PC Memory Leak: Find What’s Using All Your System RAM

Your PC starts fast, then slows down over a few hours. Apps stutter, the fans spin up, and eventually everything freezes. Memory is nearly full, but nothing obvious is using it. This guide explains what a memory leak is and how to find the cause using free Windows tools.

Skip Ahead

You do not have to read this post in order.

• Want to catch a slow leak? Jump to Log Memory Usage Until It Happens Again and start the PowerShell logger.
• Suspect a driver? Jump to Catch The Driver’s Pool Tag With PoolMonX and use PoolMon to name it.
• Need relief right now? Jump to Apps To Manage RAM Until You Fix The Leak.

What Is A PC Memory Leak?

A memory leak happens when a program, service or driver asks Windows for memory and never gives it back. One small leak is harmless. A steady leak adds up over hours or days until free RAM runs out. Windows then relies on the page file, which is far slower, and the whole PC starts to crawl.

There are two kinds, and they behave differently:

• App leaks: one program’s memory grows and grows. These are easy to spot because the process gets bigger in Task Manager.
• Kernel or driver leaks: the memory sits in Windows’ kernel pools, so no app looks big. These are the hard ones, and they are the focus of this guide.

A leak is not the same as high memory use. Windows deliberately uses spare RAM as cache, so a PC at 70% memory with no slowdown is usually fine. The giveaway for a leak is memory that keeps climbing and never comes back down, even when you close apps.

Don’t Want To Do It Manually? Let An AI Assistant Do The Heavy Lifting

You can follow every step in this guide by hand, but you do not have to. A free AI assistant can read your PowerShell output  memlog.csv and your PoolMonX results for you, then point out which process or pool is growing and what to check next. What takes hours of scrolling through rows and charts by hand can take minutes. We recommend it especially for the memory usage log, because that file can run to thousands of rows. Just run the logging script, wait for the next slowdown, and hand the CSV to an AI assistant.

Remember to remove anything private from the data first. See the privacy tip in Tools Needed below.

Tools Needed

• Windows Task Manager: your first check, built into Windows.
• Windows Resource Monitor: a more detailed memory view, built into Windows.
• PowerShell: for memory summaries, event log searches and a logging script. Built into Windows.
• PoolMonX: a free pool monitor on GitHub that shows which kernel pool tag is growing.
• Poolmon.exe (optional): the command-line equivalent, included in the Windows Driver Kit.
• Microsoft Excel (or any spreadsheet app): to chart the log and spot growth over time.
• Event Viewer: to see what changed when memory started climbing.
• Command Prompt: to match a pool tag to a driver file.
• A RAM management app (optional): CleanMem or WinMemoryCleaner, to buy time until the leak is fixed.
• A free AI assistant (optional, but a real time-saver): Microsoft Copilot, ChatGPT and Google Gemini all have free tiers. Paste in your PowerShell summary or part of your log and ask which process or pool is growing. It can also explain an unfamiliar pool tag or Event Viewer error in plain English.

Privacy tip: before pasting anything into an AI tool or sharing it with anyone, check the process names, folder paths and PC name in the output, and remove anything you would not want public.

Start With Windows Task Manager

Press Ctrl+Shift+Esc to open Task Manager. On the Processes tab, click the Memory column to sort by usage. If one app is far bigger than the rest, you may have found your leak.

For a quick summary in PowerShell, run this. It prints total memory used and the ten biggest processes:

$os = Get-CimInstance Win32_OperatingSystem
"{0:N1} GB used of {1:N1} GB" -f (($os.TotalVisibleMemorySize-$os.FreePhysicalMemory)/1MB), ($os.TotalVisibleMemorySize/1MB)
Get-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 10 Name, @{n='M

Use The Task Manager Performance Tab

The Performance tab shows what the Processes tab cannot. Click Memory in the left-hand list and read these figures:

• In use (Compressed): RAM currently held by apps and Windows. The compressed figure shows memory Windows has squeezed to save space.
• Available: RAM that can be handed to apps straight away, including cached data.
• Committed: how much memory Windows has promised to apps, shown against the total your RAM and page file can support. If the first number keeps nearing the second, you are running out of room.
• Cached: data Windows keeps in spare RAM for speed. This is normal and is released when needed.
• Paged pool and Non-paged pool: kernel memory used by Windows and drivers. This is the key figure for hidden leaks. The non-paged pool must stay in physical RAM, so a leaking driver can fill it. A healthy PC usually sits at a few hundred MB to about 1 GB. Sustained growth past 2 to 4 GB is a warning sign.

Hover over the memory composition bar to see how RAM splits between In use, Modified, Standby and Free.

Tip: On the Details tab, right-click any column header, choose Select columns, and add Commit size. Then sort by it. Commit size shows how much memory a process has reserved, which exposes growing apps that the working set figure can hide.

If the Processes and Details tabs show no big app, but memory is still near 100%, and the Non-paged pool is huge, suspect a driver. Network, VPN, antivirus, and virtualisation drivers are the usual suspects.

Use Windows Resource Monitor

Resource Monitor gives you a closer look. Press Win+R, type resmon and press Enter. You can also click Open Resource Monitor at the bottom of the Task Manager Performance tab.

1. Click the Memory tab.
2. Look at the Physical Memory bar at the bottom. It splits RAM into Hardware Reserved, In Use, Modified, Standby and Free. A leak shows up as In Use growing while Free and Standby shrink.
3. In the process list, sort by Commit and then by Private. Private shows memory only that process uses, which is the best measure of a leaking app.
4. Watch the Hard Faults/sec graph. Constant spikes mean Windows is swapping data to disk because RAM is full.

If the process list shows nothing unusual, but In Use is high, the memory is probably in the kernel. Keep going.

Quick Checks Before You Dig Deeper

First, make sure the page file is on. Press Win+R, run sysdm.cpl, then go to Advanced, Performance Settings, Advanced, Virtual memory. It should be set to “Automatically manage all paging file sizes”. With the page file off, the PC freezes hard once RAM fills up instead of slowing down gradually.

Second, restart your browsers now and then. A long session with several browsers open, each with five or more processes using 0.5 to 2 GB, adds up quickly.

Apps To Manage RAM Until You Fix The Leak

Tracking down a leak can take days. In the meantime, a RAM management app can keep your PC usable. These tools trim the memory that apps are holding without using, which gives Windows free RAM back.

• CleanMem: runs quietly in the background and trims the memory used by running processes on a schedule. Set it and forget it. Check the licence on the official site before you install.
• WinMemoryCleaner: a free tool that clears several memory areas on demand or automatically, including process working sets, the system cache and the standby list.

An honest warning: these apps treat the symptom, not the cause. They can help with an app that hoards memory, but they cannot reclaim kernel memory that a leaking driver holds, so a Non-paged pool leak will keep growing. Clearing the cache can also make Windows feel slightly slower for a minute while it reloads data. Use them as a stopgap, and keep hunting for the real cause.

Want to compare more options? See our full guide: Best Windows RAM Management Software in 2026: Tested & Compared.

Log Memory Usage Until It Happens Again

Leaks are slow, so you need a record. Run this in PowerShell and leave the window open. Every 60 seconds it saves the top five processes, free RAM and the kernel memory pools to a CSV file on your Desktop:

$log = "$env:USERPROFILE\Desktop\memlog.csv"
while ($true) {
  $t = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
  $c = Get-Counter '\Memory\Available MBytes','\Memory\Pool Nonpaged Bytes','\Memory\Pool Paged Bytes'
  $v = $c.CounterSamples.CookedValue
  Get-Process | Sort-Object PrivateMemorySize64 -Descending | Select-Object -First 5 | ForEach-Object {
    [pscustomobject]@{Time=$t; FreeMB=[int]$v[0]; NonPagedMB=[int]($v[1]/1MB); PagedMB=[int]($v[2]/1MB); Process=$_.Name; PrivateMB=[int]($_.PrivateMemorySize64/1MB)}
  } | Export-Csv $log -Append -NoTypeInformation
  Start-Sleep 60
}

After the next slowdown, open memlog.csv in Excel. Select the Time, FreeMB and NonPagedMB columns and insert a line chart. A steady upward line in NonPagedMB with no matching process growth points to a driver. If one process’s PrivateMB climbs over time, that app is leaking.

Find What Changed

Once the chart shows when memory started climbing, look at what happened around then, such as an update, a network change, waking from sleep or a backup. This command lists System log errors and warnings from the last 24 hours:

Get-WinEvent -FilterHashtable @{LogName='System'; Level=2,3; StartTime=(Get-Date).AddHours(-24)} |
  Select-Object TimeCreated, ProviderName, Id, Message | Format-Table -AutoSize -Wrap

You can also search Event Viewer under Windows Logs, System, around the same timestamp. Look for driver installs, service restarts and network adapter resets.

Catch The Driver’s Pool Tag With PoolMonX

This step gives you proof. Download PoolMonX from GitHub, or use poolmon.exe from the Windows Driver Kit. Run it as administrator while memory is climbing, click the Non-Paged column header to sort by size, and note the four-letter tag at the top.

Then find which driver uses that tag. Open an administrator Command Prompt and run this, replacing ABCD with your tag:

findstr /s /m /l ABCD C:\Windows\System32\drivers\*.sys

The file names that come back tell you which drivers contain the tag. Microsoft documents common tags in pooltag.txt, which ships with the Windows Debugging Tools. Tags starting with Vid or Vm, for example, point to virtualisation components.

How To Confirm The Culprit

1. Restart the PC to get the memory back.
2. Fully quit the suspect program, including from the system tray, and stop its background service in an administrator PowerShell window. Replace the placeholder with the real service name:

Stop-Service -Name "ServiceName"; Get-Service -Name "ServiceName"

3. Watch Task Manager, Performance, Memory, Non-paged pool for a while. If it stays flat, start the program again and see whether it begins climbing.
4. For definitive proof, run PoolMonX while the leak is active and check whether the tag at the top matches the driver you traced.

If the leak follows the app, update it, reinstall it or report it to the developer with your chart and pool tag as evidence.

Conclusion

Task Manager is the right first stop, and its Performance tab and Resource Monitor tell you far more than most people realise. When memory fills up with no obvious culprit, a log, a chart and a pool tag turn a vague slowdown into something you can name and report. Use a RAM management app if you need breathing room, but remember it only masks the problem. Fix the cause by updating, replacing or reporting the faulty app or driver.

Questions People Ask

What Is A Memory Leak In Windows?

A memory leak happens when a program or driver keeps asking for memory and never gives it back. Available RAM shrinks over hours or days until the PC slows down or freezes.

How Do I Find What Is Using All My RAM?

Start with Task Manager’s Processes tab, sorted by Memory. If nothing stands out, check the Non-paged pool on the Performance tab, open Resource Monitor, and log memory with PowerShell until the problem returns.

Why Does Task Manager Show High Memory Use But No Large Process?

The memory is probably in the kernel, not in an app. Check the Paged pool and Non-paged pool figures. Large values usually mean a driver leak.

What Is The Non-Paged Pool?

It is kernel memory that must stay in physical RAM and can never move to the page file. A leaking driver can fill it and leave less RAM for everything else.

Do RAM Cleaner Apps Fix Memory Leaks?

No. Apps like CleanMem and WinMemoryCleaner can trim memory that apps hold, which helps in the short term. They cannot fix the leak itself, and they cannot free kernel memory held by a leaking driver. Read our Best Windows RAM Management Software in 2026 post if you need a RAM optimiser.

Is PoolMonX Safe To Use?

PoolMonX is a free, open-source tool on GitHub that reads pool statistics. As with any download, get it from the official GitHub page and run it as administrator.

Will Restarting Fix A Memory Leak?

Restarting clears the memory, but the leak returns if the cause is still there. Use the logging steps to identify the app or driver and fix it for good.

Should I Turn Off The Page File To Stop Memory Problems?

No. Leave it on Automatically manage. Without it, Windows has nowhere to move data when RAM fills, and the PC can freeze instead of slowing down.