To monitor Windows Server performance, use Performance Monitor to log the key counters for CPU, memory, disk and network, compare them with a baseline and Microsoft's thresholds, and drill into processes with Resource Monitor or Task Manager when a counter goes red. For more than a few servers, send the same counters to a central monitoring tool with alerts.
Key takeaways
- Performance Monitor is built into every Windows Server version and can record counters continuously with a Data Collector Set, created in the GUI or with
logman. - Microsoft treats disk latency (Avg. Disk sec/Read and sec/Write) above 25 ms as a warning and above 50 ms as critical.
- Low Memory\Available MBytes (under 10% of RAM) and low % Idle Time (under 10%) are the clearest signs of memory and CPU pressure.
- Short spikes are normal. Investigate when a counter stays in the warning range for a minute or more.
- Build a baseline during normal load first; without one, you cannot tell slow from normal.
Which built-in tools monitor Windows Server performance?
| Tool | Use it for | How to open |
|---|---|---|
| Task Manager | A quick look at CPU, memory, disk and network use, and which process is busy | Ctrl+Shift+Esc or taskmgr |
| Resource Monitor | Live detail per process: disk files in use, network connections, memory hard faults | resmon |
| Performance Monitor | Counters over time, Data Collector Sets, reports and threshold alerts | perfmon |
| Reliability Monitor and Event Viewer | Crashes, failed updates and service errors that line up with slowdowns | perfmon /rel and eventvwr |
| Windows Admin Center | Browser-based management with performance charts across several servers | Install on a gateway server |
| PowerShell and command line | Scripted counter sampling and remote collection | Get-Counter, typeperf, logman |
Windows Admin Center is Microsoft's free browser-based tool for managing servers and clusters, and it is a practical middle step between logging on to each server and a full monitoring platform.
Which performance counters matter most?
Microsoft's guide to troubleshooting performance problems in Windows lists the most important counters with healthy, warning and critical ranges. The main ones:
| Resource | Counter | Healthy | Warning | Critical |
|---|---|---|---|---|
| Disk | \LogicalDisk(*)\Avg. Disk sec/Read and sec/Write | < 15 ms | > 25 ms | > 50 ms |
| Memory | \Memory\Available MBytes | > 10% of RAM or at least 4 GB free | < 10% | < 1% or under 500 MB |
| Memory | \Memory\% Committed Bytes In Use | 0–50% | 60–80% | 80–100% |
| CPU | \Processor Information(*)\% User Time | < 50% | 50–80% | > 80% |
| CPU | \Processor Information(*)\% Privileged Time | < 30% | 30–50% | > 50% |
| CPU | \Processor Information(*)\% Idle Time | > 20% | > 10% | < 10% |
| Network | \Network Interface(*)\Bytes Total/sec (share of link speed) | < 50% | 50–80% | > 80% |
Microsoft notes that short spikes are acceptable; investigate when a value stays high for over a minute. When a primary counter is in the warning range, use the matching process counters to find the cause:
- Disk: \Process(*)\IO Read Operations/sec and IO Write Operations/sec show which process is driving disk load.
- Memory: \Process(*)\Working Set shows which process holds the most RAM. Also watch Pool Paged and Pool Nonpaged Bytes, which point to driver or kernel leaks.
- CPU: \Process(*)\% User Time and % Privileged Time. High privileged time usually means drivers, storage or network work, including antivirus filter drivers.
- Network: remember that link speed is in bits. A 1 Gbit/s card tops out at about 125 MB per second.
Role-specific servers need extra counters. For SQL Server and IIS hosts, see our guides on monitoring SQL Server performance and monitoring IIS server performance.
How to set up continuous logging with Performance Monitor
- Create a Data Collector Set. In Performance Monitor go to Data Collector Sets, User Defined, New. Or use logman from a command prompt run as administrator.
- Choose counters from the table above, plus Process(*) counters so you can find the culprit later.
- Pick a sensible interval. Microsoft's example uses 15 seconds, because a Performance Monitor graph shows at most 1,000 data points before it starts merging samples.
- Use a circular log with a size limit so the log never fills the disk. Microsoft's example caps it at 800 MB and states the overhead is under 1%.
- Start it automatically. A Data Collector Set started with logman does not restart after a reboot, so add a scheduled task at startup.
- Review and compare. Open the .blg file in Performance Monitor and compare the busy period with your baseline.
A minimal example, adapted from Microsoft's guide:
logman create counter PerfLog-15s -o "C:\perflogs\PerfLog-15s.blg" -f bincirc -max 800 -si 00:00:15 -c "\LogicalDisk(*)\*" "\Memory\*" "\Network Interface(*)\*" "\Processor Information(*)\*" "\Process(*)\*" "\System\*"
logman start PerfLog-15sFor a quick check from PowerShell, Get-Counter samples counters on local or remote servers, for example Get-Counter '\Processor Information(_Total)\% Processor Time' -SampleInterval 5 -MaxSamples 12.
How to monitor many Windows servers centrally
Logging on to servers one by one does not scale. Send the same counters to a central platform that stores history, draws dashboards and raises alerts:
- Azure: Azure Monitor Agent with a data collection rule for Windows performance counters, for Azure VMs and, through Azure Arc, on-premises servers.
- AWS: the CloudWatch agent collects Windows performance counters as custom metrics; the CloudWatch agent documentation lists what it can gather.
- Open source: Prometheus with windows_exporter and Grafana dashboards, or Zabbix agents.
- Commercial: PRTG, SolarWinds, Datadog and similar tools bundle Windows templates and alerting.
Whatever the tool, alert on sustained breaches (for example five minutes above the warning range), not single samples. Pair performance monitoring with availability checks; our guide on how to monitor server uptime covers that side.
What Are the Best Practices for Windows Server performance monitoring?
- Capture a baseline for at least one normal business week, including month-end or batch peaks if you have them.
- Monitor logical disk free space as well as latency. A full system volume causes failures that look like performance problems.
- Keep counter names consistent across servers so dashboards and alerts can be reused.
- Correlate counters with Event Viewer and change records: many slowdowns start right after a patch, driver update or new scheduled task.
- For virtual machines, check the host too. A guest can look idle while it waits for CPU or storage on an overloaded host.
- Review trends monthly to plan capacity before users notice.
How Opsio helps
Opsio runs 24/7 monitoring and operations for Windows and Linux servers on AWS, Azure and on-premises. We set up counters, dashboards and alert rules, and our engineers respond when thresholds are breached. For Opus Bilprovning, a Swedish vehicle inspection company with about 100 stations, Opsio provides 24/7 managed operations with proactive monitoring and change management on AWS; see the case study. Read more about our server management services and cloud monitoring and support.
Frequently asked questions
How do I check Windows Server performance quickly?
Open Task Manager's Performance tab for an overview, then Resource Monitor (resmon) to see which processes use CPU, memory, disk and network. For history, use Performance Monitor or a central monitoring tool.
What is a good disk latency for Windows Server?
Microsoft's guidance treats average read and write latency under 15 ms as healthy, over 25 ms as a warning and over 50 ms as critical, measured with the Avg. Disk sec/Read and sec/Write counters. Investigate periods longer than a minute rather than single spikes.
How much free memory should a Windows server have?
Keep Memory\Available MBytes above 10% of RAM or at least 4 GB. Below 10% is a warning; below 1% or under 500 MB is critical, according to Microsoft's troubleshooting guide.
Is it safe to run Performance Monitor on a production server?
Yes, if it is configured sensibly. Microsoft states that its example Data Collector Set, sampling every 15 seconds into a circular log capped at 800 MB, has an impact of less than 1%.
What is the best free tool to monitor Windows Server?
Performance Monitor and Windows Admin Center are free and built for Windows Server. For many servers with central alerting, open-source options such as Prometheus with windows_exporter or Zabbix are common choices.
Related reading: Outsourcing Performance Metrics.
Related reading
Related Guides
Written By
Head of Innovation
Jacob leads innovation at Opsio, specialising in digital transformation, AI, IoT, and cloud-driven solutions that turn complex technology into measurable business value. With nearly 15 years of experience, he works closely with customers to design scalable AI and IoT solutions, streamline delivery processes, and create technology strategies that drive sustainable growth and long-term business impact.
Editorial standards: This article was written by the cloud practitioner named in the byline above. We revise it when the technology or regulation it covers changes; the dates on this page show the latest update. Opsio maintains editorial independence.