A technician is troubleshooting a custom line-of-business application that has stopped responding on a Windows 11 workstation. The application window is frozen, and CPU utilization remains high. Place the troubleshooting and isolation steps in the correct chronological sequence that a technician should follow to diagnose, capture diagnostic evidence, recover system responsiveness, and identify the root cause module.
- 1Open Resource Monitor, locate the frozen application under the CPU tab, and run Analyze Wait Chain to check for thread deadlocks.
- 2Right-click the application process in Task Manager and select Create memory dump file to capture the active memory state to disk.
- 3Select End Task in Task Manager to force close the unresponsive process and release consumed system resources.
- 4Open Event Viewer and navigate to the Application log to locate Event ID 1000 or Event ID 1002 for details on the faulting module.
Answer
The correct sequence is: 1) Analyze the wait chain in Resource Monitor to check for thread contention, 2) Create a memory dump file in Task Manager to preserve volatile memory, 3) End the task in Task Manager to terminate the frozen process, and 4) Inspect Event Viewer Application logs for Event ID 1000 or 1002 faulting module information.
The correct troubleshooting workflow prioritizes live non-destructive diagnosis and memory state preservation prior to process termination. First, Analyze Wait Chain in Resource Monitor inspects real-time thread dependencies. Second, creating a memory dump in Task Manager preserves volatile RAM data for debugging. Third, End Task clears the hung application from system resources. Fourth, Event Viewer Application logs (Event ID 1000/1002) are examined to identify the faulting DLL or binary.
Step-by-Step Solution
Key Concept
Methodical sequence for isolating hung Windows applications while preserving diagnostic evidence.