You power on your Windows 11 PC, open three browser tabs and a spreadsheet, and suddenly Task Manager reports that 88% of your 32 GB of RAM is consumed. Games begin to stutter, browser tabs spontaneously crash with *Out of Memory* errors, and your mouse cursor freezes for seconds at a time.
When high memory usage occurs without any visible large processes in Task Manager, you are dealing with a memory leak—a scenario where a device driver or system service requests dynamic memory from the kernel but fails to release it after execution.
In this deep-dive guide, we will pinpoint non-paged pool leaks, identify offending hardware drivers using Microsoft Sysinternals, and optimize Windows 11 memory management.
---
Step 1: Distinguish Paged Pool from Non-Paged Pool Memory
1. Press `Ctrl + Shift + Esc` to open Task Manager.
2. Click the Performance tab on the left sidebar, then click Memory.
3. Look at the lower-right metrics:
* Paged pool: Memory that Windows can swap out to your NVMe SSD pagefile.
* Non-paged pool: Memory reserved exclusively for the kernel and hardware drivers that must stay in physical RAM.
# Normal healthy non-paged pool range:
Non-paged pool: 200 MB to 750 MB (Healthy)
Non-paged pool: 4 GB to 16 GB+ (DEFINITE DRIVER MEMORY LEAK)
If your Non-Paged Pool exceeds 2 GB while idle, an outdated network card, audio driver, or anti-cheat software is leaking memory continuously.
---
Step 2: Use Microsoft RAMMap to Pinpoint the Leak
Windows Resource Monitor and Sysinternals RAMMap allow power users to pinpoint the exact driver holding kernel memory.
Task Manager's basic Processes tab does not show kernel driver memory allocations. To find the exact culprit, download Microsoft's free official diagnostic tool: Sysinternals RAMMap.
1. Download RAMMap from Microsoft Docs (`learn.microsoft.com/sysinternals`).
2. Run `RAMMap.exe` as Administrator.
3. Inspect the Use Counts tab:
* Check the Driver Locked and Nonpaged Pool columns.
4. Click the File Summary tab and sort by Total (KB) descending to identify whether Windows is caching millions of orphaned small files from indexing services or cloud sync clients.
---
Step 3: Track Down the Offending Driver with PoolMon (Pool Monitor)
Windows includes an enterprise kernel utility called `poolmon.exe` inside the Windows Driver Kit (WDK):
# Run PoolMon to sort non-paged memory by tag in PowerShell:
poolmon -p -b
| Common Pool Tag | Associated Driver / Component | Common Fix |
|---|
| NDIS / NetB | Killer Network / Intel Ethernet Driver | Disable "Network Bandwidth Optimization" in driver settings. |
| MmSt | Windows Superfetch / SysMain | Set `SysMain` service startup to Manual or Disabled. |
| VBox / VMM | Virtualization / Hyper-V extensions | Update Hyper-V integration or VirtualBox guest additions. |
| EtmB | Third-party RGB / Fan Control Software | Uninstall buggy OEM peripheral bloatware (Armoury Crate, iCUE). |
---
Step 4: Disable Windows 11 Network Memory Leaks (NDU Fix)
One of the most documented Windows 11 bugs involves the Network Diagnostic Usage (NDU) monitor, which frequently fails to free network socket buffers during large downloads or peer-to-peer transfers.
1. Press `Win + R`, type `regedit`, and hit Enter.
2. Navigate to the following key:
`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ndu`
3. Double-click the Start DWORD value in the right pane.
4. Change the value from 2 (Automatic) to 4 (Disabled).
5. Click OK and restart your computer.
*Note: Disabling NDU does not affect your internet speed or network connectivity; it merely disables Windows' background network packet telemetry tracker.*