Windows 11 Memory Troubleshooting Cheat Sheet

Sidebar

Operating Systems · Windows 11 Memory Troubleshooting Cheat Sheet

What the memory words mean, which numbers to read, and how to tell a leak from a cache from a busy PC. Counter names were all run on this PC (Windows 11 Pro, build 26300, 32 GB installed / 29.8 GB usable) as a normal user. Interpretations come from Microsoft's documentation and the course Windows 11 Memory, Performance & Crash Forensics; the tools RAMMap and PoolMon were not run here.

Words That Get Confused

Working setPhysical RAM a process is using now (shared pages included)
Private working setRAM only that process uses. Task Manager's Memory column on the Processes tab shows this
Commit (private bytes)Memory a process has promised: RAM plus page file. Task Manager's Commit size column
Commit charge / limitSystem total promised / the maximum (RAM + page file). Here 29.5 of 77.8 GB
In useRAM holding data programs need right now
Standby (cached)Old data kept in RAM because it might be needed again; Windows gives it back on demand. Counts as Available
ModifiedChanged pages waiting to be written to disk
FreeTruly empty RAM. Normally small on a healthy PC
AvailableFree + Standby: what can be handed to a program right away

Counters That Matter

\Memory\Available MBytesRAM that can be used immediately (13,584 here)
\Memory\Committed BytesCommit charge
\Memory\Commit LimitRAM + page file
\Memory\% Committed Bytes In UseCharge as a percentage of the limit (35 here)
\Paging File(_Total)\% UsageHow much of the page file is in use; % Usage Peak is the high-water mark
\Memory\Pages Input/secPages read from disk to satisfy page faults. Sustained high values with low Available memory mean a starved PC
\Memory\Page Faults/secIncludes harmless soft faults: large numbers alone mean little
\Memory\Pool Nonpaged BytesKernel memory that must stay in RAM; steady growth points at a driver
\Memory\Pool Paged BytesKernel memory that can be paged out
\Memory\Standby Cache Normal Priority BytesThe bulk of the Standby cache (13.6 GB here)
\Process(_Total)\Handle CountOpen handles system-wide (192,314 here); watch a single process for runaway growth

Quick Looks (PowerShell, No Admin)

Get-Counter '\Memory\Available MBytes'Add -Continuous to sample every second; Ctrl+C to stop
Get-CimInstance Win32_OperatingSystemTotalVisibleMemorySize, FreePhysicalMemory. Careful: Free here is not the Free list; use the counters above
Get-CimInstance Win32_PageFileUsagePage file name, size (AllocatedBaseSize) and PeakUsage in MB
Get-CimInstance Win32_PhysicalMemoryThe modules: size, rated Speed, ConfiguredClockSpeed, part number
Get-Process -Name 'Memory Compression'The compressed-memory store (around 1.4 GB here); its size counts in In use

Memory Compression's on/off setting needs Get-MMAgent, which was access-denied without administrator rights here.

Top Consumers

Get-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 10 Name, Id, @{n='MB';e={[int]($_.WorkingSet64/1MB)}}Biggest by working set
Get-Process | Sort-Object PrivateMemorySize64 -Descending | Select-Object -First 10 Name, Id, @{n='CommitMB';e={[int]($_.PrivateMemorySize64/1MB)}}Biggest by commit (private bytes)
Get-Process | Sort-Object Handles -Descending | Select-Object -First 10 Name, Id, HandlesMost handles
Get-Process firefox | Measure-Object WorkingSet64 -SumTotal for one program with many processes (browsers: 27 here). Working sets overlap, so the sum overstates real use; compare PrivateMemorySize64

Leak, Cache or Busy?

LeakA process's commit or a kernel pool grows steadily and never gives anything back, even when the program is idle. It needs hours of samples, not minutes
CacheGrowth that stops by itself, or shrinks when other programs ask for memory (the Standby list does this by design)
SawtoothGrows, drops, grows: ordinary garbage collection or a program cleaning up. Not a leak
BusyAvailable low but Pages Input/sec near zero and page file use low: Windows is using spare RAM as cache. Fine
StarvedAvailable low, Pages Input/sec high, page file filling, everything slow: too little RAM for the workload
Handle leakOne process's Handles climbs while its memory stays flat
Pool leakPool Nonpaged/Paged Bytes climbs while no process's memory does: a driver. PoolMon (Windows Driver Kit) finds the tag

Page File and Commit

Why have oneIt backs commit (so the limit is higher than RAM) and holds crash dumps if the dump type needs it
System-managedWindows picks the size. Here 48 GB (1.5 x RAM) with a peak use of 153 MB: far larger than needed, and the reason is unexplained
RAM + page file= Commit Limit (checked here to the byte: 83,522,240,512)
Changing itSettings > System > About > Advanced system settings > Performance > Advanced > Virtual memory. Note the old value first; needs admin and a restart
Never turn it offPrograms can then fail when commit runs out, even with RAM free

Other Tools

Task Manager > Performance > MemoryIn use, Available, Committed, Cached, Paged/Non-paged pool, Speed, Slots used
resmonResource Monitor > Memory tab: the Hard Faults/sec column and the physical memory bar (Hardware Reserved, In Use, Modified, Standby, Free)
RAMMap (Sysinternals)Shows where RAM goes by type, and can empty the Standby list. Needs administrator rights. Not run here
PoolMon (WDK)Kernel pool by tag: for finding a leaking driver. Not installed here
mdsched.exeWindows Memory Diagnostic: restarts the PC and tests the RAM. A pass is weak evidence; a fail is strong. Never run here
Free is not the number to watch
A PC showing 13.7 GB free in one place and 2 GB in another is not broken: some tools report Free + Standby (Available) as free. Read Available MBytes and Pages Input/sec, not the word free.
One sample proves nothing
A cache looks like a leak for the first few minutes. Sample for hours and compare like with like (same program, same activity) before deciding.