Fix Memory Leak on Windows 11 (Find the Exact Cause)
Short answer: Open Task Manager, Performance, Memory. If it sits at 85-95% used but no single app in Processes is eating it, something is leaking — requesting RAM and never releasing it, climbing back up hours after each restart. That points to a driver, not an app, so use RAMMap and poolmon to find the leaking pool tag; the usual culprits are network and storage drivers.
Open Task Manager, Performance tab, Memory. If it shows 85-95% used and the Processes tab has nothing obviously eating it — no single app sitting at 4GB — you’ve got a memory leak. Something is requesting RAM and never giving it back. Restarting temporarily fixes it because the OS reclaims everything, but the number climbs right back up over hours or days.
The annoying part is Task Manager doesn’t actually show you the full picture. A process can allocate memory that doesn’t show in its “Memory” column because Windows counts things differently depending on whether the allocation is private, shared, or in the kernel pool. Download RAMMap from Sysinternals — free, no install. Open it and look at the “Use Counts” tab. Two numbers matter: “Nonpaged Pool” and “Driver Locked.” If Nonpaged Pool is above 500MB, a kernel-mode driver is leaking. If Driver Locked is huge, same thing. Normal systems sit at 100-200MB for nonpaged pool.
A guy’s Alienware was using 14 of 16GB at idle. Task Manager showed 6GB of visible process usage and 8GB just gone. RAMMap showed Nonpaged Pool at 3.2GB, which is insane. I ran poolmon from the Windows Driver Kit — it shows pool tags, which are four-letter codes that identify which driver owns each allocation. The top tag was eating 2.8GB and belonged to Killer Networking’s driver. Killer ships on every Alienware and half the gaming laptops sold in the last four years. Uninstalled Killer’s software suite entirely, installed Intel’s generic WiFi and Ethernet drivers instead, Nonpaged Pool dropped to 180MB. He got 3GB of RAM back doing nothing.
Find the Leak
Process Explorer from Sysinternals is better than Task Manager for this because it shows two columns you need: Working Set and Private Bytes. Working Set is how much physical RAM the process is actually using right now. Private Bytes is how much the process has claimed — requested from Windows but not necessarily filled with data yet. A process with 200MB Working Set but 2GB Private Bytes is hoarding address space. That gap is your leak.
Sort by Private Bytes, descending. Whatever’s at the top with a Private Bytes way higher than its Working Set is the leaker. Common offenders I see regularly: dwm.exe (Desktop Window Manager) on multi-monitor setups, especially with mismatched refresh rates — it allocates GPU-backed memory buffers that never get freed. Nahimic or Sonic Studio audio services that ship on ASUS and MSI boards. And browsers, obviously — Chrome with 40 tabs and extensions will eat whatever you give it, but that’s by design rather than a bug.
If the leak is kernel-mode — RAMMap shows nonpaged pool growing but no user-mode process is responsible — you need poolmon. Open an admin Command Prompt, run poolmon -b to sort by bytes. The tag at the top is your culprit. Google the four-letter tag plus “pool tag” and you’ll usually find which driver it belongs to. Common tags: NDnd or NDgd for network drivers, MmSt for memory manager, FMfn for filter manager (antivirus or backup software hooking the filesystem).
Known Leakers
I keep a mental list at this point because the same handful of software shows up over and over.
Killer Networking suite — every Alienware, many Dell gaming laptops. Leaks nonpaged pool steadily until you hit 90%+ RAM. Replace with Intel drivers.
Nahimic audio service — ships on MSI and ASUS boards as “Sonic Studio” or “Nahimic Companion.” Leaks both user and kernel memory. Disable through services.msc or uninstall from Apps. You lose the “surround sound” processing, which honestly sounded terrible anyway.
Desktop Window Manager on multi-monitor with different refresh rates — dwm.exe climbs to 1-2GB over days. Not a clean fix — Microsoft is aware but hasn’t patched it. Workaround is matching refresh rates across monitors or restarting dwm through Task Manager when it gets bad (it auto-restarts and releases everything).
Windows Defender real-time scanning — not a leak exactly, but MsMpEng.exe can hold 800MB+ in memory during and after full scans. Adding folder exclusions for dev directories, game directories, and large media folders reduces its working set significantly.
Page File
If your system has 8GB of RAM and you’re doing anything beyond browsing with a few tabs, Windows needs page file space to compensate. Open System Properties (Win+Pause or Settings, System, About, Advanced system settings), Performance, Settings, Advanced tab, Virtual Memory, Change. Uncheck “Automatically manage” and set a custom size — 1.5x your physical RAM for the initial size, 3x for maximum. On 8GB that’s 12GB initial, 24GB max.
The automatic page file that Windows manages is usually fine on 16GB+ systems. On 8GB it’s too conservative — it starts small and grows reactively, which means by the time Windows decides it needs more page file, something already crashed — sometimes a MEMORY_MANAGEMENT blue screen — or froze because it ran out of commit charge. Setting it manually up front prevents that.
If you’re genuinely running out of memory at 16GB because your workload needs it — VMs, video editing, lots of browser tabs — adding more RAM is the only real fix. RAM is $20-30 per 8GB stick in 2026. Check what you’ve got first — Task Manager shows speed and slots used, CPU-Z tells you whether you’re running dual channel. But make sure the problem is actual demand and not a leak first, because adding RAM to a leaking system just means it takes longer before you hit the wall again. Our speed optimization service includes the full RAMMap and poolmon analysis — we identify the exact driver or process, fix or replace it, and verify the leak is gone over 24 hours.
Frequently Asked Questions
How do I know if Windows 11 has a memory leak?
Open Task Manager, Performance tab, Memory. If it shows 85-95% usage but the Processes tab has no single app using a lot of RAM, memory is being consumed by something that isn't releasing it. A reboot temporarily fixes it but usage climbs back over hours or days. Download RAMMap from Sysinternals — if Nonpaged Pool is above 500MB, a kernel-mode driver is leaking. Normal systems sit at 100-200MB.
What is nonpaged pool and why does it leak?
Nonpaged pool is kernel memory that Windows guarantees will always stay in physical RAM — never paged to disk. Drivers use it for data that must be instantly accessible, like network buffers and USB descriptors. When a driver allocates nonpaged pool but never frees it, the pool grows until it consumes most of your RAM. Killer Networking and certain audio drivers are the most common culprits.
Does adding more RAM fix a memory leak?
No. Adding RAM to a leaking system just means it takes longer to hit the wall. If a driver leaks 500MB per hour, 16GB buys you a few more hours before you're at 95% usage again. You need to identify and fix the leaking driver or process. Use RAMMap and poolmon to find the exact culprit.
Why does Desktop Window Manager use so much memory?
dwm.exe manages window composition and rendering. On multi-monitor setups with mismatched refresh rates, it allocates GPU-backed memory buffers that never get properly freed. Over days it can climb to 1-2GB. Microsoft is aware but hasn't fully patched it. Matching refresh rates across monitors or restarting dwm.exe through Task Manager releases the memory temporarily.