How do I tell what program is slowing down my machine?

Process Explorer

We're going to start by downloading and installing Process Explorer. That's a free utility that can be thought of as a replacement for Windows' own Task Manager. Process Explorer, often just "procexp", provides a much more detailed view of what's happening on your machine.

By default, Process Explorer does not run with administrative privileges, which means that it'll show you some, but not all of the information that we need.

Click the File menu, then click Show Details for All Processes:

You'll probably get a UAC prompt to confirm.

CPU Usage

A program which is using all of your computers' CPU can often impact the performance of other applications or even the entire system, resulting in the delayed or stuttered scrolling that you're seeing.

In Process Explorer, click the column header labeled CPU to sort the display by those applications using the most CPU. You may need to click on it twice - first, to sort in increasing order and then again to sort in decreasing order, with those using the most CPU at the top.

In the display above, you can see that the top "user" of the CPU is the "System Idle Process". That's not a real process, but it indicates that the CPU is idle, doing nothing, roughly half of the time.

It's very common to have the System Idle Process appear at the top of the list and that's good. It means your CPU is not overloaded and is available to perform other tasks.

As you can see, next up is chkdsk.exe, which I was running at the time that this snapshot was taken, using a little over a quarter of the available CPU time.

Memory Usage

Windows memory management is incredibly complex. It's the stuff of nightmares for people that understand it, and the source of much confusion for people that don't. (I'm somewhere in between - confused nightmares.) It's an incredible piece of engineering and does some amazing things that contribute to the overall speed and efficiency of Windows.

But it's not simple. Not even close.

In this case, we don't care about exact answers. We're simply interested in overall system impact and who might be the larger offenders.

There are two columns of interest, "Private Bytes" and "Working Set":

Private Bytes is kind of the amount of virtual memory being used by this process.

Working Set Size is sort of the amount of actual memory being used by this process.

Even though it's "kinda sorta", these are pretty much what we're looking for. We're not going to look at actual values or anything like that anyway - what we're going to care about is who is using what and how much, in comparison to the rest of the processes that are running on the machine.

As with CPU, you can click the column header to sort by the amount of each being used.

If you find an application that has private bytes exceeding the amount of physical memory in your machine (say it's using three gigabytes on your two-gigabyte machine), that's often a clear indication that the application is affecting your performance, as it's probably forcing Windows to read and write to the swap file a lot. That can definitely impact overall performance.

Even if neither number exceeds your installed RAM, the total of all applications is another factor to consider. Too many applications using too much memory can also often degrade overall performance. Sorting by memory usage will quickly point out the biggest offenders.

Disk Usage

Hard disks are slow compared to the rest of your computer, and if programs themselves are doing a lot of I/O, that can not only affect their own performance, but interfere with the performance of other applications also attempting to read from or write to the disk.

The columns of interest here are "I/O Delta Reads" and "I/O Delta Writes":

"Delta" in this context means "change" - these columns show you the read or write activity that happened since the last display. Because Process Explorer updates once a second by default, that means that what you're seeing is the number of reads or writes that happened in the previous second.

Sorting by each column allows you to once again see who the biggest offenders are in each category. In the example above, chkdsk.exe was at the top of the read list, but it wasn't really doing too much.

Adding Columns to Process Explorer

If the columns that I've mentioned aren't being displayed by Process Explorer, they're easy to add. Just right-click any of the column headers and click Select Columns...:

You'll be given a huge list of columns that you can choose from, spread across several tabs in the Select Columns dialog box:

You'll find Delta Reads and Delta Writes in the Process I/O tab, and Private Bytes and Working Set Size in the Process Memory tab.

Feel free to explore and add or remove other columns that sound interesting.

What do I do with all of this information?

Great, you've got all of this information about what program is using the most CPU, taking up the most memory, or doing the most I/O ... what next?

In the famous words of ... well, me, it depends.

Remember that there's always going to be a process using the most CPU, a process using the most memory, and a process doing the most I/O. Using "the most" doesn't necessarily mean that specific program is causing a problem.

The problem is knowing when "the most" is really "too much".

And that's not something that we can define in absolute terms.

If an application (other than "System Idle Process") is constantly using 99% CPU, then that's something to look at too.

If an application is using most of the RAM installed in your system or trying to use more than you have, or if the amount of memory used is only going up over time, that's something to look at.

If an application is reading or writing to the disk a lot when there's no logical reason why it should, that's something worth looking at.

But that's all that we can say.

Sometimes, those are normal and expected behaviors and simply a part of software doing what it's supposed to be doing on your system.

But sometimes, it's not.

At least now you have information that'll help target your investigations.