WPT: WPR/Xperf: Capture high cpu, disk i/o, file, registry, networking, Private bytes, Virtual bytes, Paged Pool/Nonpaged pool and/or application slowness.

Applies to:

Windows Server 2019

Windows Server 2016

Windows 10

Windows Server 2012 R2

Windows 8.1

Windows Server 2012

Windows 8

Windows Server 2008 R2

Windows 7

Updated 03/01/2019.

Windows Performance Recorder (WPR.exe) now inbox in Windows 10.

Note:  Also in Windows Server 2016 and Windows Server 2019.

In the previous post (Installing the Windows Performance Toolkit v5.0 (WPRUI, WPR, Xperf)), we went thru installing the Windows Performance Toolkit (WPT).


Windows 10 ADK/SDK WPT is not compatible w/ Windows 7 SP1 or Windows Server 2008 R2 SP1.

Note 2:  In Windows Server 2008 R2 and 64-bit Windows 7, you will need to set the following command:

wpr.exe -disablepagingexecutive on


go to the registry key to set it on:


HKEY_LOCALMACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

DisablePagingExecutive (dword) 1 (hex)


What does this do?

“This tells the operating system not to page kernel mode drivers and system code to disk, which is a prerequisite for getting 64-bit call stacks using wpr/wprui/xperf, because 64-bit stack walking depends on metadata in the executable images, and in some situations the wpr/wprui/xperf stack walk code is not allowed to touch paged out pages.”

What if I don’t want to change this setting?

You will not get the detailed information that we (Microsoft) or the 3rd party ISV or 3rd party OEM or your in-house developers need to grab to troubleshoot the issue.

How much extra memory does this consume?

~7MB of nonpaged pool memory.

Does this need to be done in 32-bit Windows 7?  No.

Does this need to be done in Windows Server 2012/2012R2/2016/2019 or 32-bit/64-bit Windows 8/Window 8.1/Windows 10?  No.

Best practices when collecting data.

  • Close all the applications that are not necessary to reproduce the issue.  Including all the web browser tabs.
  • On Windows clients, if possible try capturing on machines that have:
  1. SSD or NVME hard drives
  2. 8 GB or 16 GB of RAM


Right click on “Windows Performance Recorder”

Click on “Run as administrator”


Click on the drop down “More options”


WARNING: If your Windows Server has equal or more than 64 GB of RAM, please click on “Add Profiles”.

"C:\Program Files (x86)\Windows Kits\8.0\Windows Performance Toolkit\SampleGeneralProfileForLargeServers.wprp"

Note:  Otherwise, your system count consume a high amount of non-paged pool memory (buffers) causing to instability.

You will see the following options:

Profiles for performance recording When to use?
CPU usage High cpu in Application(s) or Service(s) or the System process.

Is your application hanging for 5 seconds to a couple of minutes, do you want to find out why?
Disk I/O activity Is there an application, or service, causing a high disk utilization?  Or a storage driver that is causing a slow disk i/o?
File I/O activity Look at files and folders that are being touched.
Registry I/O activity Look at registry hits and modifications.
Networking I/O activity Provides local and target IP addresses, the target port and the dynamic port that the different applications are utilizing.
Heap usage Private bytes (user mode memory leaks)
Pool usage Paged pool and/or Nonpaged pool (kernel mode memory leaks)
VAlloc usage Virtual bytes (user mode memory leaks)
Power usage Power changes by the processor.
GPU activity Video card performance
Audio glitches On a call and your audio is stuttering?
Video glitches Is the video quality bad?
Internet Explorer If Internet Explorer is slow to browse to a particular website.
Minifilter I/O activity Antivirus slowing you down?  Find out.

In this example, I’ll be checking the box for “CPU Usage”:


Check the box for “CPU Usage”

In regular troubleshooting, you will want to go ahead and check the following boxes:


Disk I/O

File I/O




MiniFilter I/O

Note:  If you are collecting from a Windows 10 client with less than 8GB, I would highly recommend to change the “Logging mode:” from Memory to File.

Note: If you are troubleshooting a memory leak related issue, you might want to change the “Logging mode:” from Memory to File.

Click on “Start”


Reproduce the issue

Click on “Save”


Under “Type in a detailed description of the problem:”

Type something that provides information of the problem and repro steps.

A sample of info that is helpful in troubleshooting in general:

Next to “File Name:”, select the path that you want to save the file to.

By default, it saves it to %user%\Documents\WPR Files\

Click on “Save”


Wait while the trace is being merged.


Click on “OK”


Click on “Cancel” to stop tracing.


The next step is to analyze the .etl data.

You could use the new “Windows Performance Analyzer” or go back to XperfView.




How to collect a good boot and logon trace on Windows 10 or Windows Server 2016 using WPR.

How to collect a good boot trace on Windows 10 or Windows Server 2016 using WPRUI.

How to troubleshoot a handle leak using ETW (WPRUI/WPR/Xperf) tracing?

Installing the Windows Performance Toolkit v5.0 (WPRUI, WPR, Xperf)


XPerf versions


XPerf version 4.6 from July 2009


XP/Server2003:Xperf.exe, XPerfView.exe and XbootMgr.exe missing after installing the WPT (Windows Performance ToolKit)


Stop hurting yourself by: Not updating the drivers and firmware in Windows and Windows Server.


Stop hurting yourself by: Not applying the non-security updates for Windows and Windows Server.


Stop hurting yourself by: Disabling IPv6, why do you really do it?


WMI: Stop hurting yourself by using “for /f %%s in (‘dir /s /b *.mof *.mfl’) do mofcomp %%s”


More information:

Windows Performance Analysis Developer Center


Comments (9)
  1. Anonymous says:

    Hi my name is Randolph Reyes (Randy) with my first blog contribution! I am Premier Field Engineer specializing

  2. Anonymous says:

    Hi my name is Randolph Reyes (Randy) with my first blog contribution! I am Premier Field Engineer specializing

  3. Anonymous says:

    Applies to: Windows Server 2008 R2 Windows 7 Does not apply to: Windows Server 2012 R2 Windows 8.1 Windows

  4. Anonymous says:

    Hi all, For those of you that are using the “Windows Performance Toolkit” actively in your troubleshooting

  5. Deeps says:

    Do u have any video for analyzing CPU, memory and Disk I/O

  6. Anonymous says:

    Applies to: Windows Server 2012 R2 Windows 8.1 Windows Server 2012 Windows 8 Windows Server 2008 R2 Windows

  7. Anonymous says:

    Updated version of the “Windows Performance Toolkit” (WPRUI, WPR, and Xperf) is now available (Feb. 2015

  8. Anonymous says:

    Applies to: Windows Server 2012 R2 Windows 8.1 Windows Server 2012 Windows 8.0 Windows Server 2008 R2

  9. Caio says:

    Hi my name is caio im an absolute noob, but im going to see if i can figure this tool out for my purpose; why i was looking into wpt. Looks like something I could use if a non techie like me can read the output.Wish me luck

Comments are closed.

Skip to main content