OSITC.011 — Windows Resource Monitor. is a built-in diagnostic application for viewing which processes are using processor time, memory, storage and network capacity in real time. A Windows computer that feels slow may have a busy CPU, a storage queue, memory pressure or heavy network activity; Resource Monitor helps a technician distinguish those possibilities before changing a configuration. It complements Windows Reliability Monitor, which is designed to investigate dated crashes and failures, and Windows process troubleshooting, which introduces Task Manager, process IDs and Process Explorer.

Definition and purpose

Resource Monitor, commonly launched as resmon.exe, is a graphical performance troubleshooting utility included with Windows desktop and Windows Server editions that provide the tool. It groups observations under Overview, CPU, Memory, Disk and Network. Microsoft’s performance-counter documentation identifies Resource Monitor alongside Performance Monitor and other built-in monitoring utilities. Resource Monitor’s live readings are snapshots and short rolling graphs, not a substitute for a recorded multihour performance trace.

Opening Resource Monitor

1. Press Windows + R, type resmon or resmon.exe, and select OK.
2. Alternatively search the Start menu for Resource Monitor.
3. Inspect the Overview tab, then choose the resource associated with the user-reported symptom.

The separate command perfmon /res also starts the resource view; Microsoft’s perfmon command reference documents that switch. On managed workstations, administrative policy can affect which diagnostic tools or protected process details are accessible. Start with observation rather than elevating or terminating applications unnecessarily.

Video walkthrough — the live diagnostic views

The first demonstration walks through Resource Monitor’s CPU, memory, disk, network, associated-handle and connection views. As you watch, focus on identifying the process ID (PID) that accompanies each observation rather than guessing from the application’s displayed name.

CPU — process activity and wait conditions

On the CPU tab, examine each process’s current CPU consumption and Average CPU across the tool’s sampling window. If a process repeatedly tops the list while users report latency, record its name and PID, then compare the timing with the affected application. Microsoft’s high-CPU troubleshooting guidance recommends sorting Resource Monitor by Average CPU before investigating sustained consumption.

The CPU tab can also expose Associated Handles, which may help identify a program holding an open file or resource, and Analyze Wait Chain for some unresponsive processes. Finding an open handle does not prove a program is defective. Avoid closing handles or killing processes as a first diagnostic step, especially on production equipment.

Memory — use, commitment and hard faults

The Memory tab shows how much physical RAM is being used and how individual processes are consuming or reserving memory. Commit indicates committed virtual memory for a process, not necessarily physical RAM currently resident. Hard Faults/sec measures references that required retrieving pages not presently in physical memory; some such faults are normal, and a spike alone does not prove faulty hardware.

When users report freezes during large file operations, compare sustained hard faults, available memory and disk activity. For the distinction between RAM, committed memory, paging files and virtual address spaces, read What Is Virtual Memory?. Treat all four measurements as context, not an automatic diagnosis.

Disk — identify the actual files generating I/O

Under Disk, sort by total bytes per second, reads or writes to see which processes are active. In Disk Activity, the file-path column can show where I/O is occurring. The disk response time, queue length and active time may help distinguish a device under load from one moving data quickly. A disk can be near 100% busy while transferring relatively little data if requests are small, slow or highly fragmented; a percentage without latency and workload context is insufficient.

Example: an application hangs during a backup. Resource Monitor shows the backup process repeatedly reading many small files, while disk response time rises. The sound next step is to record the measurements and check the storage subsystem, free space, recent changes and competing workloads—not to disable antivirus or stop a backup without authorization.

Network — processes, connections and listening ports

The Network tab associates processes with send/receive activity and, where visible, TCP connections. Examine the executable, PID, destination address and connection state together. A listening port indicates that software is ready to accept appropriate connection attempts; it does not by itself mean an intrusion occurred. Likewise, an unfamiliar remote IP address is a clue for investigation, not proof of malicious activity.

For a slow remote-management session, compare the application’s network traffic with concurrent downloads and other processes. Check authorization and the system’s approved network baseline before taking action. Resource Monitor observes local activity but cannot diagnose every possible upstream switch, router, DNS or service issue.

Video study — launching Resource Monitor in Windows 11

This separate video demonstrates ways to open the tool in Windows 11. Interface paths may differ among releases, so the resmon.exe command is a convenient version-independent starting point for environments where the utility is available.

Practical troubleshooting example

A technician receives a report that a Windows-based infrastructure workstation is intermittently unresponsive while monitoring a server rack. The operator opens Resource Monitor without altering settings, notes the time and observes CPU, memory, disk and network behavior during the slowdown. Disk activity reveals one process doing sustained writes and another performing a read-heavy scan. That observation narrows the investigation but does not establish which operation is faulty.

1. Record the computer name, time, application, PID, resource and measurable symptom.
2. Repeat the observation during a normal interval to establish a comparison.
3. Correlate the PID with Task Manager and Process Explorer and check relevant system or application logs.
4. Escalate with evidence and seek change approval before restarting a service, altering security settings or modifying storage operations.

Limits of live monitoring

Resource Monitor is most useful while a problem is occurring. A missed event, intermittent spike or long-term trend may require Performance Monitor data collection and a properly configured Data Collector Set. Note that a percentage, an unfamiliar process name or an elevated hard-fault count is not in itself root-cause evidence. Collected screenshots or logs can include hostnames, user names, file paths and network addresses, so follow the organization’s data-handling policy.

Knowledge check

• Which command opens Resource Monitor directly?
• Why should a technician record a process ID alongside a program name?
• Does a high hard-fault rate automatically mean damaged RAM?
• Which view can reveal the file paths behind heavy disk I/O?
• What tool is more suitable for retaining long-duration performance records?

Answer key: resmon.exe; to track the specific running process; no, hard faults can be part of ordinary paging and must be interpreted in context; the Disk tab’s Disk Activity view; and Performance Monitor with configured data collection.

References and related learning

The governing Windows references are Microsoft’s performance-counter overview, Microsoft’s high-CPU diagnosis guide, the perfmon command reference and the performance-recording guide. For diagnosing a dated crash rather than active load, use Windows Reliability Monitor. For a contrast with Linux startup performance investigation, see systemd-analyze boot diagnostics.

BitcoinVersus.Tech Editor’s Note: This open technical reference focuses on read-only, evidence-led troubleshooting. If this free lesson was useful, support independent research and teaching with a 5,000-satoshi donation. Scan the original QR code below using a compatible Bitcoin wallet and verify the receiving address before sending.

For easy scanning, display this page on another screen and scan the QR code with your mobile Bitcoin wallet. BitcoinVersus.Tech publishes educational material for informational purposes.