How to Use Resource Monitor on Windows Server 2012 R2

How to Use Resource Monitor on Windows Server 2012 R2

Resource Monitor (resmon.exe) on Windows Server 2012 R2 provides a more granular, real-time view of system resource utilization than Task Manager, offering per-process breakdowns of CPU, memory, disk, and network activity with detailed metrics not available elsewhere in the built-in toolset. While Performance Monitor excels at historical trend analysis, Resource Monitor fills the role of immediate triage — quickly identifying which specific processes are consuming resources, which files are being accessed, and which network connections are active at any given moment.

Systems administrators frequently use Resource Monitor during incident response: a server is running slowly, and you need to identify the cause within minutes. Resource Monitor’s ability to filter views by process, see which disk I/O is occurring on which files, and observe live network connections per process makes it the first tool to reach for in performance troubleshooting scenarios. This guide covers every tab and major feature of Resource Monitor on Windows Server 2012 R2.

Prerequisites

– Windows Server 2012 R2 with local console or Remote Desktop access
– Administrative credentials (some views require elevation)
– Performance Logs & Alerts service running
– No specific prerequisites — Resource Monitor is available on any WS2012 R2 installation

Step 1: Open Resource Monitor

Launch Resource Monitor using any of these methods:

# From Run dialog or Start search
resmon.exe

# From Task Manager (Performance tab > Open Resource Monitor button)
taskmgr.exe

# From PowerShell
Start-Process resmon.exe

Resource Monitor opens with five tabs: Overview, CPU, Memory, Disk, and Network. The Overview tab provides a simultaneous summary of all four resource areas, each with an expandable section showing the top consumer processes.

Step 2: Use the Overview Tab for Quick Triage

The Overview tab is the starting point for performance triage. It shows four mini-graphs (CPU, disk, network, memory) with real-time updates, and four expandable sections listing the processes consuming each resource type.

The key workflow on the Overview tab is to identify a high-consuming process, check its checkbox in the Processes section, and then observe how all four resource graphs filter to show only the selected process. This immediately reveals whether a high-CPU process is also causing disk I/O or generating network traffic, which helps distinguish between a compute-bound task and an I/O-bound one.

The CPU section on Overview shows:

– PID and Image name
– CPU column: instantaneous CPU usage percentage
– Average CPU column: average over approximately 60 seconds
– Description: friendly name from the process executable
– Threads and Handles: useful for detecting handle leaks or thread pool exhaustion

Step 3: Detailed CPU Analysis

Click the CPU tab for detailed per-process CPU analysis. The tab has two main sections:

Processes section — Shows all running processes with CPU%, Average CPU, Threads, Handles, and Image. Sort by CPU to find the top consumer. The “Average CPU” column is particularly useful because instantaneous CPU can spike briefly; average shows sustained usage.

Services section — Shows services hosted in svchost.exe processes. Since a single svchost.exe can host many services, this section tells you exactly which service within svchost is consuming CPU. This is critical for diagnosing service-related CPU spikes.

When a process is checked in the Processes section, the Associated Handles and Associated Modules sections appear at the bottom, showing every DLL and file handle the selected process has open. This is invaluable for diagnosing file locking and DLL conflicts.

# PowerShell equivalent for CPU-heavy processes
Get-Process | Sort-Object CPU -Descending | Select-Object -First 15 `
    Id, Name, CPU, 
    @{N="MemMB"; E={[math]::Round($_.WorkingSet/1MB,1)}},
    Handles, Threads

Step 4: Memory Analysis in Detail

The Memory tab in Resource Monitor provides a breakdown of physical memory usage that is far more detailed than what Task Manager shows. The bottom of the Memory tab displays a color-coded memory bar showing:

– In Use (green): Memory actively used by processes
– Modified (orange): Memory modified by a process but not yet written to disk
– Standby (blue): Memory that was used and is now available but still holds cached data
– Free (dark gray): Memory that has never been used or has been zeroed

The key columns in the Processes section of the Memory tab:

– Commit (KB): Virtual memory committed to the process (not necessarily in RAM)
– Working Set (KB): Physical memory currently used by the process
– Shareable (KB): Portion of Working Set that can be shared with other processes
– Private (KB): Memory exclusively used by this process (non-shareable)

High Private memory values that grow continuously indicate a memory leak:

# PowerShell for private memory analysis
Get-Process | Sort-Object PrivateMemorySize64 -Descending | Select-Object -First 10 `
    Id, Name,
    @{N="PrivateMB"; E={[math]::Round($_.PrivateMemorySize64/1MB,1)}},
    @{N="WorkingSetMB"; E={[math]::Round($_.WorkingSet64/1MB,1)}},
    @{N="CommitMB"; E={[math]::Round($_.PagedMemorySize64/1MB,1)}}

Step 5: Disk Activity Analysis

The Disk tab provides per-process, per-file disk activity information — the most detailed disk view available in built-in Windows tools. The top section shows processes with disk I/O, and the bottom section shows Disk Activity with the exact file path being read or written.

Key columns in the Disk Activity section:

– File: Full path of the file being accessed
– Read (B/sec): Read throughput for this specific file
– Write (B/sec): Write throughput for this specific file
– I/O Priority: Normal, Low, Very Low — shows if the I/O is background or foreground
– Response Time (ms): How long each I/O request takes — values above 20ms indicate a slow disk

The Storage section at the bottom shows per-disk statistics including queue length — a queue length consistently above 2 indicates the disk is saturated:

# PowerShell equivalent for disk activity
Get-Counter -Counter "PhysicalDisk(*)Avg. Disk Queue Length",
                     "PhysicalDisk(*)Disk Reads/sec",
                     "PhysicalDisk(*)Disk Writes/sec",
                     "PhysicalDisk(*)Avg. Disk sec/Transfer" | 
    Select-Object -ExpandProperty CounterSamples |
    Select-Object InstanceName, CookedValue, Path

Step 6: Network Connection Analysis

The Network tab is uniquely powerful — it shows every active TCP connection per process and all network activity including DNS activity. This information is difficult to obtain from other built-in tools.

Processes with Network Activity: Shows each process generating network traffic with send/receive bytes per second.

Network Activity: Shows each individual network connection with local address, remote address, and bytes transferred — allowing you to see which process is communicating with which external IP address.

TCP Connections: Shows detailed TCP connection state (ESTABLISHED, TIME_WAIT, etc.), local and remote ports, and the process owning the connection.

Listening Ports: Shows every port with an active listener — essential for a quick security audit of what network services are exposed.

# PowerShell equivalent for network connections
Get-NetTCPConnection | Where-Object State -eq "Established" | 
    ForEach-Object {
        $process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            LocalAddress  = "$($_.LocalAddress):$($_.LocalPort)"
            RemoteAddress = "$($_.RemoteAddress):$($_.RemotePort)"
            State         = $_.State
            PID           = $_.OwningProcess
            ProcessName   = $process.Name
        }
    } | Sort-Object ProcessName | Format-Table -AutoSize

Step 7: Filter Views to Specific Processes

One of the most powerful features of Resource Monitor is the ability to filter all tabs to show only data related to one or more selected processes. To filter:

1. On the Overview tab, find the process of interest in the Processes section
2. Check the checkbox next to the process name
3. All resource graphs and detail sections now show only activity attributable to that process
4. Switch to other tabs (Memory, Disk, Network) to see detailed per-resource data for the selected process only

This workflow allows you to trace the complete resource footprint of a specific process — for example, an application server that seems to be causing slow disk performance — by selecting it and immediately seeing all its disk I/O, including which files it is writing to.

Step 8: Use Resource Monitor Alongside Performance Monitor

Resource Monitor and Performance Monitor serve complementary roles. Use this workflow for comprehensive performance analysis:

# Step 1: Check current resource utilization summary
Get-Counter -Counter "Processor(_Total)% Processor Time",
                     "MemoryAvailable MBytes",
                     "PhysicalDisk(_Total)% Disk Time",
                     "Network Interface(*)Bytes Total/sec" |
    Select-Object -ExpandProperty CounterSamples |
    Select-Object Path, CookedValue

# Step 2: If any metric is elevated, use Resource Monitor to identify the process

# Step 3: Once identified, use Get-Process for additional detail
$suspectPID = 1234
Get-Process -Id $suspectPID | Select-Object Name, Id, CPU, WorkingSet64, Handles, StartTime

# Step 4: Check what files the process has open
# (Requires Sysinternals handle.exe or Resource Monitor GUI)

Step 9: Diagnose File Lock Issues

Resource Monitor’s Associated Handles feature (on the CPU tab) can identify which process is holding a lock on a file. Select a process in the CPU Processes section, then scroll down to see “Associated Handles.” This shows every file, registry key, mutex, and other named kernel object the process has open — essential for diagnosing “cannot delete file because it is in use” errors.

# Find which processes have a specific file open (PowerShell 4.0 approach using openfiles)
openfiles /query /fo table | findstr /i "filename.log"

# Enable openfiles tracking (small performance cost)
openfiles /local on

# After enabling, query open files
openfiles /query /fo csv > C:TempOpenFiles.csv

Summary

Resource Monitor on Windows Server 2012 R2 provides uniquely detailed, real-time visibility into CPU, memory, disk, and network utilization at the individual process and file level. Its ability to filter all views to a specific process enables rapid root-cause analysis during performance incidents. The Network tab’s per-process TCP connection and DNS activity views are particularly valuable for security investigations and network troubleshooting. Used alongside Performance Monitor for historical context and PowerShell cmdlets for automation, Resource Monitor completes the built-in performance analysis toolkit and should be among the first tools an administrator opens when investigating server performance complaints.