Which process is using up CPU, RAM, or disk space? A comparison of analysis tools for Windows Server

The server is running slowly, and the dashboard shows 95% CPU usage—but which process is to blame? Or maybe the RAM is full, even though the provider says the running services shouldn’t use much. The Windows Task Manager provides an initial clue, but it’s often not enough to get to the root cause.

That’s exactly what Microsoft’s Sysinternals Suite is for: a collection of free tools that delve much deeper into the operating system than any built-in tool. In this article, I’ll compare the most important process and resource analysis tools—from quick checks to in-depth forensic analysis.

Table of Contents

1. Task Manager (Windows)
2. Process Explorer (Sysinternals)
3. Process Monitor (Sysinternals)
4. RAMMap (Sysinternals)
5. PowerShell
6. An Overview of the Tools
7. Conclusion

1. Task Manager (Windows)

Task Manager (taskmgr.exe) is always available, requires no installation, and is sufficient for many everyday situations. Since Windows Server 2012, the “Details” tab has displayed significantly more columns: CPU time, I/O read/write bytes, handles, and threads. Right-clicking on a process allows you to open the process stack directly or jump to the file.

• Always available, no download required
• Overview of CPU, RAM, disk I/O, and network usage per process
• Terminate a process, change priority
• Manage services and startup entries

Limitations: No process tree view, no handle or DLL details, no real-time I/O logging. It’s too superficial to answer the question, “Why is this process doing this?”

Suitable for: A quick first look and simple tasks like terminating hung processes.

2. Process Explorer (Sysinternals)

Process Explorer is the task manager it was meant to be. It displays all processes as a process tree —you can immediately see which process is a child of which other process, which can be crucial when dealing with services and subprocesses. It also uses color-coding: Green = process just started, Red = process just terminated, Purple = packed or compressed executable, Light Blue = process running under your user account.

Particularly valuable: Process Explorer displays the loaded DLLs and open handles (files, registry keys, mutexes) for each process. This allows you to determine which file is being locked by a process—or whether an unknown DLL has infiltrated a legitimate process. The direct VirusTotal integration scans executables against 70+ antivirus engines with the click of a button.

• Process tree with parent-child relationships
• Color coding for quick orientation
• Handle and DLL view per process
• VirusTotal scan directly from the tool
• CPU graph per core, I/O and RAM history
• Portable—can permanently replace the Task Manager

Suitable for: Detailed process analysis, suspected malware, debugging unknown processes.

Process Explorer – Microsoft Sysinternals Download

3. Process Monitor (Sysinternals)

Process Monitor (ProcMon for short) is the tool to use if you want to know what a process is currently doing—not just how many resources it’s consuming. It captures every file access, registry access, network call, and process event across the entire system in real time and displays them as a searchable log.

Practical example: An application won’t start and throws a cryptic error. With ProcMon, you can filter by process name and immediately see which configuration file is missing, which registry key can’t be found, or which DLL can’t be loaded. In minutes, the cause becomes clear—a problem that would otherwise take hours to diagnose.

• Real-time logging of all file, registry, network, and process events
• Powerful filters (by process, path, result, event type)
• Boot logging: Record events starting from system startup
• Save logs and analyze them offline

Limitations: Without filters, the volume of logs is overwhelming—ProcMon literally records everything. It can be a steep learning curve for inexperienced users.

Suitable for: Diagnosing application errors, missing files, and registry issues; indispensable for developers and experienced admins.

Process Monitor – Microsoft Sysinternals Download

4. RAMMap (Sysinternals)

RAMMap shows how physical memory is actually allocated—broken down into categories that Task Manager doesn’t recognize: Active, Standby, Modified, Free, divided into Paged Pool, Non-Paged Pool, Working Sets, File Cache, and more.

A common scenario: The server has 32 GB of RAM; Task Manager shows 28 GB in use, but the total of all processes adds up to only 12 GB. The difference lies in the system file cache or standby memory. RAMMap makes this visible and explains why Windows manages RAM the way it does—and whether there’s actually a leak or if the operating system is simply preloading efficiently.

• Detailed RAM breakdown by physical categories
• Visualizing the paged pool, non-paged pool, and file cache
• Detection of driver memory leaks in the kernel area
• Manually clear the standby list (for testing)

Suitable for: Servers with inexplicably high RAM usage, diagnosing kernel memory leaks.

RAMMap – Microsoft Sysinternals Download

5. PowerShell

If you want to not only analyze resource issues once but also monitor them regularly or have them reported automatically, use PowerShell. Get-Process displays CPU time and RAM usage, while Get-Counter reads performance counters such as processor load, disk queue length, or available memory. The results can be exported directly to CSV files or sent via email.

# Top 10 processes by current RAM usage
Get-Process | Sort-Object WorkingSet64 -Descending |
  Select-Object Name, @{N='RAM (MB)';E={[math]::Round($_.WorkingSet64/1MB,1)}} -First 10

• No additional tools required; available everywhere
• Scriptable and automatable
• Time-series data collection possible with Get-Counter
• Results can be exported via email, to log files, or to monitoring systems

Limitations: No graphical visualization; more cumbersome than Process Explorer for one-time ad hoc analyses.

Suitable for: Automated monitoring, long-term recording, and analyzing resource issues over extended periods.

Resource issues are almost always monitoring gaps
If the administrator only realizes that the server has been running at capacity for hours when the customer calls, it’s the monitoring that’s missing—not the analysis tool. The Sysinternals tools are excellent for forensic diagnosis after an incident. What they cannot replace: threshold alerts that warn before a problem turns into a failure. Learn more about our proactive IT support →

An Overview of the Tools

Conclusion

The Task Manager is sufficient for a quick overview. For anything beyond that, Process Explorer is the first tool that belongs on every admin computer—portable, free, and far more powerful than the built-in alternative. When a process exhibits unexplained behavior, Process Monitor comes into play. RAMMap clarifies puzzling RAM usage. And if you want to monitor continuously rather than perform a one-time diagnosis, you can automate the process with PowerShell.

By the way, all the Sysinternals tools mentioned can be downloaded as a package or installed directly via `winget install Microsoft.Sysinternals `—and they run right from a USB drive without any setup.

Related articles: Display system information for Windows Server on the desktop · Hard drive full on Windows Server? Find memory hogs