Share via

Can't Find an Run poolmon.exe in Windows 10

Question

Saturday, April 15, 2017 3:24 AM

I'm trying to discover the source of a memory leak in Windows 10 and I've read that poolmon.exe can help with that.  However, after downloading Windows Driver Kit, I can't find poolmon in the Tools folder of the Windows Driver Kit.  Can someone explain where I can find and run the program?

All replies (19)

Saturday, April 22, 2017 10:39 AM ✅Answered

Enable the nonpaged pool column in the Task Manager. I suspect the Norton Security software. But you should really search for poolmon.exe. The driver tag with the most unreleased allocations shows the root cause.

BTW: After installing the WDK from https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit I see poolmon.exe in C:\Program Files (x86)\Windows Kits\10\Tools\x64

Saturday, April 22, 2017 6:43 PM ✅Answered

Currently the nonpaged pool is at 560 MB. This is nothing to worry about when it stays that way or is reduced at regular intervals. When it grows, you have a memory leak. You should search all *.sys files in c:\windows\system32\drivers for ismc. It could be iastorAV.sys. So you may check for a newer version of the Intel RST driver.

On my system it looks like this (strings is from www.sysinternals.com; you can use findstr as well: findstr /M /C:ismc *.sys):

C:\Windows\System32\drivers>strings  -n 4 *.sys | find "ismc"
C:\Windows\System32\drivers\iaStorAV.sys: ismcH
C:\Windows\System32\drivers\iaStorAV.sys: ismc

Saturday, April 15, 2017 6:42 AM

Hi Ramnav,

Is this article what you want?
**How to use Memory Pool Monitor (Poolmon.exe) to troubleshoot kernel mode memory leaks
**https://support.microsoft.com/en-us/help/177415/how-to-use-memory-pool-monitor-poolmon.exe-to-troubleshoot-kernel-mode-memory-leaks

It says "Poolmon.exe is available in the Windows NT 4.0 Resource Kit and in the \Support\Tools folder of Windows 2000, Windows XP, and Windows Server 2003 CD-ROMs. "
___________
Ashidacchi

Saturday, April 15, 2017 3:15 PM

Hmm...I'll try, but looking at the directions it seems to be referring to using poolmon.exe for older versions of Windows and not Windows 10. Thanks for the reply, though.

Monday, April 17, 2017 7:07 AM

Hi Ramnav,

To troubleshoot a memory leak issue, we could check the task manager for any process occupying many memory resources firstly.
We also could use the RamMap tool to check the detailed information of the memory.
RAMMap
https://technet.microsoft.com/en-us/sysinternals/rammap.aspx

As for the PoolMon tool, it should be in C:\Program Files (x86)\Windows Kits\10\Tools\x64 or x86 (default location) if you have installed Windows 10 Driver Kit.

Here is an example for using PoolMon tool, I hope it will be useful to you.
https://msdn.microsoft.com/en-us/windows/hardware/drivers/devtest/poolmon-examples

Best regards

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Monday, April 17, 2017 6:02 PM

I'll try the path you listed above when I get home later. Regarding RAMMap, will it be able to pinpoint what programs are responsible for my non-paged pool memory? That's my issue currently. It rises to an obscene amount after a week of regular computer use.

Tuesday, April 18, 2017 2:17 AM

I tried the path you listed and I still cannot find poolmon there.  When I go C:\Program Files (x86)\Windows Kits\10\Tools\ I arrive at two folders: "bin" and "Certificates".  Poolmon is not located in either.

Tuesday, April 18, 2017 2:31 AM

Hi Ramnav,

MeipoXu mentioned:
As for the PoolMon tool, it should be in C:\Program Files (x86)\Windows Kits\10\Tools\x64 or x86 (default location) if you have installed Windows 10 Driver Kit.

Have you installed Windows 10 Driver Kit?
__________
Ashidacchi

Tuesday, April 18, 2017 10:39 AM

Hmm...I believe that I have. I went to following link and downloaded the WDK for the version of Windows 10 that I had: https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit I even downloaded the SDK as well and still nothing.

Wednesday, April 19, 2017 8:25 AM

Hi Ramnav,

Yes, the RAMmap will give us detailed information of the memory. Have you tried it?

As for poolmon tool, there are several Windows 10 Driver kit in that link. Please ensure you have installed the right version(run "winver" to check the system version information).

If you didn`t change the installation location, it should be in C:\Program Files (x86)\Windows Kits\10\Tools\x64 or x86. Anyway, we could search "poolmon" from Windows Explorer search bar.

Best regards

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Wednesday, April 19, 2017 2:36 PM

I will try RAMMap when I get home later. If I can get it to run, I will post a screen shot of my non paged pool activity. As for the Windows Driver Kit download, I never changed the file location. I checked the version of Windows I had and downloaded the appropriate WDK from the link I provided. But I don't find poolmon.exe from the path you provided. I always end up at the location with the two folders I listed above. I'll try running a manual search in Windows for the file and see if it finds it.

Thursday, April 20, 2017 1:14 AM

I still could not find poolmon.exe via any of the methods suggested so far.  I'll attach images of my task manager, resource monitor, and RAMMap findings once my account is verified here.

Saturday, April 22, 2017 12:18 AM

Saturday, April 22, 2017 12:22 AM

Saturday, April 22, 2017 12:24 AM

I posted my findings above now that my account was verified. 

Does anyone see any irregular activity?  My non-paged pool started the week at 350 and now it's over 600 after a few days.

Saturday, April 22, 2017 6:26 PM

So I finally found and ran poolmon.  I've pasted my paged and non-paged findings below.  I'm not sure what I'm looking at, however.

Monday, April 24, 2017 11:56 AM

I'm going to wait until tomorrow to see if my non-paged pool rises past 560 before attempting to update any of the intel drivers. I'll post an update then.

Wednesday, April 26, 2017 10:05 PM

My non paged pool still gradually increased, so I went ahead and updated my intel drivers (including the RST drivers). I'll leave my computer on for a few hours tonight and see what happens.

Tuesday, May 2, 2017 6:09 PM

I think my non-paged pool has stabilized now that I've updated my intel drivers. Idling, it sits at 450mb (it used to trend upwards at a gradual rate). During normal computer use it goes up to 520mb and that seems normal. Thanks to everyone that contributed solutions to my issues.