Why is Windows using so much memory?

What this covers

When Windows uses a lot of memory, your PC slows down, apps stutter, and the disk may churn as the page file absorbs overflow. The good news: you can pinpoint the culprit from the command line without installing anything. This guide walks you from finding the memory hogs to verifying your system has recovered.

Symptom

Find which processes are eating your RAM

Before changing anything, rank the top 15 processes by working-set memory. This tells you whether one runaway app or many small ones are responsible. If a single process dominates, you know what to close or fix; if memory is spread thin, look at background services next.

$ Get-Process | Sort-Object WS -Descending | Select-Object -First 15 Name, Id, @{n='Mem(MB)';e={[math]::Round($_.WS/1MB,1)}}, @{n='CPU(s)';e={[math]::Round($_.CPU,1)}} | Format-Table -AutoSize

Check what is hiding inside svchost.exe

svchost.exe often appears multiple times with large memory footprints, but each instance hosts different services. List the services inside each one so you know which Windows component is actually consuming the memory instead of blaming Windows blindly.

$ tasklist /SVC /FI "IMAGENAME eq svchost.exe"

See how close you are to memory exhaustion

The page file absorbs overflow when physical RAM runs out. Query its current and peak usage: high peak usage means Windows has been spilling to disk, which explains slowdowns even before memory is fully exhausted. Low peaks suggest your problem is a single misbehaving process, not a system-wide shortage.

$ Get-CimInstance Win32_PageFileUsage | Select-Object Name, AllocatedBaseSize, CurrentUsage, PeakUsage

Confirm the offender is still running before acting

Once you have identified a suspicious program from the memory ranking, confirm it is actually running right now and note its PID. This makes sure you act on the right instance — especially if the program spawns multiple processes — before you close or restart it.

$ tasklist | findstr /i chrome    ::  or filtered directly:  tasklist /FI "IMAGENAME eq chrome.exe"

Verify the system is back to normal

After closing or restarting the memory hog, re-check the heaviest processes ranked by CPU. A healthy system shows no single process dominating for long, and the previously bloated process should no longer appear at the top of the memory list either.

$ Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, Id, CPU

Check the stability timeline for related crashes

Open Reliability Monitor to see whether memory pressure coincided with app crashes or driver failures. A clean recent timeline, with no new errors after your fix, confirms the memory problem is resolved rather than just moved.

$ perfmon /rel

How to confirm it worked

Re-rank the heaviest processes and open Reliability Monitor: no single process should dominate, and there should be no new errors after your fix.

Sources

• tasklist
  Microsoft Learn · vendor-doc · 2026-09-17
  Evidence: Syntax includes /svc which 'Lists all the service information for each process' — i.e. services hosted inside each process.
• TaskList — List processes running on the machine
  SS64 · technical · 2026-09-17
  Evidence: Documents /SVC: 'List services hosted within each process' — useful for identifying the services inside svchost.exe instances.
• Win32_PageFileUsage class
  Microsoft Learn · vendor-doc · 2026-09-17
  Evidence: Win32_PageFileUsage exposes AllocatedBaseSize (current MB), CurrentUsage and PeakUsage for each page file on the system.
• Start Reliability Monitor
  Microsoft Learn · vendor-doc · 2026-09-17
  Evidence: Instructions state you can start Reliability Monitor "in its own window by typing perfmon /rel".
• Get-Process - SS64
  SS64 · technical · 2026-09-17
  Evidence: Shows sorting processes by working set and other memory-oriented examples.
• perfmon
  Microsoft Learn · vendor-doc · 2026-09-17
  Evidence: Lists the /rel switch that starts Reliability Monitor with a specific report.
• Get-Process
  Microsoft Learn · vendor-doc · 2026-09-17
  Evidence: Documents Get-Process objects and their WS and CPU properties.

Last verified: 2026-09-21

Related guides