Find high memory processes
Documentation: Microsoft Learn
The pipeline sorts Get-Process output on WorkingSet64, the resident set in bytes as reported by the 64-bit counter, then keeps the top fifteen.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 15 Name,Id,@{ Name = "MemoryMB"; Expression = { [math]::Round($_.WorkingSet64/1MB, 1)} }- Stage 1Get-Process
Positional values or no named parameters - Stage 2Sort-Object
-Descending - Stage 3Select-Object
-First
How it works
The pipeline sorts Get-Process output on WorkingSet64, the resident set in bytes as reported by the 64-bit counter, then keeps the top fifteen. A calculated property named MemoryMB converts that byte count with a 1MB divisor and rounds to one decimal so the column stays narrow enough to read.
Adapting it
Swap WorkingSet64 for PrivateMemorySize64 when shared pages need to be excluded from the ranking. Raise the -First value if the interesting consumer is sitting just outside the cut.
If the result is unexpected
MemoryMB values total far more than the RAM installed in the machine, and the per-process numbers do not match the column people are comparing against in Task Manager.
Working set includes memory-mapped pages shared between processes, and every process holding a shared page is charged for the whole of it. Task Manager's default column shows private working set, which is why the two figures disagree. Neither is wrong; they measure different things and get quoted interchangeably.
- Switch the calculated property to PrivateMemorySize64 and compare against Task Manager again.
- Total the private figures rather than the working set values when the question is overall consumption.
- Read the commit charge from Win32_OperatingSystem for a machine-level view.
- Sample twice instead of reading one snapshot to confirm the process is genuinely growing.
- Check handle and thread counts on the suspect, since a leak in either shows up as memory growth.
Validate the result
The sum of private memory across processes lands below installed RAM, and the per-process figure lines up with the private working set column.
Keep the check reliable
Name the metric in the column header so nobody compares a working set figure against a private one, and use private memory for anything that feeds capacity sizing.
Primary documentation
Select-Object reference · Sort-Object reference · Get-Process reference
