Interactive Troubleshooter

Published: Sep 2, 2026

Memory Leak in Windows: Find the Process Causing It

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

Pinpoint and resolve non-paged pool memory leaks, runaway user-mode processes, and system service bloat in Windows 11. Systematic diagnostic workflow using Task Manager, Resource Monitor, Poolmon, and Sysinternals RAMMap.

Full Diagnostic Tree & Step-by-Step Overview

What type of high RAM usage or memory leak behavior are you observing in Windows 11?

Task Manager shows a specific desktop app or web browser consuming massive RAM
High RAM usage (80-99%) but Task Manager processes do not add up to total memory used
A core Windows system process like svchost.exe, System, or MsMpEng is eating memory

How does the user-mode application memory usage behave over time?

RAM consumption increases steadily without stopping as long as the application remains open
Multiple hidden or orphaned background sub-processes remain in RAM after closing the main application

Diagnose and Fix User-Mode Heap Memory Leaks via Process Explorer

Solution:

Root Cause: User-Mode Heap Memory Leak in Application Code

An application fails to release allocated memory (heap allocations) back to the OS after completing tasks. This is common in web browsers, electron-based applications, or programs with corrupt GPU acceleration hooks.

Step-by-Step Fix:

1.Identify Commit Charge with Sysinternals Process Explorer:

Download and run Process Explorer as Administrator.

Right-click the column header, choose Select Columns, and check Private Bytes and Working Set under Process Memory.

Sort by Private Bytes (this represents actual memory requested by the app that cannot be shared).

2.Isolate Hardware Acceleration and Extensions:

If the culprit is a browser (Chrome/Edge), open browser settings, search for Hardware Acceleration, and turn it OFF.

Type about:performance or chrome://task-manager inside the browser to identify the specific leaking extension or tab process.

3.Reconfigure App Heap Management:

Open Settings > Apps > Installed apps.

Select the leaking program, click Advanced options (if available), and select Repair or Reset.

4.Update or Cap App Memory Consumption:

Ensure the application is updated to the latest build or set launch parameters to limit heap usage.

Terminate Orphaned Background Sub-Processes & Rebuild App Cache

Solution:

Root Cause: Orphaned Process Handles and Unreleased Sub-Processes

When software crashes or closes improperly, its child threads or sub-processes remain active in memory holding open handles, preventing Windows from reclaiming committed RAM.

Step-by-Step Fix:

1.Force Terminate Process Tree via Command Line:

Press Win + X and launch Terminal (Admin) or Command Prompt (Admin).

Find the process image name (e.g., appname.exe) in Task Manager.

Execute the process tree kill command:

cmd
     taskkill /F /T /IM appname.exe

2.Clear AppData Temporary Cache:

Press Win + R, type %LocalAppData%, and hit Enter.

Locate the folder corresponding to the leaking app and delete its Cache and GPUCache subdirectories.

3.Disable Startup and Background Execution:

Press Ctrl + Shift + Esc to open Task Manager.

Navigate to Startup apps and set the leaking application status to Disabled.

Go to Settings > Apps > Installed apps, open the app's advanced settings, and set Background apps permissions to Never.

In Task Manager Performance tab > Memory, which kernel pool tag or metric is abnormally high?

Non-paged pool (NPP) is elevated (several gigabytes) and continuously rising
Paged pool or Mapped Files / Standby Cache is filling up total physical RAM

Identify and Update Leaking Kernel Driver Using Poolmon Tag Analysis

Solution:

Root Cause: Kernel-Mode Driver Non-Paged Pool (NPP) Leak

A kernel driver (frequently network adapter drivers, RAID controllers, or third-party antivirus drivers) allocates memory in the Non-Paged Pool without freeing it. Because this memory cannot be paged to disk, physical RAM saturates completely.

Step-by-Step Fix:

1.Locate the Leaking Pool Tag using Poolmon:

Open Command Prompt (Admin) and check if Poolmon is available (part of Windows Driver Kit), or download poolmon.exe.

Run poolmon -b to sort kernel pool allocations by byte count (B).

Note the 4-character tag in the Tag column associated with highest non-paged memory (Nonp). Common culprits include NDis (Network), Athr (Wi-Fi), or GeFd (NVIDIA).

2.Match the Pool Tag to the Driver File:

Run the following command in Command Prompt replacing XXXX with your 4-character tag:

cmd
     findstr /m /l /i /s "XXXX" C:\Windows\System32\drivers\*.sys

Note the .sys file returned (e.g., iqvw64e.sys or rtwlane.sys).

3.Identify the Associated Hardware and Update Driver:

Run driverquery /FO CSV | findstr "[filename.sys]" to identify the driver's display name.

Open Device Manager, locate the corresponding hardware device (e.g., Network Adapter), right-click, select Update driver, or download the official manufacturer package directly.

Clear Mapped File Cache and Purge Standby List using Sysinternals RAMMap

Solution:

Root Cause: System Working Set & Mapped File Cache Accumulation

Windows 11 automatically caches read/write file data into physical memory as Mapped Files or Standby Memory. In certain scenarios, the Memory Manager fails to purge this standby list when active applications demand RAM.

Step-by-Step Fix:

1.Inspect Memory Breakdown with RAMMap:

Download and launch Sysinternals RAMMap as Administrator.

Look at the Use Count tab and examine the Mapped File, Page Table, and Active columns.

2.Purge the Standby Memory List:

In RAMMap, click Empty in the top menu bar.

Select Empty Standby List and Empty Working Sets to immediately reclaim cached physical RAM.

3.Disable or Reset SysMain (SuperFetch) Service:

Press Win + R, type services.msc, and press Enter.

Scroll down to SysMain, right-click, and select Properties.

Change Startup type to Disabled and click Stop.

4.Adjust System Cache Registry Limits:

Open regedit and navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

Ensure ClearPageFileAtShutdown is set to 0 and reboot your system to apply clean memory mapping.

Which specific Windows system process or service group is consuming excess RAM?

A Service Host container process (svchost.exe) bundling multiple system services
Antimalware Service Executable (MsMpEng.exe) or Windows Defender background worker

Isolate Leaking Service Host (svchost.exe) Group via Command Line

Solution:

Root Cause: Service Host Process Grouping & Corrupted Service State

Multiple Windows services run under shared svchost.exe process instances. When an individual background service (such as Windows Update, SysMain, or Windows Search) encounters a corrupt index or queue, the host process memory grows unbounded.

Step-by-Step Fix:

1.Identify the Exact Service PID inside svchost.exe:

Open Task Manager, switch to the Details tab, and locate the svchost.exe instance with high memory.

Note its PID (e.g., 3412).

Open Command Prompt (Admin) and list services running inside that PID:

cmd
     tasklist /svc /fi "pid eq 3412"

2.Split the Leaking Service into its Own Host Process:

Force the specific service (e.g., wuauserv or wsearch) to run in an isolated process container by running:

cmd
     sc config [ServiceName] type= own

*(Replace [ServiceName] with the actual service name string)*.

3.Restart the Service and Reset Components:

Stop and restart the isolated service:

cmd
     net stop [ServiceName] && net start [ServiceName]

If the service is wsearch, rebuild the index in Control Panel > Indexing Options > Advanced > Rebuild.

Examine Defender Exclusions and Repair Antimalware Engine Memory Bloat

Solution:

Root Cause: Antimalware Engine File Cache & Infinite Scan Loops

MsMpEng.exe (Antimalware Service Executable) can experience memory leaks when real-time monitoring gets trapped in an infinite scan loop over large compressed archives, virtual machine disks, or developer cache directories (node_modules).

Step-by-Step Fix:

1.Add Exclusions for Large Working Directories:

Go to Settings > Privacy & security > Windows Security > Virus & threat protection.

Click Manage settings under Virus & threat protection settings.

Scroll to Exclusions and click Add or remove exclusions.

Add paths for heavy developer folders, local VM disks, or large archive directories.

2.Disable Scans of Compressed Archives via PowerShell:

Open PowerShell (Admin).

Execute the following command to prevent real-time scanning from parsing giant zip/rar files into memory:

powershell
     Set-MpPreference -DisableArchiveScanning $true

3.Update Security Platform Engine and Binaries:

In PowerShell (Admin), force a clean update of the antimalware platform and definitions:

powershell
     Update-MpSignature

4.Reboot the System:

Restart Windows 11 to confirm MsMpEng.exe memory usage stabilizes under 250 MB.

Related Diagnostic Guides

Windows 11 Wi-Fi Connected but No Internet? How to Fix It

Google Account Suspicious Activity? How to Check for Unknown Devices

Microsoft Account Hacked? How to Recover and Secure Your Account

Fast Charging Not Working? How to Check USB PD and Quick Charge Support

Laptop Using Integrated Graphics Instead of Dedicated GPU? Here's How to Fix It

Subscribe to StepDiag

Embed Guide on Your Website