and groups and gpedit.msc for local policy. Computer Configuration and User Configuration affect different scopes. Domain policy can override conflicting local settings. gpupdate /force requests reapplication, though some changes need sign-out or restart.

certmgr.msc shows the current user's certificates; certlm.msc shows the computer's. Check the appropriate store and certificate expiry when investigating trust errors.

Make documented Registry changes

The Registry stores settings under root keys including HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE; the other roots are HKEY_CLASSES_ROOT, HKEY_USERS, and HKEY_CURRENT_CONFIG. Values have types such as text REG_SZ, numeric REG_DWORD, and REG_BINARY.

Prefer a supported Settings or policy control. If vendor instructions require regedit, export the affected key first, verify the full path, change the documented value, and record the result. A similar-looking key for another user or machine scope is a different target.

Maintenance changes the software a user relies on. Check the requirements and source before installation, then test the affected work after the change.

Recognize update types

Windows quality updates combine security and reliability fixes in cumulative monthly releases, normally on the second Tuesday. Optional previews arrive separately; urgent out-of-band releases can arrive outside that cycle. Feature updates change the release version. Where releases share a code base, an enablement package can activate the new version with one restart. Drivers and Microsoft Defender security intelligence have their own update schedules.

In Windows Update, Check for updates starts a check. Active hours help avoid automatic restarts during working time. A temporary pause gives time to investigate a problem, not a permanent maintenance plan. Update history identifies installed packages and offers uninstall controls for removable updates. Windows Recovery Environment can remove a troublesome update when Windows will not start. In organizations, a pilot group tests updates before wider rollout through tools such as Intune or Windows Update policies.

Match a driver to the device

A driver lets the OS control hardware. Use Windows Update, the computer or device manufacturer's exact-model support page, or the component vendor. Match OS version and architecture. Kernel-mode drivers on 64-bit Windows need trusted signatures; an app that installs successfully says nothing about a separate driver package.

Device Manager's Update driver can browse to an extracted .inf folder. Roll Back Driver restores a stored earlier driver; if no earlier copy exists, the button is unavailable. Uninstall device and Scan for hardware changes are different operations from rollback. Record the original and replacement versions so the result is traceable.

After a display update introduces flickering, restore the previous driver if available, restart, and test the same display activity. Installing a newer unrelated-model package because its number is higher does not establish compatibility.

Check the whole application requirement

Compare OS release, x86/x64/Arm64 architecture, processor, RAM, free storage, graphics, network access, and any license token. Dedicated GPU memory differs from RAM shared by integrated graphics. A graphics app needing 16 GB RAM and a dedicated GPU cannot be judged suitable just because it has ample free disk space.

Most 32-bit Windows applications run on x64 Windows; a 64-bit app cannot run on 32-bit Windows. On x64 Windows, conventional 32-bit apps usually install under C:\Program Files (x86) and 64-bit apps under C:\Program Files. These folder names are useful clues, not substitutes for checking the vendor requirements.

Install and remove deliberately

Sources include Microsoft Store, official .exe or .msi installers, mounted ISO media, and winget. For example, winget install --id Mozilla.Firefox selects a package by ID. Check the publisher and license terms; a free personal license may not allow business use. System-wide installation asks for administrator approval.

Consider storage and performance, network transfers, support and training, licensing cost, and data handling before adding workplace software. Use Installed apps or Programs and Features to repair or uninstall. Deleting the program folder skips its uninstaller and can leave services, settings, and shortcuts behind.

A user account answers "Who is signed in?" Its groups and permissions answer "What may this identity do?" Keeping the questions separate helps when a person can sign in but cannot complete a system change.

Recognize the identity

A local account exists on one PC. A Microsoft account is an online personal identity used for services such as OneDrive and settings sync. A work or school account belongs to an organization through Microsoft Entra ID. A domain account belongs to an Active Directory domain. In a workgroup, each PC manages its own accounts; a domain centralizes identities and policies. Joining a domain needs Windows Pro or higher, and sign-in still depends on the organization's access rules.

Each Windows account receives a profile, usually under C:\Users, containing its Desktop, Documents, Downloads, hidden AppData, and personal settings. Separate accounts keep settings distinct and help identify who performed an action. A Windows Hello PIN is tied to a device; it is different from the account's password.

Give the rights the task needs

A standard user can run apps and change personal settings. Administrators can make system-wide changes and manage other accounts. Group membership supplies many of these rights: Users, Administrators, Remote Desktop Users, and Backup Operators serve different purposes. Power Users is a legacy group without its old extra powers. The built-in Administrator and Guest accounts are disabled by default.

Least privilege means granting only the rights required for the work. Daily work uses a standard account; a technician uses separate administrator credentials for a system change. Giving everyone administrator rights broadens the damage an accidental or malicious action can cause.

Understand UAC

User Account Control requests elevation when a program needs administrator rights. An administrator normally receives a consent prompt. A standard user receives a credential prompt requiring an administrator's identity and password. Even an administrator's ordinary applications normally run without elevation. Right-click > Run as administrator requests it for that program.

Suppose a standard user needs a scanner driver. A technician verifies the driver and approves that installation with administrator credentials. The user can remain standard afterward. Membership in Administrators is not needed for every task that occasionally needs approval.

Create and maintain a local account

In Windows 11, open Accounts > Other users > Add account. Choose the options for a person without Microsoft sign-in information and then a user without a Microsoft account. Enter the account information and leave daily users standard. Pro also provides lusrmgr.msc; netplwiz and command-line tools offer other views.

From an elevated Command Prompt, net user Dana * /add creates a local account and asks for the password without displaying it in the command. net user Dana shows its state and memberships. whoami identifies the current account and whoami /groups lists its groups.

Disable an account to block sign-in while preserving it for review or handover. Delete only after deciding what should happen to its files. An administrator resetting a local password can break access to EFS-encrypted files and stored credentials; an online Microsoft-account reset uses that account's recovery process.

A network folder can have two access layers: its NTFS permissions and its share permissions. Work out each layer before combining them.

Read NTFS permissions

An access control list, or ACL, records entries allowing or denying actions to accounts and groups. NTFS permissions apply both locally and over the network. Read opens content; Read & execute also runs programs; List folder contents shows folder entries; Write permits creating and writing; Modify adds deletion; Full control includes changing permissions. Advanced permissions refine these actions.

Files usually inherit entries from their parent folder. An explicit entry is set directly on the item; an inherited entry comes from above. Inheritance lets a top-level folder's rules reach many files without editing each one. Owners normally have the ability to change permissions, and administrators can take ownership when required.

Allow entries from a user's groups combine. If Staff grants Read and Accounts grants Modify, a member of both receives Modify. At the same level, Deny blocks the matching allowed action. An explicit Allow can take precedence over an inherited Deny, so "Deny always wins" is too broad. Use Advanced security settings > Effective Access to inspect a real user's result.

Add the share layer

Share permissions are Read, Change, and Full Control. They apply when the folder is reached through the network share, not when a user opens its local path. A UNC path such as \\FS01\Projects identifies the server and share. A mapped letter is a convenient route to that same resource; it does not grant rights.

For network access, first combine permissions within each layer, then keep only the actions allowed by both layers.

Work through an access request

Lena belongs to Editors, granting NTFS Modify, and Staff, granting NTFS Read. No Deny entries apply. The combined NTFS result is Modify. The share grants Read, so over the network Lena can read but cannot save edits. If she signs in locally and opens the folder's local path, share permissions no longer apply and NTFS Modify permits changes.

Use groups for role-based access instead of broad Deny entries. A hidden share name ending in a dollar sign is absent from normal browsing, but its permissions still decide access. Administrative shares such as C$ are intended for administrative access, not ordinary document sharing.

Predict copies and moves

An ordinary copy creates a new file that inherits the destination's permissions. A move to another volume also inherits there. A move within the same NTFS volume normally keeps the original permissions. Special copy tools can preserve ACLs deliberately.

For example, moving a restricted file from D:\Finance to D:\Shared can leave it restricted. Copying it there normally gives the new copy Shared's inherited access. Copying onto FAT32 or exFAT loses NTFS ACL protection entirely.

Map a share with File Explorer or net use P: \\FS01\Projects /persistent:yes; inspect with net use and remove with net use P: /delete. File attributes such as Hidden and Read-only are separate flags. Clearing Read-only may be permitted to a user with Modify; it is not an access-control substitute.

A file system organizes files, folders, locations, and metadata on a volume. The choice affects compatibility as well as features such as permissions and crash recovery.

Compare the Windows choices

NTFS is the standard for a Windows system volume and ordinary internal Windows data drives. It supports ACL permissions, compression, quotas, EFS file encryption, and large files. Its journal records metadata changes to help recover a consistent structure after a crash. BitLocker protects a whole volume at a different layer; it is not an NTFS-only feature.

FAT32 works with many older devices and is used for the EFI System Partition. It has no NTFS-style permissions or journal. Its maximum single file is 4,294,967,295 bytes, just under 4 GiB. That is a per-file limit: a FAT32 volume can hold many smaller files totaling much more. Windows graphical formatting tools normally offer FAT32 only for volumes up to 32 GB; a formatting-tool limit differs from a file-size limit.

exFAT supports large individual files and is readable and writable on Windows, macOS, and current Linux systems. It suits removable media shared among these systems. It does not preserve NTFS ACLs or provide an NTFS-style journal.

ReFS targets resilient storage. Metadata has checksums; file-data checksums require integrity streams. Automatic correction needs a redundant storage arrangement that supplies a good copy. Windows cannot boot from ReFS, and it is not a removable-media format. Windows 11 Dev Drives use it; general ReFS creation depends on the edition and use case.

Recognize macOS and Linux formats

APFS is the modern macOS default, with snapshots, encryption, and efficient copies, especially suited to SSDs. HFS+, also called Mac OS Extended, is its predecessor. Many Linux installations use journaled ext4; Red Hat Enterprise Linux commonly uses journaled XFS, while Fedora Workstation commonly uses Btrfs.

Without extra software, Windows reads and writes NTFS, FAT32, and exFAT, but not APFS or ext4. macOS reads and writes APFS, HFS+, FAT32, and exFAT; its built-in NTFS support is read-only. Current Linux systems support common Linux formats, FAT32, exFAT, and NTFS, although installed drivers and mount settings still matter.

Solve a removable-drive request

A user needs a 7.4 GB archive edited on both a Mac and a Windows PC. FAT32 cannot store that one file. NTFS would be read-only using the Mac's built-in support, and Windows would not read APFS natively. exFAT meets the stated exchange need.

Before formatting, copy the USB drive's existing files elsewhere and check them. Formatting creates a new file system and makes the old files inaccessible through the normal directory. The result may be compatible, but it does not carry the old NTFS access rules. If preserving permissions is the requirement, choose storage and sharing arrangements that support them instead of assuming every USB format can do so.

Disk Management shows physical disks and their volumes together. Read the disk number, size, and layout before deciding what operation the drive needs.

Turn a new disk into usable storage

Run diskmgmt.msc or open Disk Management from Start's context menu. A new blank disk may show Not Initialized. Initialize it as GPT for a modern PC, then right-click its unallocated space and choose New Simple Volume. Select the size, letter, file system, and label. NTFS suits an internal Windows data drive. After formatting, check that it appears in File Explorer.

Unallocated means no partition occupies that region. A healthy volume without a letter needs a different action: Change Drive Letter and Paths may make it accessible without recreating it. A disk absent from the tool needs a hardware or controller check, not a formatting attempt. Basic disks are the normal choice; older dynamic-disk arrangements are deprecated.

Understand the displayed size

Manufacturers use decimal units: 1 GB is one billion bytes. Windows often labels binary GiB counts as "GB." Thus a marketed 500 GB disk appears near 465.7 GB. Disk Management's size fields also use binary-scaled MB: 100 displayed GB corresponds to 102,400 MB.

Suppose the user wants a separate 100 GB data volume. Back up, right-click C: > Shrink Volume, and enter 102,400 MB if that amount is available. Then create a New Simple Volume in the released space, assign a free letter, and format it. Shrink can stop at files it cannot move, such as a page file; the tool's maximum may be smaller than the total free space.

Read the order before extending

For a normal basic NTFS volume, Extend Volume needs unallocated space immediately after the volume on the same disk. A Recovery partition between C: and free space blocks that simple extension. Free space on another disk or on the left is not the required space. Do not delete a working recovery partition casually to make the diagram look convenient.

Other actions include mounting a volume in an empty NTFS folder, attaching a VHD, formatting, and deleting a volume. Mark Active belongs to MBR startup arrangements, not GPT. Disk Management's MBR/GPT conversion normally requires an empty disk; mbr2gpt is the separate conversion tool for a suitable system disk.

Use diskpart with a confirmed target

An elevated diskpart session offers list disk, select disk, detail disk, list volume, and commands to create or extend volumes. On a confirmed disposable target, clean removes its partition information without a confirmation prompt. The preparation sequence can then use convert gpt, create partition primary, format fs=ntfs quick label=Data, and assign letter=E. Confirm the disk's identity and size before any destructive action.

Quick format writes a new empty file system without a full sector scan. Full format takes longer, checks sectors, and writes zeros across the volume in current Windows. Neither process substitutes for a verified data-disposal procedure on sensitive media.

A full volume, a damaged file system, and failing hardware can all cause storage complaints. The maintenance tool should address the evidence you have.

Reclaim space deliberately

Settings > System > Storage shows usage by category and provides Cleanup recommendations. Storage Sense can remove temporary files and selected old Recycle Bin contents, and can make unused cloud-backed OneDrive files online-only. Check its choices against the user's needs, especially for files required offline.

Disk Cleanup (cleanmgr.exe) lets you select categories such as temporary files and thumbnails. Clean up system files adds update cleanup and Previous Windows installation(s). Removing Windows.old frees space but removes the stored files needed for Go back after an upgrade. Check that the upgraded apps work before choosing that cleanup.

Free space supports updates, temporary files, and the page file. Deleting a large personal folder simply because it is large is not the same as selecting replaceable temporary data.

Optimize according to media type

Open Defragment and Optimize Drives (dfrgui.exe). On an HDD, defragmentation reduces scattered file pieces so the drive head travels less. On an SSD, optimization mainly performs retrim, telling the drive which blocks are no longer in use. Windows can also perform limited scheduled file consolidation when appropriate. Leave the media-aware schedule enabled instead of routinely forcing traditional defragmentation on an SSD with a third-party tool.

Check the file system

From an elevated Command Prompt:

• chkdsk E: reports file-system status.
• chkdsk E: /f fixes logical file-system errors.
• chkdsk E: /r also checks for bad sectors and recovers readable data; it includes /f and can take a long time.

A repair needs access to the volume. If the system volume is in use, Windows can schedule the check for restart. A successful repair does not make physically damaged hardware reliable.

Put the data before a long repair

Repeated disk errors, unreadable files, extreme delays, or clicking from an HDD are reasons to preserve accessible important files first. Then use the manufacturer's diagnostic utility for SMART and hardware tests. Get-PhysicalDisk reports the health state supplied to Windows; Get-StorageReliabilityCounter exposes supported reliability counters. A Healthy label is one piece of evidence, not an explanation for every symptom.

For example, an external drive's directory becomes readable after chkdsk /f, but Event Viewer continues to record bad-block errors. The logical repair restored access; the repeated hardware evidence still calls for replacement. Keeping that drive as the only copy would confuse readable today with dependable storage.

Command Prompt runs text commands through cmd.exe. Windows Terminal can host it alongside PowerShell, so check the tab's shell before choosing syntax.

Read the current location

A prompt such as C:\Users\Ravi> shows the current folder. An absolute path, such as D:\Tickets\case.txt, identifies a location from the drive. A relative path, such as Tickets\case.txt, starts from the current folder. A dot means the current folder; two dots mean its parent. Ordinary Windows file-name comparisons are case-insensitive.

cd Documents enters a child folder; cd .. moves to the parent; cd \ goes to the current drive's root. Enter D: to switch drives. cd /d D:\Tickets changes both drive and folder. Without /d, a cd command naming another drive does not switch the active drive.

Paths with spaces need straight double quotes, as in copy "C:\Case Files\error.log" "D:\Evidence\error.log". Quote the whole path, not each individual word. Windows paths use backslashes; command options often use forward slashes.

List before changing

dir lists the current folder, dir /a includes hidden and system entries, and dir /s *.pdf searches subfolders for PDF names. dir /p pauses a long listing. type notes.txt displays a text file, and cls clears the screen.

md Evidence creates a folder. copy duplicates files, move relocates them, and ren changes names. del *.tmp deletes matching files; rd EmptyFolder removes an empty folder, while rd /s OldFolder removes a tree after confirmation. A wildcard * matches a variable number of characters; ? matches one. Command-line deletion bypasses the Recycle Bin, so inspect the path and matches first.

Collect logs step by step

Suppose a ticket needs copies of log files from D:\Client App\Logs in C:\Support\Case7. First run md C:\Support\Case7. Then run:

copy "D:\Client App\Logs\*.log" C:\Support\Case7
cd /d C:\Support\Case7
dir

The quotes keep the source path together. The listing checks the copied names and sizes. Copying leaves the originals available to the application; moving them would change that application folder.

Copy trees with robocopy

robocopy C:\Projects E:\Backup\Projects /E copies subfolders, including empty ones, and skips unchanged files on later runs. /Z supports restarting interrupted transfers; /LOG:C:\Support\copy.log writes a log. /COPYALL requests security information as well as content and needs appropriate rights.

/MIR mirrors the source and removes destination-only files. A backup destination with extra work is therefore at risk if mirrored from a source that lacks it. Check source and destination direction carefully. Return codes below 8 report no copy failures but can still signal extra or mismatched files; read the summary. Codes 8 or above indicate failure.

Use command /? for syntax, Up arrow or F7 for history, and Tab for path completion. An elevated window is needed for protected system changes; opening Terminal alone does not provide administrator rights.

A diagnostic command is useful when its output answers the question in the ticket. Start with identifying facts, then choose checks for the affected system component.

Identify the computer and account

hostname prints the computer name; whoami prints the current account. whoami /groups adds group memberships. winver shows the Windows release and build. systeminfo lists OS and hardware details, boot time, and installed hotfix information. Record these facts before assuming two users are testing the same PC or identity.

Check Windows files and policy

Run sfc /scannow in an elevated prompt to check protected system files. If the component source is damaged or SFC cannot complete repairs, use:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM repairs the running installation's component store; SFC checks the protected files using that source. DISM may need Windows Update access or another valid repair source. A command rejected for missing administrator rights has not diagnosed corrupt files.

gpupdate /force reapplies policy. gpresult /r reports applied policy, and gpresult /h C:\Support\policy.html creates an HTML report when the folder exists. Computer-scope reporting needs elevation. Some policy changes require a sign-out or restart even after refresh.

Check accounts, shares, and disks

net user lists local accounts; net user Dana shows one account's state; net user Dana /active:no disables it. net localgroup Administrators lists that group's members. net use reports mapped shares; net use P: \\FS01\Projects creates a mapping and net use P: /delete removes it.

Disk tools answer different questions: chkdsk checks file-system consistency, diskpart manages layout, and format creates a new file system. format E: /FS:NTFS /Q quick-formats the selected volume; it is not an error-checking command.

Read basic network evidence

ipconfig shows addresses and gateways; /all adds DHCP and DNS details. /release and /renew release and request DHCP configuration, while /flushdns clears cached name lookups. A typical automatic 169.254.x.x address suggests DHCP configuration was unavailable; inspect the actual adapter settings.

ping tests for echo replies. A timeout can reflect filtering, not only an unavailable host. nslookup example.com queries DNS; tracert shows responding hops; pathping adds loss statistics. netstat -ano associates connections and listening ports with process IDs.

Match a process before stopping it

tasklist lists processes and PIDs. Match a PID from netstat -ano to its executable before investigating or ending it. taskkill /pid 5632 /f forces a specific process to end and can lose its unsaved data. The PID is a current identifier, not a permanent identity across restarts.

shutdown /r /t 0 restarts immediately, /s /t 60 schedules shutdown after 60 seconds, and /a cancels a pending shutdown. Confirm the user's work state before a restart that interrupts it.

PowerShell works with objects that have named properties, such as a process's Name, Id, and CPU time. This lets commands filter and sort data without extracting values from a printed table.

Recognize cmdlets and get help

Windows includes Windows PowerShell 5.1 (powershell.exe). PowerShell 7 (pwsh.exe) is installed separately and also runs on macOS and Linux. They can exist side by side; available modules can differ.

A cmdlet uses a Verb-Noun name. Get-Service -Name Spooler gets one service. Get-Command -Noun Service discovers service commands, Get-Help Get-Service -Examples shows examples, and Get-Member reveals object properties and methods. Tab completes command and parameter names. Use Update-Help with the rights required for the installed help locations to download full help.

Common support cmdlets include Get-Process, Stop-Process, Get-Service, Start-Service, Restart-Service, Get-ComputerInfo, Get-NetIPConfiguration, Test-Connection, and Get-WinEvent. Local-account and file cmdlets include Get-LocalUser, New-LocalUser, Get-ChildItem, Copy-Item, and Get-Content. System changes may require an elevated session.

Keep objects through the pipeline

A pipeline, |, passes output to the next command. Consider:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 Name, Id, CPU

First retrieve process objects, then sort them by cumulative CPU seconds, then select the first five and the properties to display. CPU here is total processor time since process start, not Task Manager's current CPU percentage. A long-running process can lead this list without currently causing a slowdown. Put display formatting such as Format-Table at the end, after operations needing the original objects.

Filter on the property you need

Where-Object keeps objects meeting a condition. -eq means equal, -ne not equal, -gt greater than, -lt less than, and -like a wildcard match.

Get-ChildItem C:\Logs -Filter *.log | Where-Object Length -gt 10MB

The first command selects log-file names; the second checks their Length in bytes. PowerShell's 10MB means 10,485,760 bytes. Changing the comparison to -lt would ask a different question.

Use the shell's syntax

Aliases such as dir and ls refer to Get-ChildItem; cd refers to Set-Location. They do not import Command Prompt or Linux options. Use Get-ChildItem -Force for hidden files instead of dir /a. Native tools such as ipconfig and robocopy still use their own options.

Scripts use .ps1; .\check.ps1 runs a current-folder script. Execution policy controls script loading: Restricted blocks scripts, RemoteSigned distinguishes local from downloaded scripts, and AllSigned requires signatures. Inspect Get-ExecutionPolicy -List before a permitted, limited-scope change. It is an accident-prevention feature, not a security boundary. Preview supported changes with -WhatIf and use -Confirm when useful.

macOS uses different names and shortcuts for familiar desktop tasks. Start by identifying the installed version and chip in About This Mac, then choose the relevant app or setting.

Find files, apps, and settings

Finder manages files and shows places such as Applications, Documents, Downloads, and iCloud Drive. The Dock launches apps and marks running apps with a dot. The menu bar contains the Apple menu, System Settings, Force Quit, restart, and shutdown. Spotlight opens with Command-Space to search. Mission Control shows windows and Spaces, the Mac's multiple desktops.

Command-C and Command-V copy and paste; Command-Q quits an app. Closing its last window may leave the app running. Option serves many roles comparable to Alt. Two-finger scrolling and secondary click, pinch zoom, and desktop-swiping gestures support trackpad navigation.

System Settings contains Displays, Network, Printers & Scanners, Accessibility, Users & Groups, and Privacy & Security. Camera, microphone, screen-recording, and full-disk permissions are app-specific. General contains Software Update and Time Machine. Older macOS releases call this app System Preferences.

Install the app, not just its container

The App Store manages app installation and updates. A downloaded .dmg is a mountable disk image. Open it, copy its .app bundle to Applications, eject the image, and launch the installed copy. A .pkg runs an installer and may place components in several folders with administrator approval. An .app looks like one item but is a bundle of files.

Running directly from a mounted image leaves the app dependent on that image. If the icon disappears when the image is ejected, check Applications for the installed copy. For removal, move an ordinary app to Trash; packages that install services or other components may need the vendor's uninstaller. Preferences can remain in the user's Library.

Gatekeeper checks downloaded software and can warn about unverified apps. Confirm the official source, expected developer, and organizational approval before considering the specific Open Anyway control. Keep the protection enabled for other downloads.

Recognize folders and accounts

/Applications holds shared apps; /Users holds home folders; ~ means the current user's home. /Library holds system-wide support data; ~/Library holds one user's preferences and caches. Open the hidden user Library through Finder's Go menu while holding Option. /System contains protected macOS components.

An Apple Account connects the App Store and iCloud services, including file, photo, and Keychain sync. Keychain stores credentials, certificates, and keys. Continuity includes Handoff, Universal Clipboard, AirDrop, and linked phone features. Work devices may use Managed Apple Accounts and device-management restrictions.

Choose the maintenance tool

Activity Monitor shows resource use. Force Quit (Option-Command-Esc) stops an unresponsive app. Terminal opens the shell, normally zsh. Disk Utility's First Aid checks file-system structures; its Erase action reformats. FileVault protects startup-disk data with encryption and requires safe recovery-key storage.

Time Machine backs up to a configured disk or network destination, keeping historical versions and removing older backups as space fills. Software Update and automatic background security updates maintain macOS. Built-in XProtect and Gatekeeper contribute to protection alongside any organization's endpoint tools.

A Linux desktop combines the kernel, system tools, a desktop environment, and applications. Identify the distribution before choosing installation or update commands.

Recognize the components

Ubuntu, Debian, and Linux Mint commonly use apt with .deb packages. Fedora and Red Hat Enterprise Linux use dnf with .rpm packages. GNOME, KDE Plasma, Cinnamon, and Xfce are desktop environments; the desktop's appearance alone does not determine its package manager. A graphical Software app often provides the same everyday installation tasks.

The bootloader, commonly GRUB, loads the kernel. The kernel manages hardware, memory, and processes. Most mainstream distributions use systemd to start and manage services; systemctl status cups checks a printing service where installed. A shell such as bash runs commands in a terminal.

Read paths and privileges

The folder tree begins at /, the root directory. Other drives are mounted at folders, such as /media/lee/USB, instead of receiving Windows letters. /home/lee is a user's home, /root is the root account's home, /etc holds system configuration, /var/log holds logs, /tmp holds temporary files, and /usr/bin holds programs. Names are case-sensitive: Notes.txt and notes.txt can be different files.

The root account, user ID 0, has broad system powers. sudo normally runs a permitted command as root after requesting the invoking user's password; its exact authentication follows local policy. su switches identity and normally requests the target account's password. Work as an ordinary user and elevate the particular change instead of keeping a root shell open.

Install through the distribution's tools

On Ubuntu or Debian, sudo apt update refreshes package information; sudo apt upgrade installs available upgrades. sudo apt install vlc installs software and dependencies from configured repositories, while sudo apt remove vlc removes it. Fedora uses sudo dnf upgrade, install, and remove with the package name. Repository signatures help verify origin. Flatpak and Snap provide additional desktop package formats; availability still depends on the configured source.

Read permissions before changing them

Each file has permissions for its owner, group, and others. In -rw-r-----, the owner can read/write, the group can read, and others have no access. Numeric permissions add read 4, write 2, and execute 1 for each class: 640 gives that pattern, 644 adds others' read, and 755 gives owner rwx and group/others r-x.

If a trusted script lacks execute permission, chmod u+x backup.sh adds it for the owner; chmod +x follows the command's default class rules. chown changes ownership and normally requires elevation. Giving every user write access with 777 broadens access without explaining the actual need.

Find useful commands and files

pwd, ls, cd, cp, mv, and cat handle paths and files; rm deletes without Trash. grep searches text, find locates files, and man opens help. df -h reports file-system space; du -sh reports a folder's usage. top shows live processes and ps aux a snapshot. ip a, ping, curl, dig, and traceroute provide basic network checks. fsck repairs supported unmounted file systems.

Recognize /etc/passwd for account details, /etc/shadow for restricted password hashes, /etc/hosts for local name mappings, /etc/fstab for startup mounts, and /etc/resolv.conf for resolver settings, often managed automatically. Back up a configuration file before a documented change.