Windows Server performance: find the bottleneck and the process

Start DC01 and SRV01. Give SRV01 at least 2 vCPUs and 4 GB RAM for this lab. Work as SAATLAB\adm.rahul in PowerShell as administrator on SRV01.

1Build a performance snapshot

Save as C:\Lab\Get-PerfSnapshot.ps1 and load it:

function Get-PerfSnapshot {
    param([int]$Seconds = 10)
    $counters = '\Processor(_Total)\% Processor Time',
                '\System\Processor Queue Length',
                '\Memory\Available MBytes',
                '\Memory\% Committed Bytes In Use',
                '\Memory\Pages Input/sec',
                '\PhysicalDisk(_Total)\Avg. Disk sec/Read',
                '\PhysicalDisk(_Total)\Avg. Disk sec/Write',
                '\Network Interface(*)\Bytes Total/sec'
    $data = Get-Counter -Counter $counters -SampleInterval 1 -MaxSamples $Seconds
    $data.CounterSamples | Group-Object Path | ForEach-Object {
        $avg = ($_.Group | Measure-Object CookedValue -Average).Average
        if ($_.Name -like '*disk sec*') { $avg = $avg * 1000 }
        [pscustomobject]@{
            Counter = ($_.Name -split '\\')[-2..-1] -join '\'
            Average = [math]::Round($avg, 1)
        }
    }
}

. C:\Lab\Get-PerfSnapshot.ps1
Get-PerfSnapshot

You’ll see something like this:

Counter                                                                 Average
-------                                                                 -------
processor(_total)\% processor time                                          3.2
system\processor queue length                                                 0
memory\available mbytes                                                    2214
memory\% committed bytes in use                                            38.6
memory\pages input/sec                                                      0.4
physicaldisk(_total)\avg. disk sec/read                                     0.6
physicaldisk(_total)\avg. disk sec/write                                    1.1
network interface(intel[r] pro_1000 mt desktop adapter)\bytes total/sec  1288.4

This is SRV01 at rest: low CPU, no queue, plenty of memory, disk latency around 1 ms (shown in milliseconds). Save the output: it’s your quick baseline for the next steps.

✅ Checkpoint: Get-PerfSnapshot prints averages for CPU, memory, disk latency (ms) and network.

2Load the CPU and find the busy process

Start two busy loops (one per vCPU), measure, then find the top process:

$jobs = 1..2 | ForEach-Object { Start-Job { while ($true) { } } }
Get-PerfSnapshot -Seconds 5 | Where-Object Counter -like '*processor*'
(Get-Counter '\Process(*)\% Processor Time').CounterSamples |
    Where-Object { $_.InstanceName -notin '_total', 'idle' } |
    Sort-Object CookedValue -Descending | Select-Object -First 3 InstanceName,
        @{ n = 'CPU'; e = { [math]::Round($_.CookedValue) } }

You’ll see something like this:

Counter                            Average
-------                            -------
processor(_total)\% processor time    99.6
system\processor queue length          4.2

InstanceName CPU
------------ ---
powershell   100
powershell#1  99
wmiprvse       2

CPU is pegged and work is queueing. The per-process counter is out of 100% per core, so two processes at about 100 each fill two vCPUs. In real life you’d now map the process to a service or user.

Stop the load:

$jobs | Stop-Job -PassThru | Remove-Job

✅ Checkpoint: CPU was near 100% with a queue, and two powershell processes were the top consumers.

3Use up memory and watch it

Allocate and touch about 1.5 GB, then take a snapshot:

$a = New-Object byte[] 1.5GB
for ($i = 0; $i -lt $a.Length; $i += 4096) { $a[$i] = 1 }
Get-PerfSnapshot -Seconds 5 | Where-Object Counter -like 'memory*'
Get-Process -Id $PID | Select-Object Name, @{ n = 'PrivateMB'; e = { [math]::Round($_.PrivateMemorySize64 / 1MB) } }

You’ll see something like this:

Counter                         Average
-------                         -------
memory\available mbytes             672
memory\% committed bytes in use    76.9
memory\pages input/sec             18.3

Name       PrivateMB
----       ---------
powershell      1611

Available memory dropped by about 1.5 GB, commit rose and Windows started reading pages back from disk. Touching each 4 KB page matters: Windows only gives a process real RAM when it uses the memory.

Release it:

Remove-Variable a; [GC]::Collect()

✅ Checkpoint: Available MBytes fell and PowerShell’s private memory rose by about 1.5 GB, then recovered.

4Load the disk with DiskSpd and read latency

Download DiskSpd from Microsoft’s GitHub and run a 30-second random test on D:

New-Item C:\DISKSPD -ItemType Directory -Force | Out-Null
Invoke-RestMethod -Uri https://github.com/microsoft/diskspd/releases/latest/download/DiskSpd.zip -OutFile C:\DISKSPD\DiskSpd.zip
Expand-Archive C:\DISKSPD\DiskSpd.zip -DestinationPath C:\DISKSPD -Force
C:\DISKSPD\amd64\diskspd.exe -c1G -d30 -t2 -o16 -b8K -r -w30 -Sh -L D:\diskspd-test.dat |
    Select-String 'total:' | Select-Object -First 1

While it runs, in a second window, take a snapshot. You’ll see something like this:

Counter                                  Average
-------                                  -------
physicaldisk(_total)\avg. disk sec/read     14.8
physicaldisk(_total)\avg. disk sec/write    22.5

total:   1312022528 |    160159 |      41.71 |    5338.63 |    5.993 |    11.422 | D:\diskspd-test.dat (1024MiB)

The DiskSpd total line shows bytes, I/Os, MiB/s, IOPS, average latency in ms and its standard deviation. On a laptop the numbers vary a lot; what matters is that latency jumped from about 1 ms to 15 to 20 ms under load, which users would feel.

Clean up:

Remove-Item D:\diskspd-test.dat

✅ Checkpoint: Disk latency rose clearly during the DiskSpd run, and the test file is deleted.

5Record a trace with Windows Performance Recorder

Record 20 seconds of general activity while the CPU is busy:

$job = Start-Job { while ($true) { } }
wpr -start GeneralProfile -filemode
Start-Sleep -Seconds 20
wpr -stop C:\Lab\perf.etl
Stop-Job $job; Remove-Job $job
Get-Item C:\Lab\perf.etl | Select-Object Name, @{ n = 'MB'; e = { [math]::Round($_.Length / 1MB) } }

You’ll see something like this:

Name      MB
----      --
perf.etl 212

Copy perf.etl to your laptop and open it in Windows Performance Analyzer (part of the Windows ADK, also in the Microsoft Store). The CPU Usage (Sampled) graph shows which process, module and even function used the CPU. [Add your screenshot here]

✅ Checkpoint: wpr created C:\Lab\perf.etl and you can open it in WPA.