windows3-1  Exercise 3: Working Set Versus Private Bytes
=================================================================

Verification: Level 1 (read-only; run on the author's machine, no administrator rights).

Prediction (work this out before running the script):

  The top five by working set will contain the browser, sync client and security service plus
  the Memory Compression process. The top five by private bytes will be a different list.
  Some processes, typically databases and background services, will have private bytes at
  least twice their working set. The sum of working sets will differ from the sum of private
  bytes, and neither will equal the "in use" figure.

ex3.ps1 (run it with:  powershell -ExecutionPolicy Bypass -File ex3.ps1):

  # ex3.ps1: resident (working set) versus committed (private bytes), per process
  $ps = Get-Process | Where-Object { $_.WorkingSet64 -gt 0 }
  'Top 5 by working set:'
  $ps | Sort-Object WorkingSet64 -Descending | Select-Object -First 5 | ForEach-Object {
      '  {0,-22} working set {1,6:N0} MB   private {2,6:N0} MB' -f $_.ProcessName, ($_.WorkingSet64 / 1MB), ($_.PrivateMemorySize64 / 1MB) }
  'Top 5 by private bytes:'
  $ps | Sort-Object PrivateMemorySize64 -Descending | Select-Object -First 5 | ForEach-Object {
      '  {0,-22} working set {1,6:N0} MB   private {2,6:N0} MB' -f $_.ProcessName, ($_.WorkingSet64 / 1MB), ($_.PrivateMemorySize64 / 1MB) }
  'Processes where private is at least twice the working set (and over 200 MB private):'
  $ps | Where-Object { $_.PrivateMemorySize64 -ge 2 * $_.WorkingSet64 -and $_.PrivateMemorySize64 -gt 200MB } |
      Sort-Object PrivateMemorySize64 -Descending | ForEach-Object {
      '  {0,-22} working set {1,6:N0} MB   private {2,6:N0} MB' -f $_.ProcessName, ($_.WorkingSet64 / 1MB), ($_.PrivateMemorySize64 / 1MB) }
  'Totals over {0} processes: working sets {1:N2} GB, private bytes {2:N2} GB' -f $ps.Count, (($ps | Measure-Object WorkingSet64 -Sum).Sum / 1GB), (($ps | Measure-Object PrivateMemorySize64 -Sum).Sum / 1GB)

Output (real, from the author's machine on 2026-10-24; your numbers will differ):

  Top 5 by working set:
    Memory Compression     working set    945 MB   private      3 MB
    OneDrive               working set    906 MB   private  1,042 MB
    firefox                working set    476 MB   private    465 MB
    MsMpEng                working set    354 MB   private    444 MB
    firefox                working set    315 MB   private    367 MB
  Top 5 by private bytes:
    OneDrive               working set    906 MB   private  1,042 MB
    claude                 working set    292 MB   private    669 MB
    mysqld                 working set     51 MB   private    582 MB
    Av.Security.Service    working set    295 MB   private    502 MB
    explorer               working set    230 MB   private    476 MB
  Processes where private is at least twice the working set (and over 200 MB private):
    claude                 working set    292 MB   private    669 MB
    mysqld                 working set     51 MB   private    582 MB
    explorer               working set    230 MB   private    476 MB
    firefox                working set     79 MB   private    410 MB
    mongod                 working set     35 MB   private    407 MB
    dwm                    working set     53 MB   private    343 MB
    msedgewebview2         working set    164 MB   private    331 MB
    msedgewebview2         working set     38 MB   private    300 MB
    mspaint                working set    128 MB   private    286 MB
  Totals over 293 processes: working sets 11.04 GB, private bytes 14.54 GB

WHY THIS WORKS AS AN ANSWER
---------------------------
  Memory Compression tops the working-set list (945 MB) yet has only 3 MB of private bytes:
  it is a Windows component, not an application (what it holds is chapter 5). mysqld has
  committed 582 MB but has only 51 MB of it in RAM. Two sentences you can defend from this
  evidence: the working set counts what is resident now, and private bytes counts what the
  process has committed for itself whether or not it is resident; a process can therefore
  have a large commit and a small working set. The measurements do not show WHY mysqld is
  small in RAM (untouched reserved memory, or pages trimmed out), so a correct answer says
  that it is a question for further measurement rather than naming a cause.
  The totals (11.04 GB of working sets, 14.54 GB of private bytes over 293 processes) are not
  "memory used": a shared page is counted once per process that has it, and kernel memory
  and the compressed store are outside both.
  Common mistakes: reading one column as "how big the process is"; and calling a process that
  has a large private figure but a small working set a leak without watching it grow over time
  (chapter 3).