Task Manager tells you that something is busy. Resource Monitor tells you what it’s doing: which files a process is reading, which ports it’s listening on, which remote addresses it’s talking to, and whether memory is really short. It’s built into every version of Windows and Windows Server.

Open it with Win + R → resmon, or from Task Manager → Performance → Open Resource Monitor.

Overview tab

Four sections — CPU, Disk, Network, Memory — each with a live graph on the right. Tick a process in the CPU list to filter every other section to that process. This is the fastest way to answer “what is this program doing?”.

CPU: find what’s busy

  • Sort by Average CPU (more useful than instantaneous CPU) to find consistent consumers.
  • Expand Services to see which service inside a shared svchost.exe is responsible.
  • Associated Handles — search for a file or folder name to find which process has it open. This solves “the file is in use by another program” errors.
  • Associated Modules — DLLs loaded by the process.

Memory: is RAM actually the problem?

The bar at the bottom shows:

Segment Meaning
In Use Memory used by processes, drivers and the OS
Modified Changed pages waiting to be written to disk
Standby Cached data that can be freed instantly
Free Unused memory

Low Free memory is normal — Windows uses spare RAM as cache (Standby). Watch instead:

  • Hard Faults/sec in the process list — sustained high values mean the system is reading from the page file because RAM is short.
  • Commit (KB) vs the system’s commit limit.

If hard faults stay high under normal load, you need more RAM or fewer running programs. See CPU and RAM monitoring.

Disk: who is reading and writing?

  • The Disk Activity list shows each file being read or written, by which process, and at what rate.
  • Response Time (ms) — consistently above ~20–50 ms on SSD storage suggests a bottleneck.
  • Storage section shows Disk Queue Length; a queue that stays high means the disk can’t keep up.

Common culprits: Windows Search indexing (manage indexing), antivirus scans, backups, Windows Update and databases.

Network: connections and listening ports

  • Processes with Network Activity — bandwidth per process.
  • TCP Connections — local and remote addresses and ports per process, with latency.
  • Listening Ports — every open port, the process behind it, and the firewall status. Useful for checking what your server exposes — then lock it down with Windows firewall rules.

A troubleshooting routine

  1. Overview — which of CPU, disk, network, memory is pegged?
  2. Click into that tab and sort by the heaviest column.
  3. Tick the top process to filter all views.
  4. Check what it’s doing: files (disk), connections (network), handles (locks).
  5. Decide: update, reconfigure, schedule for off-hours, or stop it.

On a Windows VPS

  • High CPU with no obvious process can be Windows Update or Defender in the background — check after they finish.
  • Steady memory pressure on a 2–4 GB plan running Windows Server is common; Windows Server itself uses 1.5–2 GB. Consider more RAM if hard faults stay high.
  • For historical data, use Performance Monitor (perfmon) data collector sets, since Resource Monitor only shows live values.

Our Windows VPS plans can be upgraded by ticket when monitoring shows you need more resources.

  • Windows
  • Performance
  • Troubleshooting