How to Configure Windows Server 2016 Resource Monitor
Resource Monitor is a built-in diagnostic tool in Windows Server 2016 that provides a detailed, real-time view of how CPU, memory, disk, and network resources are being consumed by individual processes. Unlike Performance Monitor, which focuses on counter-based historical trends, Resource Monitor excels at pinpointing exactly which process, service, or connection is responsible for a specific resource spike right now. It is one of the first tools an administrator should reach for when investigating an unresponsive server, unexplained high CPU usage, or sudden disk saturation.
This guide explains how to open and navigate Resource Monitor, interpret each of its resource tabs, identify problematic processes, and use it alongside PowerShell for command-line diagnostics.
Opening Resource Monitor
Resource Monitor can be launched several ways. From Task Manager, click the Performance tab and then Open Resource Monitor at the bottom. Alternatively, use the Run dialog or a PowerShell session:
resmon.exeYou can also find it in Server Manager under Tools or by searching for Resource Monitor in the Start menu. Administrator privileges are required to see data for all processes, not just those running under your own account.
The Overview Tab
The Overview tab shows a compact summary of all four resource categories simultaneously — CPU, Disk, Network, and Memory — each with a small sparkline graph and a list of the top processes consuming that resource. This tab is the best starting point for a quick health check. If one of the four resource charts is constantly at its maximum, navigate to that specific tab for deeper detail.
The process list in the Overview CPU section shows each process with its PID, number of threads, CPU percentage, and average CPU usage. Click a column header to sort. Check the box next to any process to filter all four resource tabs simultaneously, showing only the activity generated by that process.
The CPU Tab
The CPU tab breaks down activity into three sections. The Processes section shows all running processes with CPU time, average load, and thread count. The Services section lists Windows services independently. The Associated Handles section shows the file system handles opened by the selected process, which is invaluable for diagnosing file locking issues. The Associated Modules section shows which DLLs are loaded by the selected process.
Right-click any process to access options including Suspend Process, End Process, Search Online, and Analyze Wait Chain. The Analyze Wait Chain option is particularly useful: it shows whether a process is blocked waiting for another process, helping you identify deadlock situations.
The Memory Tab
The Memory tab shows physical memory usage at the process level and provides a graphical breakdown of the total RAM into Used, Modified, Standby, and Free categories. Understanding these categories is important:
Used memory is actively allocated by processes or the OS kernel. Modified memory contains data that has been changed but not yet written to disk. Standby memory is a cache of recently accessed data that can be released if applications need more RAM. Free memory is immediately available.
The Processes section shows each process’s Working Set (total memory), Shareable memory, and Private memory. High Private values indicate memory that cannot be shared with other processes, and a process with rapidly growing Private memory may have a memory leak.
The Disk Tab
The Disk tab identifies which processes are performing disk I/O and against which files. It shows read and write speeds in bytes per second for each process, along with the specific files being read or written. The Storage section at the bottom shows queue length and response time per physical disk.
Sorting the Processes with Disk Activity section by Total (B/sec) immediately reveals the highest disk consumer. If a process is reading or writing unexpectedly, check the file paths in the Disk Activity detail section to understand what data is being accessed.
The Network Tab
The Network tab shows active network connections at the process level. For each process with network activity, you can see local and remote addresses and ports, the connection state (ESTABLISHED, LISTENING, TIME_WAIT, etc.), and send and receive rates in bytes per second.
The Listening Ports section shows every port on which a process is accepting connections. This is very useful for security audits — compare the listening ports list against your expected service inventory to spot unexpected services.
The TCP Connections section and Firewall Status column show whether Windows Firewall is permitting or blocking each listening process.
Using PowerShell for Similar Diagnostics
When Resource Monitor is not available (such as on Server Core), replicate its functionality with PowerShell. List the top CPU-consuming processes:
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, Id, CPU, WorkingSetList processes sorted by memory working set:
Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 10 Name, Id, @{N='MemMB';E={[math]::Round($_.WorkingSet/1MB,1)}}Check active TCP connections with owning process ID:
Get-NetTCPConnection | Where-Object State -eq 'Established' | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcessCheck what files a specific process has open using the SysInternals handle utility or by reading from the system:
handle.exe -p notepadPractical Troubleshooting Workflow
When a server becomes sluggish, open Resource Monitor and check the Overview tab. Identify which resource is saturated. Switch to that resource’s tab and sort by the highest consumer. Right-click the top process and select Search Online or Analyze Wait Chain for additional context. If the process is unexpected or stuck, use End Process from the right-click menu to terminate it.
Resource Monitor on Windows Server 2016 provides unmatched real-time visibility into exactly what your server is doing at the process level. Making it part of your regular diagnostic workflow reduces mean time to identify root causes of performance incidents significantly.
