Search our site for answers
Help Docs Server Administration Windows Server Administration Windows Server Optimization Windows Resource Monitor

Windows Resource Monitor

Is your Windows Server slow? Use the Resource Monitor (Resmon) to diagnose high CPU, memory, or disk usage. Our guide shows you how to find bottlenecks.
5 min read

Overview

If your Windows Server feels slow, unresponsive, or is experiencing performance issues, the Windows Resource Monitor (Resmon) is the best built-in tool to diagnose the problem. It gives you a live, detailed look at how your server is using its CPU, memory, disk, and network resources.

This guide will show you how to use the Resource Monitor to:

  • Find out which applications are slowing down your server.
  • Identify processes causing high disk or network activity.
  • Check for memory leaks in your applications.
  • Pinpoint the root cause of performance bottlenecks.

Accessing Windows Resource Monitor

The Windows Resource Monitor can be run by following either of these methods:

  • Type resmon in the Windows search bar and press Enter.
  • Run resmon.exe from the Run dialog (Win + R).
  • Access via Task Manager → Performance tab → Open Resource Monitor.

Parameters / Features

TabDescription
OverviewDisplays CPU, Disk, Network, and Memory usage summaries.
CPUShows process-level CPU usage, threads, and handles. Identifies processes causing high CPU load.
MemoryDisplays physical and virtual memory usage by each process. Helps locate memory leaks.
Disk (Storage)Monitors read/write operations and disk response times for each process.
NetworkShows per-process network activity, including TCP connections and bandwidth usage.

Examples

Identify High CPU Usage Process

  1. Open Resource Monitor (resmon.exe).
  2. Go to CPU tab → Processes.
  3. Click the CPU column header to sort by usage.
  4. Identify the process using the most CPU resources.
Monitor trends
You can right-click any process and select Analyze Wait Chain to check for dependent or blocked threads.

Analyze Memory Usage

  1. Open the Memory tab.
  2. Check the Commit (KB) and Working Set (KB) columns to identify processes consuming large memory portions.
  3. Hover over the Physical Memory bar graph to see how much memory is in use, modified, standby, or free.
  4. Identify if any process shows High Hard Faults/sec, which could indicate excessive paging.
Hard faults explained
Think of RAM as your desk and the hard disk as a filing cabinet. Grabbing something from your desk (RAM) is very fast. A “hard fault” happens when your server needs a file that isn’t on the desk and has to walk over to the filing cabinet (the disk) to get it. A few hard faults are normal. However, a constant, high number of hard faults means your server is spending too much time running to the filing cabinet. This can be a sign that you don’t have enough RAM (your desk is too small) for your current workload. 
More information about Windows RAM found here.

Monitor Disk Activity

  1. Open the Disk tab.
  2. Sort by Total (B/sec) to view processes performing heavy read/write operations.
  3. Expand Disk Activity to view specific files being accessed.
Background services
Many background services (e.g., Windows Defender or indexing) can temporarily cause high disk usage. 

Monitor Network Activity

  1. Go to the Network tab.
  2. Sort by Send (B/sec) or Receive (B/sec) to find processes using the most bandwidth.
  3. Expand TCP Connections to view local and remote addresses, ports, and latency.
  4. Identify unknown processes with persistent or suspicious connections.
Check for unknown connections
If you find processes connecting to unfamiliar IP addresses or domains, investigate further using antivirus or firewall tools to rule out malware or data exfiltration.

Common Use Cases

  • Diagnosing system slowdowns due to high CPU or memory usage.
  • Identifying applications causing disk thrashing or I/O delays.
  • Monitoring network connections to detect unusual traffic or potential malware activity.
  • Checking memory leaks in applications or services.
  • Verifying that processes release the system handles correctly.

Troubleshooting & FAQs

Ensure you’re running it as an administrator. You can also try launching from Task Manager → Performance → Open Resource Monitor.

Administrative rights required
Running without admin privileges limits access to certain system information.

Click Monitor → Resume Monitoring from the menu bar.

Resource Monitor doesn’t export logs directly. Use Performance Monitor (perfmon) or Task Manager → Details → Export for detailed logging.

Alternative logging
Use perfmon /report for a complete system diagnostic report, including performance summaries.

Next Steps

Once you’ve used the Resource Monitor to identify a problem, here are some common next steps:

  • If a specific application has high CPU or memory use: Try restarting the application or service. If the problem persists, check the logs for more information. You may have an update from the software vendor or you may need to review its configuration settings.
  • If your server consistently has high memory usage and hard faults: Your server may not have enough RAM for its workload. Consider upgrading your server to a plan with more memory.
  • If you see suspicious network activity: If you’ve identified a process with unknown or suspicious network connections, you should run a security scan and ensure your firewall is properly configured.
  • If you’re unsure how to resolve an issue: After identifying the problematic process or resource, you can contact our Support team with your specific findings. Providing the name of the process and the data you observed will help us assist you more quickly. 1

Helpful Links and Articles 

1 Service provided ‘as is’ without any warranties or guarantees, express or implied. Please be aware that while we investigate all reported issues, a resolution isn’t always possible.. If the problem is downstream, we will engage our vendors.

Was this article helpful?