Windows Server includes a built-in tool called Performance Monitor (PerfMon) that provides the most granular view of hardware usage available natively. It exposes hundreds of individual counters for CPU, disk, memory, and network at per-component resolution, letting you track metrics as specific as average disk read latency in seconds or the exact percentage of maximum processor frequency in use. For most administrators looking for deep hardware insight without installing third-party software, PerfMon is the answer.
That said, “granular” means different things depending on what you’re trying to do. Windows actually ships with several monitoring tools at different levels of detail, from quick overviews to microsecond-level tracing. Here’s how they compare and when to use each one.
Performance Monitor: The Most Detailed Built-In Option
Performance Monitor (perfmon.exe) is the tool designed specifically for granular hardware analysis. It works by reading from Windows Performance Counters, a system-wide abstraction layer that collects real-time data on CPU, memory, disk, and network hardware. What makes it “granular” is the sheer number of individual counters you can track simultaneously, and the ability to log that data over time for trend analysis.
For disk performance, you get counters like Avg. Disk sec/Read and Avg. Disk sec/Write, which report the average latency of read and write operations per physical drive. These are measured in seconds (typically fractions of a millisecond for SSDs), so you can pinpoint exactly which drive is slowing things down. For CPU, the Processor Performance counter reports the percentage of maximum frequency your processor is running at. On a 2.5 GHz chip throttled down to 800 MHz, for example, that counter would show 32%, immediately revealing power-saving throttling you might not otherwise notice.
Network counters go deep as well. You can monitor per-adapter metrics including packets received with errors, packets discarded (both inbound and outbound), and TCP coalescing statistics like RSC Coalesced Packets/sec that reveal how efficiently your NIC is offloading work. Interrupt-level counters such as Interrupts/sec and DPCs Queued/sec on a per-processor basis help identify whether network or storage hardware is overwhelming specific CPU cores.
For memory, PerfMon tracks committed bytes (how much memory the system has promised to processes), the commit limit (the combined total of physical RAM and page file space), and page file peak usage per process. These counters let you distinguish between a server that’s using a lot of memory efficiently and one that’s under genuine memory pressure.
You can create Data Collector Sets in PerfMon to log any combination of these counters at defined intervals, then review them later as reports or graphs. This makes it the go-to tool for diagnosing intermittent hardware bottlenecks that don’t show up during a quick glance.
Resource Monitor and Task Manager: Quick but Limited
Resource Monitor (resmon.exe) sits one level above PerfMon in simplicity. It shows real-time CPU, memory, disk, and network usage broken down by process, which is useful for quickly identifying which application is consuming resources. It pulls from the same underlying performance counter system, including processor frequency data, but you can’t customize which counters are displayed or log data over time.
Task Manager is even more simplified. It gives you a high-level snapshot of usage percentages and basic process information. For a quick “is something maxed out?” check, it works fine. For anything beyond that, you’ll need to move to PerfMon or one of the tools below.
PowerShell Get-Counter: Scripted Granular Monitoring
If you want the same granularity as PerfMon but in an automated, scriptable format, the PowerShell Get-Counter cmdlet reads from the identical set of performance counters. You specify exactly which counters to collect, set a sampling interval in seconds (the default is one second), and define how many samples to capture.
A typical command looks like this: Get-Counter -Counter "\Processor(_Total)\% Processor Time" -SampleInterval 2 -MaxSamples 3 collects three samples of total CPU usage at two-second intervals. Adding the -Continuous flag streams data indefinitely until you stop it, which is useful for monitoring during a load test or maintenance window. The minimum sampling interval is one second.
The real power here is piping output to files, databases, or alerting scripts. If you need to monitor hardware usage across dozens of servers on a schedule, PowerShell turns PerfMon’s counters into something you can automate and centralize without installing additional software.
Windows Performance Analyzer: Microsecond-Level Tracing
For the deepest possible level of detail, Windows Performance Analyzer (WPA) works with Event Tracing for Windows (ETW) to capture system activity at microsecond resolution. It’s part of the Windows Assessment and Deployment Kit (ADK) and pairs with Windows Performance Recorder (WPR), which captures trace data that WPA then visualizes as interactive graphs and tables.
This goes beyond counter-based sampling. ETW tracing captures individual events: every context switch, every disk I/O completion, every interrupt. You can see exactly what the CPU was doing at a specific microsecond, which process caused a particular disk operation, and how long each step took. It’s the tool kernel developers and performance engineers use to diagnose problems that PerfMon’s one-second sampling can’t catch, like brief CPU spikes or storage latency outliers lasting just milliseconds.
The tradeoff is complexity. WPA traces generate large files and require significant expertise to interpret. For ongoing hardware monitoring, PerfMon or PowerShell is more practical. For a deep investigation into a specific performance problem, WPA is unmatched.
DTrace on Windows Server 2025
Windows Server 2025 ships with DTrace as a native command-line tool. Originally developed for Unix systems, DTrace lets you monitor and troubleshoot system performance in real time by attaching probes to virtually any kernel or application event. It occupies a similar space to ETW tracing but with a different syntax and workflow that may be familiar if you’ve worked with Linux or Solaris systems.
Server 2025 also added new performance counters for domain controller locator operations and LSA security lookups, though these are more relevant to Active Directory troubleshooting than raw hardware monitoring.
Choosing the Right Tool
- Quick hardware check: Task Manager or Resource Monitor gives you an immediate overview of what’s busy and what’s not.
- Detailed hardware metrics with logging: Performance Monitor is the standard choice. It covers CPU frequency, disk latency, memory pressure, NIC errors, and hundreds of other counters with customizable sampling and historical logging.
- Automated or remote collection: PowerShell’s Get-Counter provides the same counter data in a scriptable format you can schedule, export, and centralize across multiple servers.
- Microsecond-level investigation: Windows Performance Analyzer with ETW tracing captures individual system events for the most granular analysis possible, at the cost of complexity.
For most people searching for granular hardware usage on a Windows Server, Performance Monitor is the right starting point. It’s already installed, it exposes the full depth of hardware counters the OS tracks, and it can log data over hours or days to catch problems that only appear under specific conditions.