How to Fix Paged Pool and Non-Paged Pool Memory Leak (Solved)

When digging for the causes of high RAM usage on Windows, you might find a massive amount of RAM used as either paged pool or non-paged pool memory in the task manager.

A third-party device driver usually causes this issue, often a network driver or an app that causes the memory leak. But Task Manager doesn’t tell us what driver or app is using it.

So, to fix the paged pool or non-paged pool memory leak, we need to use Process Explorer to identify what is using so much RAM and fix it.

(To save time, you can directly update all outdated drivers at once to fix your paged pool and non-paged pool high memory usage since the problem is often related to network drivers.) 

This is how to do it:

1. Download Sysinternals Process Explorer from the Microsoft official website.
2. Extract the content, and run Process Explorer (procexp64) as admin.
3. On the View menu, click on Select Columns:
   
4. Under Process Memory, check Non-paged pool. You can also check paged pool if your memory leak is happening there:
   
5. Then go to the non-paged pool column and click on it to sort it from the highest to lowest to see which driver or app is responsible for the non-paged pool memory leak:
   
6. Try to update the driver (or uninstall the app) that is causing the problem.

If updating the faulty driver didn’t work, try to disable the Network Data Monitoring Driver, as I explain later in this article.

As an alternative to Process Explorer, you can use PoolMon (Memory Pool Monitor) to find the memory leak.

How to Clear Paged Pool and Non Paged Memory using PoolMon

We can fix the paged pool and non-paged pool memory high memory usage using the Memory Pool Monitor, also known as PoolMon. This tool gives us detailed information on memory allocation to the system’s paged and non-paged pools.

Microsoft’s Official Website explains in detail how Poolmon works. But here we will focus on how to fix this problem right away:

1. Download the PoolMon tool ready to use in this zipped file.
   Important: This file contains the poolmon.exe tool (the version released on 08/26/2021) and a shortcut we need to run it. Microsoft doesn’t offer a separate download for the PoolMon tool, so I assembled to zip file for your convenience.
   If you don’t trust this file, download the Windows Driver Kit (WDK) on the Microsoft Official Website. The WDK is over 2GB; you will find poolmon.exe in the tools folder.
2. Run the shortcut poolmon.exe – b to visualize the processes using your paged pool and non-paged pool. Note the Tag of the process using too much memory (capitalization matters.)
   
   Check the Type column to see whether the process is paged or non-paged(nonp.)
3. Open the command prompt and enter:
   cd C:\Windows\System32\drivers
   
4. Now enter the following command (replace TAG for the tag of the process you took note of in step 2):
   findstr /s TAG *.sys
   
   As an example, here I replaced TAG for HalD, which is the process I want to check.
5. Look for a .sys driver, then google the driver’s name to find more information about it:
   
6. Now update the driver that is leaking memory, or, if possible, uninstall the related application.

Fix Non-Paged Pool High Memory Usage by Disabling the Network Data Usage Monitoring Driver

As I said, the non-paged pool memory leak is usually related to driver issues, especially network drivers.

This is because the high memory usage happens due to conflicts between your network adapter drivers and the Windows Network Data Usage Monitoring Driver(ndu.sys.)

So, your priority should be to update your network adapter drivers. If this didn’t fix the problem, try to disable the Network Data Usage Monitoring Driver to fix the non-paged pool memory leak.

You can do this in the Registry Editor.

(I suggest you backup your registry before attempting to change it.)

1. Enter Registry Editor on Windows Search and click on Open as Administrator:
   
2. In the Registry Editor, navigate to the following path:
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu\
   
3. Right-click on Start, then click on Modify. Change its Value to 4:
   

Keep reading to understand more about non-paged pool memory and how it differs from paged pool memory.

What is the Difference between Paged Pool and Non-Paged Pool Memory?

If you open the Performance tab on the task manager, you will realize that there are two types of memory: Paged Pool Memory and Non-Paged Pool Memory.

But what are they exactly? Here is a simple explanation:

When your system boots up, your operating system will create two memory pools that will be allocated to the functioning of the kernel-mode components (the kernel is responsible for the most vital functions of your OS, for example, resource, memory, and device management.)

These memory pools are the Paged Pool memory and the Non-Paged Pool memory, which are dynamically sized. This means they start using a certain amount of memory, which can be increased if the system needs

The difference between paged pool memory and non-paged pool memory is that the paged pool memory can be paged in and out of the system; that is, it can be increased or decreased according to OS needs, while the non-paged pool memory cannot be paged out.

How to Check Paged pool and Non-Paged Pool Memory Usage

The easiest way to check the paged pool and non-paged pool memory usage is through Windows Task Manager:

1. Open the task manager by pressing the shortcut CTRL + SHIFT + ESC (or by typing task manager on Start Menu).
2. On the task manager, click on the Performance tab to visualize the paged pool and non-paged pool memory usage.

The big problem with this method, as I explained at the beginning of this article, is that even though it shows you the total amount being used by both paged and non-paged pool memory, it doesn’t show you what is specifically using it.

To obtain this information and to effectively know how to clear your paged or non-paged pool memory, you will need to download a tool like Process Explorer or Poolmon, as we explained at the beginning of this article.

Conclusion

To fix the paged pool or non-paged pool memory leak, you can try using the Process Explorer application, an evolved version of Windows task manager. Or try the PoolMon tool, specifically devised to find the processes running in your paged pool.

This issue is often caused by conflicts between your network adapter driver and the Network Data Usage (NDU) Monitoring Driver. So updating your network adapter driver to the latest version, or disabling the NDU in Windows Registry should fix this issue.

If you want to know how to better use Windows task manager, check also our article on task manager keyboard controls you should know.