Diagnose high memory usage on Windows with PowerShell
Take a one-time read-only snapshot of available physical memory, pagefile usage, CPU load and the processes using the most working-set memory.
Run the performance snapshot
pwsh -NoProfile -File .\Invoke-WindowsDiagnostics.ps1 `
-Performance -PrivacyMode -ExportMarkdownFor custom thresholds and a longer process list, run the standalone module:
pwsh -NoProfile -File .\scripts\performance-snapshot.ps1 `
-TopProcessCount 20 -LowMemoryPercent 20 -HighCpuPercent 90When this guide is useful
- Windows feels slow and Task Manager shows high memory use.
- The pagefile is heavily used or applications report that memory is unavailable.
- You need a compact process list to attach to a support request.
- You want a baseline before closing applications or rebooting the computer.
What the performance report checks
Physical memory
Total and available RAM plus the percentage still available at the moment the snapshot is taken.
Pagefile usage
Current pagefile allocation and usage where Windows exposes the data.
CPU snapshot
A point-in-time CPU load value used to flag unusually high load at the moment of collection.
Top processes
Processes ranked by working set and cumulative CPU time. Process command lines, owners and executable paths are not collected.
How to interpret high memory usage
Available memory matters more than the used percentage alone
Windows intentionally uses free RAM for cache and can reclaim it when applications need memory. A high used percentage is more concerning when available memory is very low, pagefile use is rising and the user sees slowdowns or allocation failures.
Working set is not the same as total private memory
The process list ranks working-set memory currently resident in physical RAM. Shared pages, cached data and memory that has been paged out can make other tools show different totals.
Cumulative CPU time is not current CPU usage
A long-running process may have a high cumulative CPU total even when it is idle during the snapshot. Use the current CPU load together with the process list rather than treating cumulative time as a live percentage.
One snapshot cannot prove a memory leak
A memory leak is normally established by observing growth over time under comparable conditions. This report captures evidence at one moment and is best used as a starting point or reproducible support attachment.
What the toolkit does not do
- It does not terminate, suspend or reprioritize processes.
- It does not clear caches or modify virtual-memory settings.
- It does not collect process command lines, owners or executable paths.
- It does not continuously record memory growth.
Reasonable next steps
- Save the snapshot while the slowdown is occurring.
- Compare available memory, pagefile usage and the largest working sets.
- Repeat the snapshot under the same workload if growth over time is suspected.
- Use application-specific diagnostics when one process consistently dominates memory use.