Measure it yourself, with what is already installed

Nine instruments ship with Windows itself, and between them they can confirm or refute every claim examined on this site for a download cost of zero bytes. That is not a convenience. It is the test: a performance claim whose truth cannot be moved one way or the other by a counter, a log entry or a command that is already on the machine is a claim that was never framed to be checked, and the correct response to it is to stop reading rather than to argue.

§1A claim that no in-box counter can refute is not a measurement, and that is a decision procedure rather than an attitude

Costs to obtain

0 bytes downloaded · 9 instruments

Costs of the test

1 question, asked before purchase

Costs of skipping it

1 unfalsifiable number, kept forever

Question 4 of the buyer’s test on the Ledger asks whether a product’s number is falsifiable with an in-box counter. This table is the answer sheet: a claim arrives, you find the row, and the row names the thing that would have to move.

Every entry in the third column is a quantity Windows was already maintaining before anyone asked it a question, which is why none of it requires trusting the party making the claim. And every entry is a quantity rather than a count of problems — the distinction the Ledger’s standing preamble draws between a scan that reports details and a scan that reports a number of issues with no per-item path attached.

§2Performance Monitor names every counter the same way, and the sampling interval you choose decides whether your own graph tells you the truth

Costs to open

0 · perfmon, in box

Costs of a 15-second collector

<1% system impact · ≤800 MB

Costs of a 1-second collector

exact for 16 min 40 s, then combined

Microsoft’s current performance scenario guide states the naming convention in one line, and it is the grammar of every claim on this page: [Performance counter object]\<Instance>\<Counter Name>. The Memory object has no instance, because there is one memory; the Process object does. Four counters carry the weight here, and their definitions matter more than their names.

Memory\Available MBytes is the number every memory product exists to raise, and the archived counter reference defines it as the sum of memory assigned to the standby (cached), free and zero page lists — so it counts cached file data as available. Memory\Pages/sec is the rate at which pages were read from or written to disk to resolve hard page faults, which makes it a disk-traffic counter rather than a memory-size counter. Process\Working Set shows the size in bytes of the working set, the pages touched recently by the threads in the process, and the same page states the behaviour that undoes most screenshot arguments: if free memory is above a threshold, pages are left in the working set even when they are not in use. Process\Private Bytes shows the size the process has allocated that cannot be shared — a promise of memory, not a residency figure. Reading the last two as the same quantity is the specific error memory cleaners are sold into, and free RAM is the wrong number works through why.

For thresholds, that scenario guide, dated 2026-02-12, publishes a current table rather than an archived one. Memory\Available MBytes is marked healthy above 10% or at least 4 GB free, warning below 10%, and critical below 1% or under 500 MB. Memory\% Committed Bytes In Use is healthy at 0–50% and critical at 80–100%. \LogicalDisk(*)\Avg. Disk sec/Read is healthy under 15 ms and critical over 50 ms, with the note that short spikes are tolerable and periods over a minute are what to investigate.

The trap is the sample interval, and it is a documented one. Microsoft’s worked collector logs every fifteen seconds, and the guide gives the reason plainly: a maximum of 1,000 data points can be displayed within a graph, so a one-second interval produces a graph that is exact for sixteen minutes and forty seconds and, past that, starts to summarise and combine data points. The guide even shows how to catch yourself — compare the plotted line against the Minimum and Maximum values, and hover to see how many samples sit behind one point. A before-and-after recorded at a one-second interval across an afternoon is two smoothed graphs with a difference read off them.

The collector is one elevated command, and the interval is the last argument:

logman.exe create counter PerfLog-15Sec -f bincirc -max 800 -c "\Memory\*" "\Process(*)\*" "\LogicalDisk(*)\*" -si 00:00:15

Microsoft states its cost: less than 1% impact each time the set is started, and no more than 800 MB of disk at that -max value. Start and stop it with logman.exe start and logman.exe stop; a restart does not resume it.

§3Resource Monitor answers the memory question in one column, and we could find no Microsoft page that defines that column

Costs to open

0 · resmon at Start

Costs in documented column definitions

0 Microsoft pages found

Costs at the nearest published threshold

>5 hard faults/sec, Windows NT 4.0

Microsoft’s current high-CPU guidance tells you to open Resource Monitor by entering resmon at Start and to sort the CPU tab by Average CPU. Its Memory tab carries a Hard Faults/sec column, which is the fastest way to separate a machine that is short of RAM from one whose available-memory figure looks alarming because the file cache is doing its job.

What we could not establish. No Microsoft page we could find defines that column. What Microsoft does define is the underlying event: the Windows Performance Toolkit’s Hard Faults reference states that hard faults occur when the operating system retrieves memory pages from disk rather than from the in-memory pages the memory manager maintains. The nearest published threshold is older still, and free RAM is the wrong number takes it apart: the archived Windows NT 4.0 resource kit calls sustained hard page fault rates over five per second a clear indicator of a memory bottleneck, on a page carrying Microsoft’s archived-content warning and written before SSDs, prefetching and memory compression existed. Use the column; do not quote a threshold for it as though Microsoft published one this decade.

§4Task Manager shows four memory figures and Microsoft’s current documentation explains one of them

Costs to open

0 · 1 keystroke combination

Costs in first-party definitions

1 figure of 4

Costs of reading it as a total

NOT ESTABLISHED — see §4

The Memory pane reports In use, Cached, Committed and Compressed, and readers reasonably assume those four add up to something. Exactly one has a current first-party explanation. Microsoft’s performance scenario guide points at the Performance tab and states that Memory\% Committed Bytes In Use represents virtual memory, the combination of the page file and RAM, working an example on a machine with 128 GB of RAM and a 128 GB page file whose committed figure is therefore 256 GB. That is Committed: a ceiling and a promise, not an occupancy.

What we could not establish. We looked for a Microsoft definition of the other three — in the Win32 memory reference, the archived counter references, the page-file article, the cache and memory manager troubleshooting guide and the Sysinternals RAMMap page — and found counter and API definitions but no first-party account of that strip. So the honest reading is the one free RAM is the wrong number reaches from the other direction: Cached and In use are not disjoint in the way the layout implies, because the availability figure the operating system publishes already counts the standby list. For composition rather than impression the documented instrument is RAMMap, whose Use Counts tab Microsoft describes as a usage summary by type and paging list. Task Manager is the right instrument for noticing something and the wrong one for quoting a number in an argument.

§5Windows timed your last boot and your last shutdown without being asked, and both entries are already on the machine

Costs to read

0 · Event Viewer, in box

Costs in recorded events

1 per boot, 1 per shutdown

Costs in documented field names

0 current Microsoft pages found

Open Event Viewer, go to Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance → Operational, and filter for event ID 100. That is the boot record, and what happens before your desktop appears works through the fields, the severity thresholds and the reason row B-05 is UNVERIFIED — we could not find a Microsoft page that defines BootTime, MainPathBootTime and BootPostBootTime. Event ID 200 in the same log is the shutdown counterpart. Microsoft’s archive of the TechNet Wiki, a community-contributed source rather than product documentation, records the event as source Microsoft-Windows-Diagnostics-Performance, ID 200, version 6.1, applying to Windows 7 and Windows Server 2008, with a message reporting a shutdown duration in milliseconds, an IsDegradation flag and an incident time in UTC. We cite it labelled, because it is the best source we found and it is not a specification.

Both events share one property no other instrument here has: the operating system recorded them before anyone had an argument to win. The same archived wiki page isolates startup items through msconfig, which dates it — that surface moved in Windows 8, and sixteen places Windows can start a program covers where it went.

§6Three commands turn “you are running too many services” into a list you can check line by line

Costs to run

0 · 3 commands, in box

Costs of sc qc

9 named fields per service

Costs of a bulk recommendation list

NOT ESTABLISHED — see §6

tasklist /svc is documented as listing all the service information for each process without truncation, and it is what turns a column of identical svchost.exe rows into a map of which services are inside which process. sc qc <service> queries the configuration information for a specified service, and Microsoft lists the fields it returns: SERVICE_NAME, TYPE, ERROR_CONTROL, BINARY_PATH_NAME, LOAD_ORDER_GROUP, TAG, DISPLAY_NAME, DEPENDENCIES and SERVICE_START_NAME. The same page gives the reason to run it before believing a services list: administrators use it to determine the binary name of a service and whether it shares a process with other services, and services written to share Services.exe or Svchost.exe are not listed as separate processes in Task Manager.

The third command settles the most arguments and is the least known. sc qtriggerinfo <service> reports a service’s trigger configuration, and Microsoft’s worked example is sc qtriggerinfo w32time, which returns a service configured to start on domain join and stop on domain leave. On a machine that never joins a domain that service costs nothing at all, and it will still appear on lists of services to disable, because those lists are written from service names rather than from trigger configurations. What a service costs when it is doing nothing has the arithmetic; the point here is that it is available to you for three commands.

§7powercfg writes two diagnostic reports that need no download and change nothing on the machine

Costs of /energy

60 s default observation, HTML in current path

Costs of /sleepstudy

last 3 days, HTML in current path

Costs in state changed

0 — both options report only

powercfg /energy is documented as analysing the system for common energy-efficiency and battery-life problems and generating an HTML report in the current path, observing for a default of sixty seconds and accepting /duration <seconds> to observe for longer. Microsoft attaches one usage condition that is easy to miss and changes the result: the option should be used when the computer is idle and has no open programs or documents. Read that report before believing any product claiming to have found what keeps your machine awake, because it names processes, drivers and devices rather than counting them.

powercfg /sleepstudy generates a diagnostic report of modern standby quality over the last three days, again in the current path, with /duration <days> to widen the window. Two boundaries are worth stating rather than discovering. It is a modern standby report, so a desktop that sleeps the older way is not the machine it was designed for. And the documented administrator requirement sits on /systemsleepdiagnostics and /systempowerreport on the same page, not on /sleepstudy — which is what the page says rather than what your machine will do. The junk-file article covers the one powercfg option here that changes the system rather than reporting on it.

§8One command ends every argument about the size of the component store

Costs to run

1 command, elevated

Costs in figures reported

3 sizes, 2 overhead lines

Costs of the Explorer figure instead

4.98 GB read against 507.18 MB of overhead

Dism.exe /Online /Cleanup-Image /AnalyzeComponentStore

This is the supported way to get the true size of WinSxS, and it exists because File Explorer’s figure is wrong in a documented way: Microsoft states that Explorer determines directory sizes without taking into account that the contained files might be hard linked. The command reports Windows Explorer Reported Size, annotated as not factoring in hard links; Actual Size, which does; and Shared with Windows, which Microsoft says should not be considered part of the overhead. In Microsoft’s own worked example the folder appears to be 4.98 GB while the actual overhead is 507.18 MB. A product quoting the first number is quoting the one the platform vendor tells you not to use, and what a disk cleaner actually deletes takes the rest of the category apart.

§9winsat is a benchmark you may compare only against itself, on the same machine, on the same day

Costs to run

Administrators group · elevated prompt

Costs stored

1 XML file per formal run, in the datastore

Costs of a cross-machine comparison

NOT ESTABLISHED — see §9

The Windows System Assessment Tool takes the form winsat <assessment name> <assessment parameters>, with named assessments including cpu, mem, disk, d3d, media and features. winsat formal runs a set of pre-defined assessments and saves the data in an XML file in %systemroot%\performance\winsat\datastore. Microsoft requires the local Administrators group and an elevated prompt, and carries a warning worth reading before anybody treats this as casual: running an assessment without parameters may result in system performance problems or system instability.

It is honestly good for one comparison: a machine against itself, in one sitting, with one thing changed — the disk assessment before and after a driver change, run back to back. It is not good for anything that crosses a boundary: two machines, two Windows versions, two days apart, or a score quoted as a figure of merit. What we could not establish: the command-line documentation we could find is archived and marked as applying to Windows Vista, Windows 7 and Windows Server 2008, and we found no current page restating the syntax for a supported client build, so the version boundary here is open rather than settled.

§10A before-and-after that is not a lie: same session, at least five runs, and both the median and the spread reported

Costs in runs

≥5 per condition · 10 total

Costs in figures published

2 — median and spread, never 1

Costs of a single-run comparison

1 number, 0 information

Everything above is an instrument. This section is the method, and it decides whether the instrument produced a result or a story. Six rules, each of which exists because skipping it produces a number that looks like evidence.

Change one thing. If the tweak, the uninstall and the reboot all happen before the second measurement, the second measurement has no subject. It is the rule most often broken by reviews that measure a “clean-up” which performed nine operations at once.

Measure in one session. Thermal state, power scheme, mains against battery, what else is running, whether an update is downloading, and whether the machine has been on for four minutes or four days all move these numbers. A cold Monday morning against a warm Friday afternoon compares two days, not two conditions. Where a run cannot be repeated inside one session — boot timing, by definition — say so in the write-up.

Exclude the cold boot, or include it and say which. Windows re-plans its boot from recent boots: the archived Microsoft material behind the boot article states that on a newly installed system ReadyBoot analyses the last five boots and builds its traces from them. A machine measured on the first boot after a change is measured mid-replan, and the number will move again over the next several boots whether or not the change did anything. Discard the boots immediately following any change, then start counting.

Run each condition at least five times. Five is not magic; it is the smallest count from which a median and a spread are worth reporting. Alternate the conditions where you can — A, B, A, B — because a drift over the afternoon otherwise lands entirely on whichever condition you measured second.

Report the median and the spread, never the mean and never the best run. The mean is dragged by one background task; the best run is a selection of the run that agreed with you. Publish the middle value and both extremes for each condition, then apply the rule that makes the exercise honest: if the two spreads overlap, the difference has not been shown. That is not a small difference. It is a difference your method cannot see, and the write-up says so.

Write the method down before you run it, including what would have counted as no change. Decide in advance how many runs, which interval, which counter, what you will do with an outlier, and what result would have made you conclude the change did nothing. A method fixed afterwards is a method fitted to its result. Publish the interval too, because §2 has shown that a graph recorded at one second and read over an afternoon is not showing you the samples you think it is.

The rule underneath all six is short enough to keep. If a method cannot survive being written down, its result cannot survive being published.

§11Standing: what this page establishes and what it does not

Costs in primary sources

13 primary + 1 wiki archive, 2026-08-06

Costs in instruments requiring a download

0 of 9

Costs we measured ourselves

0 — we run no software

§12Sources & method: every command above, with the page it came from

Costs in fetches

14 pages, all fetched 2026-08-06

Costs in commands not verified

0 published — unverified ones are named, not printed

Costs in downloads recommended

0, permanently

Method, plainly: every command, switch, counter path and output field named above was read off the Microsoft page cited for it on 2026-08-06, and nothing was printed here that we could not find in primary documentation — where a capability is real but its syntax or its current scope was not confirmable, the section says so in the paragraph rather than in a footnote. There are no timings, no scores, no screenshots and no report of what any of these commands printed on any machine, because we run no software: this is a page about which instrument answers which question, written from the instruments’ documentation.

1. Troubleshoot performance problems in Windows, ms.date 2026-02-12 — the counter naming convention, the logman.exe collector, the 1,000-data-point limit, the counter threshold tables, and the Task Manager committed-memory example. Accessed 2026-08-06
2. Troubleshoot issues using Performance Monitor, ms.date 2026-02-12 — Data Collector Sets, logman.exe start and stop, and the questions to ask before collecting. Accessed 2026-08-06
3. Process Object: Core Services (archived, Windows Server 2003) — Working Set, Private Bytes, Page Faults/sec. Carries Microsoft’s archived-content banner. Accessed 2026-08-06
4. Memory Object: Core Services (archived, Windows Server 2003) — Available MBytes as standby plus free plus zero, and Pages/sec. Accessed 2026-08-06
5. Chapter 12 — Detecting Memory Bottlenecks (archived, Windows NT 4.0 resource kit) — the five-hard-faults-per-second figure. Accessed 2026-08-06
6. Hard Faults (Windows Performance Toolkit, archived) — what a hard fault is and what the graph counts. Accessed 2026-08-06
7. Guidance for troubleshooting high CPU usage, ms.date 2026-02-12 — opening resmon, and tasklist /svc. Accessed 2026-08-06
8. tasklist — the /svc parameter, documented as listing all the service information for each process without truncation. Accessed 2026-08-06
9. Sc qc (archived) — the nine output fields, and the remark on services sharing Services.exe and Svchost.exe. Accessed 2026-08-06
10. Service trigger events — the sc qtriggerinfo w32time worked example. Accessed 2026-08-06
11. Powercfg command-line options — /energy, its 60-second default and idle condition, /sleepstudy and its three-day window, and the administrator requirement stated for /systemsleepdiagnostics and /systempowerreport. Accessed 2026-08-06
12. Determine the Actual Size of the WinSxS Folder — /AnalyzeComponentStore, the hard-link explanation, the three size fields and the worked example. Accessed 2026-08-06
13. Winsat (archived, Windows Vista / 7 / Server 2008) — syntax, the assessment list, winsat formal and the datastore path, the Administrators requirement and the instability warning. Accessed 2026-08-06
14. Event ID 200 Windows Diagnostics Performance — Microsoft’s archive of a community-contributed TechNet Wiki page, not product documentation; scoped to Windows 7 and Windows Server 2008. Cited for the event source, ID and message shape only. Accessed 2026-08-06

Previous · Sixteen places Windows can start a program — the complete autostart taxonomy, and the demand that any tool in the category publish which of the sixteen it reads and which it writes.

Next · How one XML file put a two-person vendor on a thousand download sites — the PAD file, and why link counts from this era measure distribution rather than endorsement.