Read process memory without guessing at CPU load

An application feels slow. A process listing gives you measurements, but the labels matter: a large CPU total is not a current CPU percentage. Start with a precise question and report the measurement that actually answers it.

Interactive guide 9 min practice Windows PowerShell 5.1 and PowerShell 7

Editable pipeline · fictional data · Microsoft documentation

Written and tested by Dhrub Bharali · Updated 02 October 2026

The task

The fixture records Name, CPU and WorkingSet64. CPU is a cumulative processor-time value; processes with different lifetimes are not directly comparable as instantaneous load. WorkingSet64 is the current working-set size in bytes, not a complete measure of committed memory or an application health verdict.

Interpret CPU as accumulated processor time.
Compare WorkingSet64 in bytes.
Rank every candidate before taking the top results.

Genie tip: Interpret CPU as accumulated processor time.

See the objects move

Inspect this authored example with fictional data in the bounded browser model. The numbered stages show how its objects change.

Get-Process | Sort-Object CPU -Descending

Stage 1Get-ProcessPositional values or no named parameters
Stage 2Sort-Object-Descending

Build the reasoning

Inspect the measurements

1PS> Get-Process

chrome uses 486539264 bytes of working-set memory. MsMpEng has the largest CPU total, but that says nothing about which process is busiest this second.

Rank memory use

1PS> Sort-Object WorkingSet64 -Descending

Sorting all rows puts chrome first and MsMpEng second. The ordering answers a memory question, independently of the CPU column.

Keep the top records

1PS> Select-Object -First 2 Name,WorkingSet64

Only after sorting do you limit the result. The output contains two names and two byte counts.

Try it: predict, run and explain

Fictional input objects · 5 rows

Name	CPU	WorkingSet64
chrome	842.31	486539264
notepad	0.4	12582912
Windows PowerShell	18.27	78643200
spoolsv	1.4	33554432
MsMpEng	950	220200960

Select your predicted objects before revealing the output. Then edit one stage and inspect the change.

Worked pipeline

Ctrl / Command + Enter runs the editor. This bounded model uses the displayed fixture; it does not run PowerShell on a computer.

Predict first, then run the pipeline.

Find the mistake

Calling CPU a percentage

1PS> Get-Process | Sort-Object CPU -Descending

The listing ranks accumulated CPU time. Use interval-based measurements when the question is current processor utilization.

Calling every stopped service broken

1PS> Get-Service | Where-Object Status -eq 'Stopped'

A disabled or on-demand service may be stopped by design. Compare current state with startup policy and the service’s role before proposing a restart.

MsMpEng has the largest CPU total. Can you conclude it causes the current slowdown?

Prove it: write it alone

Return processes whose WorkingSet64 is greater than 104857600 bytes (100 MiB), largest first. Return exactly Name and WorkingSet64. Do not use CPU as the sort key.

The checker also runs your command against a fresh fixture. Matching today’s names alone is not enough.

Write your pipeline from a blank prompt

Show a worked solution

1PS> Get-Process | Where-Object WorkingSet64 -gt 104857600 | Sort-Object WorkingSet64 -Descending | Select-Object Name,WorkingSet64

Read the stages, close this explanation, then write and test your own attempt.

Take it to a real environment

On Windows, a stopped automatic service is a review candidate, not an instruction to start it blindly. For process investigations, record timestamps and compare an appropriate interval. Some real process details require additional privileges; the browser fixture has no permission or process-lifetime races.

Real environment example · not executed here

1PS> Get-Service | Where-Object Status -eq 'Stopped' | Where-Object StartType -eq 'Automatic' | Select-Object Name,Status,StartType

Verify the details

Final challenge not completedChoose another guide

Practise this

Choose a task

Find stopped automatic services

Return Name and StartType for stopped services with StartType Automatic.

Review the lesson