Windows Resource Monitor (resmon.exe): Complete Usage and Troubleshooting Guide

QUICK ANSWER

Windows Resource Monitor—opened with resmon.exe—is a built-in Windows diagnostic tool that shows which processes and services are using the CPU, physical memory, disks, and network in near real time. It provides more process-level detail than Task Manager’s summary views.

Use it when Windows is slow, a disk remains busy, an application consumes excessive memory, a file cannot be moved or deleted, or you need to identify a process using a network connection. Resource Monitor is primarily a live troubleshooting tool; it is not intended for long-term monitoring, packet capture, malware detection, or detailed historical reporting.

What Is Windows Resource Monitor?

Resource Monitor is a Windows performance and troubleshooting utility. Its executable is resmon.exe, which is normally located in:

C:\Windows\System32\resmon.exe

It organizes live system activity into five tabs:

Resource Monitor is included with Windows 10, Windows 11, and supported Windows Server releases. Microsoft also documents the perfmon /res command for starting its Resource View.

How Resource Monitor Works

Resource Monitor obtains performance and activity information from Windows and repeatedly updates its tables and graphs. It associates resource activity with process IDs, executable names, services, files, network addresses, and ports where that information is available.

The displayed figures are recent measurements rather than permanent records. Values can rise and fall rapidly, so an isolated spike does not necessarily indicate a problem. Look for sustained activity that coincides with the symptom you are investigating.

Selecting a process by using its checkbox filters related information in other sections of the current tab. This makes it easier to isolate the files, services, handles, or connections associated with that process.

What Resource Monitor Does Not Do

Resource Monitor does not:

• Preserve a detailed history after it is closed.
• Explain automatically why an application is behaving incorrectly.
• Capture or inspect network-packet contents.
• Replace antivirus or endpoint detection software.
• Reliably prove that an unfamiliar connection is malicious.
• Show application source-code call stacks.
• Monitor multiple computers through a central console.
• Provide the depth of a Windows Performance Recorder trace.

How to Open Resource Monitor

Method 1: Run Command

1. Press Windows key + R.
2. Enter:

resmon

3. Press Enter.

Method 2: Windows Search

Open Start, search for Resource Monitor, and select it.

Method 3: Command Prompt, PowerShell, or Windows Terminal

Run:

resmon.exe

You can also open the Resource View through Performance Monitor:

perfmon /res

According to Microsoft, /res starts the Resource View.

Administrator Requirements

Basic monitoring normally works under a standard user account. However, elevation may be required to:

• View complete information about processes belonging to other users.
• Access details for protected or higher-integrity processes.
• End, suspend, or resume certain processes.
• Manage services associated with a process.

If required, search for Resource Monitor, right-click it, and select Run as administrator. Elevation does not bypass every protection applied to system or security processes.

Understanding the Overview Tab

The Overview tab combines four expandable sections:

• CPU
• Disk
• Network
• Memory

Start here when the cause of a slowdown is unknown.

Recommended Workflow

1. Reproduce the slowdown while Resource Monitor is open.
2. Determine whether CPU, memory, disk, or network activity rises.
3. Sort the relevant table by its busiest column.
4. Select the suspected process.
5. Open the corresponding detailed tab.
6. Observe the process long enough to distinguish a sustained problem from a brief, normal spike.

Resource Monitor shows correlation, not necessarily causation. A process may be busy because another application requested work from it.

Using the CPU Tab

The CPU tab helps diagnose high processor usage, unresponsive programs, service activity, and locked resources.

Processes Section

Important columns commonly include:

Sort by CPU or Average CPU to find processes consuming processor time. A short increase may be normal during application startup, updates, searches, compression, scanning, or software installation.

CPU values must also be interpreted in context. A single busy thread may limit an application even when total CPU utilization is well below 100% on a multicore processor.

Services Section

When a selected process hosts Windows services, the Services section can display their names and status. This is particularly useful with service-host processes such as svchost.exe.

Do not stop a service merely because it appears under a busy process. First identify the service’s purpose and dependencies. Stopping security, networking, update, storage, authentication, or management services can disrupt Windows.

Associated Handles

A handle represents an object that a process has opened, such as a file, registry object, event, or directory.

Use Associated Handles when Windows reports that a file or folder:

• Is open in another program.
• Cannot be renamed.
• Cannot be moved.
• Cannot be deleted.
• Is being used by another process.

Enter a distinctive part of the filename or path in the search box. The results identify processes with matching handles.

A result means that the process holds a matching handle; it does not always mean that the process is actively reading or writing the file.

Associated Modules

Associated Modules lists executable modules and DLLs loaded by selected processes. It can help identify:

• Which application loaded a particular DLL.
• The path from which a module was loaded.
• Possible version conflicts.
• Unexpected modules loaded into a process.

A module appearing in this list is not, by itself, proof of malware.

Analyze Wait Chain

For some processes, the context menu includes Analyze Wait Chain. A wait chain shows processes or threads waiting for resources held by another thread or process. This can help investigate an application that displays “Not Responding.”

A wait chain does not automatically identify a software defect. Waiting is a normal part of application operation, and terminating a process in the chain can cause data loss.

Using the Memory Tab

The Memory tab shows how physical RAM is being used and which processes account for significant memory consumption.

Per-Process Memory Measurements

Common columns include:

The exact columns and labels may differ slightly between Windows versions.

Physical Memory Categories

The memory bar normally divides RAM into categories such as:

• Hardware Reserved: Memory reserved for hardware or firmware and unavailable to Windows.
• In Use: Memory actively used by processes, drivers, or Windows.
• Modified: Memory containing changed data that must be written before reuse.
• Standby: Cached data retained in RAM but available for reuse when needed.
• Free: Memory containing no immediately useful data.

Standby memory is reusable and should not automatically be treated as wasted memory. Low Free memory alone is therefore not proof that the computer needs more RAM. Available memory includes memory Windows can make available promptly, including reusable standby pages.

What Hard Faults/sec Means

A hard fault occurs when a required memory page is not currently in physical RAM and Windows must retrieve it from disk-backed storage, such as the page file or a mapped file.

A hard fault is not a hardware fault, disk error, or application crash. Occasional hard faults are normal. Sustained high hard-fault activity combined with slow performance, low available memory, and heavy disk activity can indicate memory pressure.

Diagnosing Possible Memory Pressure

Look for several related symptoms:

1. Available memory remains low.
2. Hard faults continue rather than appearing as a brief spike.
3. Disk activity increases at the same time.
4. Applications become slow when switching between them.
5. One or more processes have unusually large and growing working sets or commit values.

Before adding RAM, confirm whether the issue is caused by an expected workload, too many applications, a memory leak, a virtual machine, or an improperly configured application.

Do not disable the Windows page file as a general performance fix. Some workloads and diagnostic functions require committed virtual memory, and removing the page file can reduce the system’s commit capacity.

Using the Disk Tab

The Disk tab shows which processes are performing storage input/output and which files they are accessing.

Processes with Disk Activity

This section summarizes read and write activity by process. Sort by Total, Read, or Write to identify heavy users.

Common legitimate causes include:

• Windows Update
• Antivirus scans
• Search indexing
• Application installation
• File synchronization
• Backups
• Database activity
• Copying or extracting files

Disk Activity

The Disk Activity section can show:

• Process name and PID
• File path
• Read rate
• Write rate
• Combined I/O rate
• Response time
• I/O priority, depending on the Windows version

The file path is especially useful. It can reveal whether the activity involves a database, user profile, temporary file, page file, update cache, virtual disk, or another specific workload.

Storage Section

The Storage section presents activity by logical disk and can include measurements such as active time and disk queue length.

A queue indicates pending storage requests. Whether a particular queue length is problematic depends on the storage device, workload, latency, RAID or virtualization layer, and duration. There is no universal queue-length threshold that proves a disk is faulty.

Investigate when high active time, increased response time, a persistent queue, and visible application delays occur together.

Disk Usage Is Not Disk Capacity

Disk activity and free disk space are different measurements:

• Disk activity describes reads and writes.
• Disk capacity describes used and available storage space.

A disk can be nearly full but temporarily idle, or mostly empty while experiencing heavy I/O.

Using the Network Tab

The Network tab attributes network activity to processes and displays connections and listening ports.

Processes with Network Activity

This section reports send, receive, and total traffic rates by process. Use it to find which application is currently transferring data.

Traffic may come from:

• Browsers and communication applications
• Cloud-sync clients
• Windows Update
• Backup software
• Security products
• Remote-management software
• Application launchers and updaters

Network Activity

The Network Activity section associates processes with network addresses and traffic rates. An address may appear as an IP address or resolved hostname.

Name resolution may not always succeed, and shared or proxied connections can make interpretation more complicated. A remote address alone does not establish whether traffic is safe.

TCP Connections

The TCP Connections section can display:

• Local address and port
• Remote address and port
• Packet loss
• Latency
• Associated process

Latency is connection-dependent and may fluctuate. Packet loss or high latency should be confirmed over time and, when appropriate, with dedicated network diagnostic tools.

Resource Monitor focuses mainly on active TCP connection details. It is not a full protocol analyzer and does not replace tools such as a supported packet-capture utility.

Listening Ports

A listening port indicates that a process is waiting for incoming connection attempts. This does not necessarily mean that the port is reachable from the internet.

Reachability also depends on:

• Windows Defender Firewall rules
• Network profile
• Router or NAT configuration
• Upstream firewalls
• Application binding address
• Organizational security controls

The Listening Ports section may show the process, port, protocol, address, and firewall status. Investigate unexpected listeners, but do not terminate them until you identify the owning application or Windows service.

Practical Troubleshooting Scenarios

Find the Cause of High CPU Usage

1. Open Resource Monitor.
2. Select the CPU tab.
3. Sort the Processes table by Average CPU.
4. Reproduce the slowdown.
5. Note the process name, PID, path, and description.
6. If it is a service host, inspect the Services section.
7. Confirm whether usage is sustained and whether it stops when the workload ends.

Update, repair, or reconfigure the responsible application when appropriate. Avoid changing process priority or CPU affinity as a permanent fix unless the application vendor or a tested operational procedure requires it.

Find What Is Using the Disk

1. Open the Disk tab.
2. Sort Processes with Disk Activity by Total.
3. Select the busiest process.
4. Inspect the file paths under Disk Activity.
5. Compare activity, response time, and queue behavior while the problem occurs.

Do not assume that 100% active time means the disk must be replaced. Software activity, paging, low free space, storage drivers, device health, and virtualized storage can all contribute.

Find a Process Locking a File

1. Open the CPU tab.
2. Expand Associated Handles.
3. Enter part of the filename or folder path.
4. Identify the matching process.
5. Save work in that application.
6. Close the application normally and try the file operation again.

If the owner is File Explorer, closing the relevant window or restarting Windows Explorer may release the handle. Avoid ending critical Windows processes.

Investigate High Memory Usage

1. Open the Memory tab.
2. Sort processes by Commit, Working Set, or Private.
3. Check available memory and Hard Faults/sec.
4. Reproduce the workload.
5. Watch whether one process continues growing after its workload finishes.
6. Restart or update the application if a leak is suspected.
7. Escalate persistent growth to the application vendor or development team.

Capture repeatable measurements before and after the workload. A single large working set is not necessarily a leak because Windows can reclaim some working-set memory.

Identify an Application Using the Network

1. Open the Network tab.
2. Sort Processes with Network Activity by Total.
3. Select the process.
4. Review its remote addresses and TCP connections.
5. Verify the executable’s path, publisher, purpose, and digital signature.
6. If the activity is unexplained, scan the computer with the organization’s approved security software.

Do not block an address solely because it is unfamiliar. Content delivery networks, cloud services, proxies, and shared infrastructure can use changing addresses.

Safe Use and Important Warnings

Ending Processes

Ending a process can:

• Lose unsaved work.
• Corrupt an incomplete file or database operation.
• Interrupt an update or backup.
• Sign out users or destabilize Windows.
• Cause a dependent service to fail.

Close applications normally whenever possible. Do not terminate system processes unless you understand their purpose and have an approved recovery plan.

Suspending Processes

Suspending a process stops its threads from running without closing the process. This can cause:

• Applications to stop responding.
• Locks to remain held.
• Dependent processes to wait indefinitely.
• Network sessions to time out.
• System components to become unstable.

Suspension is a diagnostic action, not a routine performance optimization.

Privacy and Security

Resource Monitor can expose:

• Usernames and process ownership
• Local file paths
• Application names
• Remote hostnames and IP addresses
• Open ports and service names

Remove or obscure sensitive information before sharing screenshots or diagnostic records publicly.

Benefits of Resource Monitor

Resource Monitor provides several practical advantages:

• It is built into Windows and requires no separate installation.
• It correlates resource usage with processes.
• It shows file-level disk activity.
• It can help locate open file handles.
• It displays active TCP connections and listening ports.
• It distinguishes several categories of physical memory.
• It provides a fast first step for diagnosing a live performance issue.
• Process filtering reduces unrelated information.
• It is useful to both help-desk technicians and system administrators.

Limitations and Alternatives

Use Resource Monitor for immediate investigation. Use Performance Monitor when you need counters collected over time, and use Windows Performance Recorder with Windows Performance Analyzer for detailed trace-based analysis. Microsoft documents WPR as an Event Tracing for Windows recording tool and WPA as the tool used to analyze the resulting ETL data.

Troubleshooting Resource Monitor

Resource Monitor Does Not Open

Try:

C:\Windows\System32\resmon.exe

or:

perfmon /res

If neither works:

1. Restart Windows.
2. Install pending Windows updates.
3. Check whether organizational application-control policies block the utility.
4. Ask an administrator to verify system-file and policy health.

Some Process Information Is Missing

Possible reasons include:

• Resource Monitor is not elevated.
• The process has already exited.
• Windows protects access to the process.
• The process belongs to another security context.
• Activity occurred before monitoring began.
• The process uses another broker, service, or shared host.

Run Resource Monitor as administrator when authorized, but remember that protected processes may still restrict access.

The Numbers Do Not Match Task Manager

Task Manager and Resource Monitor can use different sampling intervals, averaging periods, categories, and definitions. Values also change between screen updates.

Compare trends rather than expecting every figure to match exactly. Confirm that you are comparing the same process, metric, and time period.

The Problem Disappears Before It Can Be Identified

Resource Monitor is best for problems that can be reproduced or remain active long enough to observe. For brief or intermittent incidents, use Performance Monitor logging, Event Viewer, Reliability Monitor, or a WPR trace.

FAQ

Frequently Asked Questions

Is Resource Monitor included with Windows 11?

Yes. Resource Monitor is a built-in Windows tool and can be opened by running resmon.exe or perfmon /res.

Do I need administrator rights to use Resource Monitor?

Not for basic monitoring. Administrator rights may be required for complete information about other users’ processes or for actions such as terminating protected or elevated processes.

Is Resource Monitor the same as Task Manager?

No. Task Manager is designed for quick status checks and process management. Resource Monitor provides more detailed views of file activity, physical-memory categories, TCP connections, listening ports, services, handles, and modules.

Does a high Hard Faults/sec value mean the RAM is defective?

No. A hard fault means Windows retrieved a required memory page from disk-backed storage because it was not in physical RAM. It is not a hardware-failure message. Sustained hard faults may indicate memory pressure when accompanied by slow performance and heavy disk activity.

Can Resource Monitor detect malware?

It can reveal suspicious-looking processes, ports, or connections, but it cannot determine reliably whether software is malicious. Verify the executable path, publisher, signature, and reputation, then use approved security software.

Can Resource Monitor record performance history?

Resource Monitor is mainly a live monitoring tool and does not provide robust long-term recording. Use Performance Monitor Data Collector Sets or Windows Performance Recorder for historical or trace-based analysis.

Can I use Resource Monitor to close a locked file?

Resource Monitor can identify the process holding a matching file handle. Close that application normally to release the file. Resource Monitor does not provide a safe universal “unlock file” function.

Why is my disk at 100% when the transfer rate is low?

Active time measures how busy the device is servicing requests, not just the number of bytes transferred. Numerous small requests, high latency, paging, device problems, or slow storage can produce high active time with a modest transfer rate.

Does a listening port mean my computer is exposed to the internet?

Not necessarily. It means a process is waiting for connections on an address and port. Firewall rules, network binding, NAT, router settings, and upstream controls determine whether the port is reachable externally.

Can Resource Monitor monitor another computer remotely?

Resource Monitor is primarily intended for the local computer. For centralized or remote monitoring, use appropriate Windows administration, performance-monitoring, or enterprise-management tools.

FINAL RECOMMENDATION / CONCLUSION

Use Resource Monitor as the first detailed diagnostic tool when a Windows computer is slow and Task Manager does not provide enough information. Reproduce the problem, identify the affected resource, filter on the relevant process, and correlate activity across CPU, memory, disk, and network views.

Treat its measurements as evidence rather than an automatic diagnosis. Confirm sustained behavior, save work before taking process-control actions, and avoid terminating unfamiliar services or system processes. For intermittent, historical, or technically complex problems, continue the investigation with Performance Monitor, Event Viewer, Process Explorer, Process Monitor, or Windows Performance Recorder and Analyzer.

#Windows #ResourceMonitor #Resmon #Windows11 #Windows10 #WindowsServer #Troubleshooting #Performance #CPU #Memory #DiskUsage #NetworkMonitoring #HardFaults #TCPConnections #FileLocks #SystemAdministration #ITSupport #PerformanceMonitor #WindowsDiagnostics #TechSupport

SOURCES

• Microsoft Learn: perfmon command
• Microsoft Performance Team: Using Resource Monitor to Troubleshoot Windows Performance Issues—Part 1
• Microsoft Performance Team: Using Resource Monitor to Troubleshoot Windows Performance Issues—Part 2
• Microsoft Learn: Process Explorer
• Microsoft Learn: Windows Performance Recorder
• Microsoft Learn: Windows Performance Analyzer