A Windows Server running low on available memory shows up fast: sluggish response times, application timeouts, alerts from your monitoring tools, or users reporting that a service “feels slow” for no obvious reason. High memory usage can come from a range of causes, including memory leaks, misconfigured databases, too many active remote sessions, or malware.
When available RAM runs low, Windows starts paging, moving data from fast RAM to much slower disk storage. This keeps the system running, but at a cost: paging adds latency to every operation that touches paged-out data, and sustained heavy paging puts extra wear on the underlying drive. On a server under load, this can turn a memory problem into a performance problem that’s visible to every user hitting that server.
This article covers three ways to detect and resolve high memory usage: monitoring at the platform level, built-in Windows tools, and PowerShell for faster diagnostics.
For Linux users, see How to Monitor CPU Spikes on Kamatera, How to Get Your Server Back Online, and 6 Quick Tools to Monitor System Resources on Linux.
Check memory usage from the Kamatera dashboard
Kamatera lets you monitor your Windows Server instance’s Memory and other useful information directly from your Server Management page. Choose a server and press Open.
From the sidebar, choose STATISTICS.
From the list, choose RAM Activity.
The graph offers several range options, from one hour to three months, plus a custom range that lets you set a start and end date.
For greater resolution, use the start and end sliders to isolate and zoom in on a specific area of the graph.
Accelerate troubleshooting with PowerShell
Windows Server’s built-in monitoring tools work well for a wide range of uses and users. Power users, such as system administrators, often want something faster, more direct, and scriptable. PowerShell, Microsoft’s scripting environment for the Windows terminal, fills that role. This section covers how PowerShell’s Get-Process, taskList, and Get-CimInstance commands can help locate and troubleshoot memory usage issues.
Get-Process: Displaying process data
Start by listing all processes running on the server using Get-Process. Open PowerShell and type:
Get-Process
This displays the following information for all running processes:
To display the physical RAM a process uses, show the WorkingSet (WS) column for the process.
Get-Process | Select-Object ProcessName, Id, WS
Now let’s limit the list to the top ten svchost processes, sorted in descending order.
Get-Process | Sort-Object WS -Descending| Select-Object ProcessName, Id, WS -First 10
To wrap things up, this command builds on the previous and uses our WS column to calculate and format the WS column in megabytes and gigabytes.
Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 10 ProcessName, Id, @{ Name='MemMB'; Expression={ [math]::Round($_.WorkingSet/1MB,1) } }, @{ Name='MemGB'; Expression={ [math]::Round($_.WorkingSet/1GB,3) } } |Format-Table -AutoSize
Locating problems on the server
Kamatera’s Server Statistics shows you that a server’s memory usage is high, but not where the problem is or what’s causing it. Finding the source means working directly on the server itself. Let’s start by opening the Kamatera console or launching a local RDP session.
Once you’re on the server, Windows has several useful built-in tools. Let’s take a closer look at three Windows tools: Task Manager, Resource Monitor, and Performance Monitor.
Monitoring processes: Task Manager
Windows Task Manager is a simple and comprehensive monitoring tool. To get started, type Task Manager in the taskbar’s search box, and click Open.
Task Manager typically opens in Processes view, showing a list of applications and their processes. Click Memory in the top row to sort processes by Memory usage.
To display detailed information by process, click Details in the sidebar. Details view shows each running process individually, rather than grouped by application, and lets you add or remove columns to display additional information.
To add a column, click the top row and choose Select columns:
From the list, check and/or uncheck the columns you want to display.
In either view, once you’ve identified a process using an unusually high amount of memory, right-click on it and choose End Task. Before ending a process, confirm it’s safe to close. Ending a system process or an active service can cause instability or data loss.
Tracking performance: Task Manager and Resource Monitor
Task Manager’s Performance tab displays system-wide, top-level memory performance.
To see what’s happening underneath, open the side menu and click Resource Monitor. When you launch it, Resource Monitor displays a system-wide overview. On the left, it shows how the system consumes CPU, Disk, Network, and Memory resources. On the right, it displays a graph for each resource type.
Click the Memory tab to display memory-specific information. On the left side, it shows memory usage by process, with a graph of physical memory usage below it. On the right, graphs display utilization by Used Physical Memory, Commit Charge, and Hard Faults.
Visualizing memory usage: Performance Monitor
If the first two methods don’t give you all the information you need, Performance Monitor lets you dig deeper. It builds graphs of specific system resource counters, tracks them over longer periods, and stores the data.
This table shows the memory counters you can track, what they mean, and the values that may indicate a problem.
| Group | Counter | Meaning | Warning signs |
|---|---|---|---|
| Memory | Available MBytes | Total RAM immediately available | Consistently low |
| Memory | % Committed Bytes In Use | How much of the commit limit is consumed | Sustained >80–90% |
| Memory | Committed Bytes | Total RAM committed virtual memory | Continually increasing |
| Memory | Commit Limit | Maximum memory Windows can commit | Compare with Committed Bytes |
| Memory | Pages/sec | Pages read/written due to paging | Sustained high values need investigation |
| Memory | Page Reads/sec | Hard page faults requiring disk reads | Sustained activity can indicate memory pressure |
| Memory | Pool Nonpaged Bytes | Kernel memory that cannot be paged | Continuous unexplained growth |
| Memory | Pool Paged Bytes | Pageable kernel memory | Continuous unexplained growth |
| Paging | % Usage | Page file utilization | Sustained high usage |
| Process | Private Bytes | Memory committed to a specific process | Continuous growth may indicate a leak |
| Process | Working Set | Physical RAM currently associated with a process | Useful for identifying heavy consumers |
To launch Performance Monitor
- Open a terminal and type perfmon.
- In the console tree, expand Monitoring Tools and click Performance Monitor.
- In Performance Monitor, click the + icon.
- From Available Counters, choose Memory and add the counters listed in the table above.
- Monitor the selected counters in the graph.
Tasklist: Monitoring memory usage by process
The tasklist PowerShell command displays a list of processes currently running locally or on a remote server.
Use the following command to display memory usage per process in descending order.
tasklist /FO CSV /NH | ConvertFrom-Csv -Header Name,PID,SessionName,Session,Memory | Sort-Object {[int](($_.Memory -replace '[^\d]',''))} -Descending | Select-Object Name,PID,Memory
Building on the previous command, let’s filter the list to just the svchost processes.
tasklist /FI "IMAGENAME eq svchost.exe" /FO CSV /NH | ConvertFrom-Csv -Header Name,PID,SessionName,Session,Memory | Sort-Object {[int](($_.Memory -replace '[^\d]',''))} -Descending | Select-Object Name,PID,Memory
Get-CimInstance – Displaying detailed process information
Get-CimInstance is a powerful command that lets you display a wide range of information. You select the type of information with the appropriate Class parameter. For detailed performance information, use the Win32_PerfFormattedData_PerfProc_Proc Class.
Get-CimInstance -ClassName Win32_Process
Now, let’s modify the command to show only svchost processes.
Get-CimInstance -ClassName Win32_Process -Filter "Name like 'svc%'"
For our last example, let’s limit the list to the top ten svchost processes sorted by virtual memory size, in descending order.
Get-CimInstance -ClassName Win32_Process -Filter "Name like 'svc%'" | Select-Object -First 10 | Sort-Object VirtualSize -Descending
Conclusion: Why memory management matters
For Windows Server-based systems, available memory directly impacts performance and user experience, and affects a wide range of applications, including SQL Server, IIS, and Exchange. Ensuring a server always has sufficient available memory is essential to keeping these systems running reliably.
In this article, we explained why memory management matters, then covered the tools Kamatera, Windows Server, and PowerShell provide to monitor and troubleshoot memory issues. Use this knowledge to keep your own systems running smoothly.