Process Explorer 17.2 Adds More Ways to Investigate a Misbehaving PC

When your PC slows down, Task Manager is usually the first stop. 9 times out of 10 these days, its a browser anyway.Open Task Manger, kill the offending program and move on.

But knowing which program is getting to busy only gets you halfway to understanding the problem and you may need to know more.

Microsoft Process Explorer is that tool that gives you a closer look at what running programs are doing. Version 17.2, (released October 15), now adds persistent process activity history, efficiency-mode support, and several deeper troubleshooting tools that are pretty handy. However, they are a bit buried in the menus, so knowing where to find them when you need that will help.

What Is Process Explorer?

Process Explorer is a free Windows utility from Microsoft’s Sysinternals collection. Think of it as a more investigative companion to Task Manager.

It shows running processes and lets you examine the files, DLLs, and other resources they have open. Its search can help answer a particularly annoying Windows question: which program is holding onto this file?

You can get useful information without understanding every number on the screen. Start with the program causing trouble, then dig deeper as needed.

Record Activity Before Your PC Acts Up

The new activity history is probably the most practical addition for troubleshooting those “it was doing it a minute ago” problems.

For example, if your computer periodically becomes sluggish while you work, recording activity gives you something to examine afterward instead of trying to catch the culprit in the act.

Enable Options > Record Activity History, then leave Process Explorer running while you use your computer. After a slowdown, open View > Activity History to examine the recorded activity. Recording must be enabled beforehand, so turn it on before trying to reproduce the problem.

Use Efficiency Mode for Background Work

Efficiency-mode support gives you another way to manage a program competing for processor time.

Select a process, then choose Process > Efficiency Mode. A sensible candidate is a busy background application that is interfering with the program you are actively using.

Windows efficiency mode lowers scheduling priority and applies power-efficient processor behavior. That can help reduce interference, but the selected application’s work may take longer. It is a tradeoff, so try it on background work you can afford to slow down.

If Process Explorer reports that efficiency mode is unavailable or access was denied, it could not apply the setting to that process.

See Where an Application’s Memory Is Going

To explore the new memory-map view, double-click a process to open its properties, then select Memory Map.

This provides a more detailed breakdown of the process’s memory allocations. It is a deeper troubleshooting tool for investigating questions such as why an application’s memory consumption keeps growing.

A large memory allocation does not automatically mean something is broken. Some applications legitimately need plenty of memory. The map gives you more information to investigate, rather than a diagnosis by itself.

Check Devices and NPU Activity

Open View > System Information and select Devices to find the new device overview. This brings device activity together in one place when you need to look beyond an individual application.

For computers with compatible NPU hardware, Process Explorer also adds NPU monitoring. An NPU is a processor designed to accelerate certain AI workloads.

Look for NPU Graph in a process’s properties. You can also open View > Select Columns and look for NPU usage and memory counters to add to the main process list.

This is useful when checking whether a supported workload is actually using the NPU. Having an AI application running does not necessarily mean that application uses it.

Capture a Live Kernel Dump for Deeper Troubleshooting

Live kernel dumps are aimed more at technicians and developers investigating Windows or driver problems.

Run Process Explorer as administrator, select the System process, then open Process > Create Dump > Live Kernel Dump. The available choices include a Full Live Kernel Memory Dump and a Kernel Stacks Memory Dump.

The feature requires Windows 11 build 22621.1992 or later. The resulting dump is diagnostic material for a tool such as WinDbg, so this is something you would generally use as part of a specific investigation or at a technician’s request.

Worth the Download?

If Process Explorer already lives in your troubleshooting toolkit, version 17.2 gives you several useful reasons to update. Activity history is the standout for everyday troubleshooting because intermittent problems rarely wait politely for you to open the right window.

Start by enabling recording, use your PC normally, and review the history after the next slowdown. That is a much more useful starting point than staring at a process list and hoping the guilty program looks suspicious.

Download Microsoft Process Explorer from MajorGeeks.

Jim McMahon Jim McMahon, aka Corporal Punishment, is the founder of MajorGeeks.com. He has spent decades testing software, troubleshooting Windows, and helping users cut through the nonsense. He loves real freeware, hates bloatware, and runs on caffeine, sarcasm, and questionable choices.