What is Resource Monitor?
Resource Monitor picks up where Task Manager stops. Task Manager tells you which process is busy; Resource Monitor shows what that process is doing: which files it is reading and writing, which remote addresses it is talking to, which ports it is listening on and how much memory it has committed. It is a live view only and does not record history.
How to open it
- Press Win+R and type
resmon, or runperfmon /res. - Search Start for Resource Monitor, or open it from Windows Tools (Windows 11) or Administrative Tools (Windows 10).
- Task Manager's Performance view also links to it on many builds.
The tabs
| Tab | Key details | Use it for |
|---|---|---|
| Overview | Summary lists and graphs for all four resources | A first look at what is busy |
| CPU | Processes, Services, Associated Handles and Associated Modules | Seeing which services run inside a busy svchost.exe; finding which process has a file open |
| Memory | Per-process Commit, Working Set, Shareable and Private memory; Hard Faults/sec; a bar showing Hardware Reserved, In Use, Modified, Standby and Free memory | Memory pressure and leaks; constant hard faults mean Windows is paging to disk |
| Disk | Read and write bytes per second by process and by file; Active Time and Disk Queue Length per drive | Finding the process and file behind a disk stuck at 100% |
| Network | Traffic per process and per remote address, TCP Connections, and Listening Ports with firewall status | Unexpected uploads; which program owns a port |
Finding which process has a file locked
When Windows says a file or folder is open in another program and cannot be deleted, renamed or ejected, go to the CPU tab, expand Associated Handles and type part of the file or folder name in the search box. The results show the process name, PID and full path of each match. Close that program normally, or right-click it and choose End Process if you are sure it is safe.
Filtering and process actions
Ticking the checkbox next to a process filters the other panes, and the other tabs, to that process, which makes it easy to follow one program across CPU, disk and network activity. Right-clicking a process offers End Process, End Process Tree, Analyze Wait Chain (shows what a hung program is waiting on), Suspend Process, Resume Process and Search Online.
Reading the numbers
- Disk queue length that stays high while throughput stays low suggests a slow or struggling drive rather than one busy process.
- Hard faults are reads from disk to satisfy memory requests. Occasional bursts are normal; a steady stream during lag means too little free RAM for the workload.
- Commit that keeps climbing for one process over time is the classic sign of a memory leak.
- Listening ports owned by an unfamiliar process deserve a closer look for unwanted remote-access software or malware.
Resource Monitor vs. related tools
- Task Manager: quick live overview, ending tasks, startup apps and services.
- Resource Monitor: live per-process detail down to files, ports and connections.
- Performance Monitor (
perfmon): counters logged over time, data collector sets and baselines for comparison. - netstat -b: a command-line list of connections with the owning executable, when you cannot use the GUI.
Resource Monitor on the CompTIA A+ exam
Resource Monitor is one of the Windows tools in Core 2 (220-1202) objective 1.4. Know the resmon command, the CPU, Memory, Disk and Network tabs, and when it beats Task Manager. Cues: which file is that process writing, think the Disk tab; file in use and cannot be deleted, think Associated Handles on the CPU tab; which program is listening on a port or sending unexpected traffic, think the Network tab; constant paging, think hard faults on the Memory tab.