Operating SystemsWindows Memory Management

Windows Memory Management

LevelAdvanced

Duration90 mins

TopicWindows Memory Management

3 / 5

Working Sets

The Dynamic Dance of Memory Residency

Every running process has memory pages scattered across the virtual address space—but at any given moment, only a subset of those pages actually resides in physical RAM. This subset is called the working set. Understanding working sets is crucial for performance optimization, capacity planning, and diagnosing memory issues on Windows systems.

The working set concept originates from Peter Denning's seminal 1968 research on program locality. The key insight: programs don't touch all their memory equally—they work intensively with a core set of pages, occasionally reaching beyond. Windows exploits this behavior, keeping frequently-used pages in RAM while allowing rarely-touched pages to be evicted. The challenge is doing this efficiently without impacting application performance.

What You Will Learn

By the end of this page, you will understand how Windows defines and tracks working sets, the working set manager's trimming algorithms, min/max working set limits and their configuration, how to analyze working set behavior for performance tuning, and the relationship between working sets and memory pressure response.

Working Set Fundamentals

In Windows terminology, a process's working set is the set of virtual memory pages that are currently resident in physical RAM (Active state in the PFN database). Pages not in the working set either haven't been accessed yet, or have been trimmed out and now reside only in the paging file or standby list.

Key Working Set Metrics:

Working Set Size: Total physical memory currently mapped to the process
Private Working Set: Pages exclusively owned by this process (not shared)
Shareable Working Set: Pages potentially shared with other processes (DLLs, mapped files)
Shared Working Set: Pages actually shared (currently mapped in multiple processes)

The Working Set List:

Each process maintains a Working Set List (WSL) data structure that tracks which virtual pages are currently in RAM. This list enables efficient operations:

Lookup: Is page X in RAM? (O(1) via page table flag)
Enumeration: Which pages should be considered for trimming?
Aging: Which pages haven't been accessed recently?
Replacement: When trimming, which pages to remove first?

Working Set Types in Task Manager
Metric	Definition	Typical Use Case
Working Set	Total physical pages mapped	Quick memory usage overview
Working Set (Private)	Pages only this process uses	True process memory consumption
Working Set (Shared)	Shared pages (DLLs, mapped files)	Collaboration with other processes
Private Bytes	Committed private memory (may not all be resident)	Total private memory obligation
Commit Size	Total committed memory	Full memory commitment

Private vs. Shared Working Set

When analyzing memory usage, focus on Private Working Set for individual process impact. Shared pages (like ntdll.dll) are counted in every process using them, so summing Working Set across processes dramatically overcounts actual RAM usage. Process Explorer and Resource Monitor show these metrics separately for accurate analysis.

Working Set Examination
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
#include <windows.h>
#include <psapi.h>
#include <stdio.h>
 
void examineWorkingSet() {
    HANDLE hProcess = GetCurrentProcess();
    
    // Get basic working set information
    PROCESS_MEMORY_COUNTERS_EX pmc = {0};
    pmc.cb = sizeof(pmc);
    
    if (GetProcessMemoryInfo(hProcess, (PROCESS_MEMORY_COUNTERS*)&pmc, sizeof(pmc))) {
        printf("Working Set Metrics\n");
        printf("════════════════════════════════════════════════════\n");
        printf("Working Set Size:        %8llu KB\n", 
               pmc.WorkingSetSize / 1024);
        printf("Peak Working Set:        %8llu KB\n", 
               pmc.PeakWorkingSetSize / 1024);
        printf("Private Usage:           %8llu KB\n", 
               pmc.PrivateUsage / 1024);
        printf("Page Fault Count:        %8lu\n", 
               pmc.PageFaultCount);
        printf("Quota Page Pool Usage:   %8llu KB\n", 
               pmc.QuotaPagedPoolUsage / 1024);
        printf("Quota NonPage Pool:      %8llu KB\n", 
               pmc.QuotaNonPagedPoolUsage / 1024);
    }
    
    // Get detailed working set information
    // First call to get required buffer size
    ULONG_PTR workingSetSize = 0;
    QueryWorkingSet(hProcess, NULL, 0);  // Gets ERROR_BAD_LENGTH but sets up
    
    // Allocate buffer for working set pages
    SIZE_T bufferSize = sizeof(PSAPI_WORKING_SET_INFORMATION) + 
                        sizeof(PSAPI_WORKING_SET_BLOCK) * 100000;
    PSAPI_WORKING_SET_INFORMATION* wsInfo = 
        (PSAPI_WORKING_SET_INFORMATION*)malloc(bufferSize);
    
    if (QueryWorkingSet(hProcess, wsInfo, (DWORD)bufferSize)) {
        printf("\nWorking Set Pages: %llu\n", (ULONGLONG)wsInfo->NumberOfEntries);
        
        // Analyze page types
        ULONG_PTR sharedCount = 0, privateCount = 0;
        ULONG_PTR protCounts[8] = {0};  // Protection histogram
        
        for (ULONG_PTR i = 0; i < wsInfo->NumberOfEntries; i++) {
            PSAPI_WORKING_SET_BLOCK block = wsInfo->WorkingSetInfo[i];
            
            if (block.Shared) sharedCount++;
            else privateCount++;
            
            // Protection is 3 bits
            protCounts[block.Protection]++;
        }
        
        printf("  Shared pages:  %llu\n", (ULONGLONG)sharedCount);
        printf("  Private pages: %llu\n", (ULONGLONG)privateCount);
        printf("\nProtection breakdown:\n");
        const char* protNames[] = {
            "NoAccess", "ReadOnly", "Execute", "ExecuteRead",
            "ReadWrite", "WriteCopy", "ExecuteRW", "ExecuteWriteCopy"
        };
        for (int p = 0; p < 8; p++) {
            if (protCounts[p] > 0) {
                printf("  %-20s: %llu pages\n", protNames[p], 
                       (ULONGLONG)protCounts[p]);
            }
        }
    }
    
    free(wsInfo);
}
 
// Query working set limits
void queryWorkingSetLimits() {
    SIZE_T minWS, maxWS;
    DWORD flags;
    
    if (GetProcessWorkingSetSizeEx(GetCurrentProcess(), &minWS, &maxWS, &flags)) {
        printf("\nWorking Set Limits:\n");
        printf("  Minimum: %llu MB\n", minWS / (1024 * 1024));
        printf("  Maximum: %llu MB\n", maxWS / (1024 * 1024));
        printf("  Flags:   0x%X\n", flags);
        
        if (flags & QUOTA_LIMITS_HARDWS_MIN_ENABLE) {
            printf("    - Hard minimum enabled\n");
        }
        if (flags & QUOTA_LIMITS_HARDWS_MAX_ENABLE) {
            printf("    - Hard maximum enabled\n");
        }
    }
}

The Working Set Manager

The Working Set Manager (also called the Balance Set Manager or Trimmer) is a kernel thread responsible for maintaining a healthy balance of memory across all processes. It runs periodically and in response to memory pressure, deciding which pages to remove from process working sets.

When Does Trimming Occur?

The Working Set Manager activates in several scenarios:

Available Memory Falls Below Threshold: When free + standby pages drop below a watermark
Working Set Exceeds Maximum: A process grows beyond its configured maximum
System-Wide Memory Pressure: Multiple processes competing for limited RAM
Proactive Aging: Background trimming of cold pages even without immediate pressure
Memory Priority Rebalancing: High-priority processes need RAM from low-priority ones

Trimming Algorithm:

The trimmer uses a sophisticated algorithm combining:

Age: How recently was the page accessed? (Reference bit sampling)
Access Pattern: Hot pages are protected; cold pages are candidates
Protection Priority: Some pages get extra protection (e.g., kernel mappings)
Process Priority: Low-priority processes trimmed before high-priority ones

Working Set Trimming Mechanics

Windows Working Set Trimming Algorithm
════════════════════════════════════════════════════════════════════════════
 
TRIGGER CONDITIONS:
┌─────────────────────────────────────────────────────────────────────────┐
│ Memory Manager checks system state ~1 second intervals:                │
│                                                                         │
│ Available Pages = Free + Zeroed + Standby lists                        │
│                                                                         │
│ IF Available < LowMemoryThreshold                                      │
│    → Aggressive trimming initiated                                     │
│ ELSE IF Available < PlentifulMemoryThreshold                           │
│    → Background/gentle trimming                                         │
│ ELSE                                                                    │
│    → No trimming needed (allow working sets to grow)                   │
└─────────────────────────────────────────────────────────────────────────┘
 
TRIMMING PROCESS (for each process):
┌─────────────────────────────────────────────────────────────────────────┐
│ 1. Calculate trim target based on:                                      │
│    - Current working set size vs. minimum                               │
│    - Process memory priority (0-7)                                      │
│    - System memory pressure level                                       │
│                                                                         │
│ 2. Age all pages in working set:                                        │
│    - Clear reference bits to track future access                       │
│    - Pages not accessed since last check are "aged"                    │
│    - Multiple age levels (0 = hot, higher = colder)                    │
│                                                                         │
│ 3. Select trim candidates:                                              │
│    - Start with coldest (highest age) pages                            │
│    - Skip pages with special protection                                 │
│    - Skip pages below minimum working set                               │
│                                                                         │
│ 4. Remove selected pages:                                               │
│    - Unmap from process page tables                                    │
│    - Add to Modified list (if dirty) or Standby list (if clean)       │
│    - Update working set list                                            │
└─────────────────────────────────────────────────────────────────────────┘
 
PAGE AGE BITS:
┌─────────────────────────────────────────────────────────────────────────┐
│ Each page in the working set has associated age bits:                  │
│                                                                         │
│ Age = 0: Accessed since last aging pass (HOT - protected)              │
│ Age = 1: Not accessed for 1 pass                                       │
│ Age = 2: Not accessed for 2 passes                                     │
│ Age = 3+: Not accessed for multiple passes (COLD - trim candidate)    │
│                                                                         │
│ On each aging pass:                                                     │
│ - If reference bit set → reset age to 0, clear reference bit          │
│ - If reference bit clear → increment age                               │
│                                                                         │
│ This is similar to "Clock" algorithm with multiple hands               │
└─────────────────────────────────────────────────────────────────────────┘
 
MEMORY PRIORITY LEVELS (Windows 8+):
┌─────────────────────────────────────────────────────────────────────────┐
│ Priority │ Description              │ Trim Behavior                     │
│──────────┼──────────────────────────┼───────────────────────────────────│
│    0     │ Idle/Background          │ Trimmed first, aggressively       │
│    1     │ Very Low                 │ Trimmed before normal             │
│    2-3   │ Low                      │ Trimmed before normal             │
│    4-5   │ Normal                   │ Standard trim behavior            │
│    6-7   │ High/Critical            │ Protected, trimmed last           │
└─────────────────────────────────────────────────────────────────────────┘

Soft vs. Hard Trimming

Windows distinguishes between 'soft' trimming (voluntary reduction, pages go to standby) and 'hard' trimming (forced reduction during memory pressure). Soft-trimmed pages can be instantly reclaimed without disk I/O if the process touches them again. Hard trimming during pressure may force modified pages to disk, which is much slower.

Working Set Limits: Minimum and Maximum

Each process has configurable minimum and maximum working set sizes that influence how the working set manager treats it during memory balancing.

Minimum Working Set:

The minimum working set is a guarantee—Windows will not trim the process below this size unless under extreme memory pressure. It protects critical pages from being evicted when other processes need memory.

Default: ~200 pages (~800 KB on x64)
Can be increased: By applications needing guaranteed resident memory
Costs quota: Minimum working set reserves commit against process
Requires privilege: SE_INCREASE_WORKING_SET_NAME for large values

Maximum Working Set:

The maximum working set is a ceiling—the process cannot grow beyond this size. When it tries to fault in pages beyond the maximum, existing pages are first trimmed.

Default: Very large (system dependent, often ~1 GB+ on x64)
Can be reduced: To limit memory-hungry applications
Hard vs. Soft: Can be enforced strictly or as a guideline

Working Set Limit Configurations
Scenario	Min WS	Max WS	Effect
Default process	~800 KB	~1-8 GB	Normal behavior, flexible sizing
Real-time audio	50-100 MB	200 MB	Guaranteed resident pages for latency
Background service	Default	50 MB	Prevents memory hogging
Database buffer pool	Large (GBs)	Large	Keeps critical data resident
Constrained container	Default	Limit	Enforces memory limit

Configuring Working Set Limits
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
#include <windows.h>
#include <stdio.h>
 
// Set working set limits for current process
BOOL setWorkingSetLimits(SIZE_T minMB, SIZE_T maxMB, BOOL hardMin, BOOL hardMax) {
    SIZE_T minBytes = minMB * 1024 * 1024;
    SIZE_T maxBytes = maxMB * 1024 * 1024;
    
    DWORD flags = 0;
    if (hardMin) {
        flags |= QUOTA_LIMITS_HARDWS_MIN_ENABLE;
    }
    if (hardMax) {
        flags |= QUOTA_LIMITS_HARDWS_MAX_ENABLE;
    }
    
    BOOL result = SetProcessWorkingSetSizeEx(
        GetCurrentProcess(),
        minBytes,
        maxBytes,
        flags
    );
    
    if (!result) {
        DWORD err = GetLastError();
        printf("Failed to set working set limits: %lu\n", err);
        
        if (err == ERROR_PRIVILEGE_NOT_HELD) {
            printf("Need SE_INC_WORKING_SET_NAME privilege for large minimum\n");
        }
        return FALSE;
    }
    
    printf("Working set limits set: %llu MB - %llu MB\n", 
           (ULONGLONG)minMB, (ULONGLONG)maxMB);
    return TRUE;
}
 
// Lock pages in memory (prevent ANY trimming)
BOOL lockCriticalPages(LPVOID address, SIZE_T size) {
    // Requires SE_LOCK_MEMORY_NAME privilege (usually admin + policy)
    BOOL result = VirtualLock(address, size);
    
    if (!result) {
        printf("VirtualLock failed: %lu\n", GetLastError());
        printf("Usually requires:\n");
        printf("  1. Admin privileges\n");
        printf("  2. Group policy: Lock pages in memory\n");
        return FALSE;
    }
    
    printf("Locked %llu KB in memory\n", (ULONGLONG)(size / 1024));
    return TRUE;
}
 
// Trigger working set trim (release unused pages)
void trimCurrentProcess() {
    // Setting both to (SIZE_T)-1 triggers empty working set
    // This is rarely useful except for testing/initialization
    
    // Better: Set to current size minus some margin to release cold pages
    PROCESS_MEMORY_COUNTERS pmc = {0};
    pmc.cb = sizeof(pmc);
    GetProcessMemoryInfo(GetCurrentProcess(), &pmc, sizeof(pmc));
    
    SIZE_T currentWS = pmc.WorkingSetSize;
    SIZE_T targetWS = (SIZE_T)(currentWS * 0.5);  // Trim to 50%
    
    printf("Attempting to trim from %llu MB to %llu MB\n",
           (ULONGLONG)(currentWS / 1024 / 1024),
           (ULONGLONG)(targetWS / 1024 / 1024));
    
    // Empty working set completely (testing only)
    SetProcessWorkingSetSize(GetCurrentProcess(), (SIZE_T)-1, (SIZE_T)-1);
    
    // Then set reasonable limits
    SetProcessWorkingSetSizeEx(
        GetCurrentProcess(),
        200 * 4096,     // 800 KB min
        targetWS,       // Target max
        0               // Soft limits
    );
    
    GetProcessMemoryInfo(GetCurrentProcess(), &pmc, sizeof(pmc));
    printf("New working set: %llu MB\n", 
           (ULONGLONG)(pmc.WorkingSetSize / 1024 / 1024));
}

Large Working Set Minimum Risks

Setting a large minimum working set protects your process but steals from others. If many processes demand large minimums, the system can become over-committed, leading to thrashing. Use minimum working set increases sparingly and only for genuinely latency-sensitive applications (real-time audio, high-frequency trading, etc.).

Memory Priority and Background Apps

Windows 8 introduced memory priority as a mechanism to better manage memory between foreground and background applications. Unlike CPU priority (which affects scheduling), memory priority affects working set trimming order and standby list placement.

Memory Priority Levels (0-7):

Processes and individual pages can have different priorities:

Level	Category	Behavior
0	Idle/Background	Trimmed first; standby pages repurposed first
1-2	Very Low/Low	Background processes
3-4	Normal (default)	Standard interactive applications
5-6	High	Foreground/important applications
7	Critical	System-critical processes

How Memory Priority Affects Behavior:

Trimming Order: Low-priority processes are trimmed before high-priority ones
Standby Repurpose: When RAM is needed, standby pages from low-priority processes are repurposed first
Page Lifetime: High-priority pages stay in standby longer before being repurposed
Soft Page Faults: Only help if your standby pages haven't been repurposed

Memory Priority Management
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
#include <windows.h>
#include <stdio.h>
 
// Memory priority levels
#define MEMORY_PRIORITY_LOWEST          0
#define MEMORY_PRIORITY_VERY_LOW        1
#define MEMORY_PRIORITY_LOW             2
#define MEMORY_PRIORITY_MEDIUM          3
#define MEMORY_PRIORITY_BELOW_NORMAL    4
#define MEMORY_PRIORITY_NORMAL          5
#define MEMORY_PRIORITY_HIGH            6
 
// Information class for process memory priority
typedef enum _PROCESS_INFORMATION_CLASS {
    ProcessMemoryPriority = 0x27
} PROCESS_INFORMATION_CLASS;
 
typedef struct _MEMORY_PRIORITY_INFORMATION {
    ULONG MemoryPriority;
} MEMORY_PRIORITY_INFORMATION;
 
typedef NTSTATUS (NTAPI *pNtSetInformationProcess)(
    HANDLE ProcessHandle,
    PROCESS_INFORMATION_CLASS ProcessInformationClass,
    PVOID ProcessInformation,
    ULONG ProcessInformationLength
);
 
void setMemoryPriority(HANDLE hProcess, ULONG priority) {
    // Modern Windows API approach
    MEMORY_PRIORITY_INFORMATION mpi = {0};
    mpi.MemoryPriority = priority;
    
    HMODULE ntdll = GetModuleHandleW(L"ntdll.dll");
    if (ntdll) {
        pNtSetInformationProcess NtSetInformationProcess = 
            (pNtSetInformationProcess)GetProcAddress(ntdll, "NtSetInformationProcess");
        
        if (NtSetInformationProcess) {
            NTSTATUS status = NtSetInformationProcess(
                hProcess,
                ProcessMemoryPriority,
                &mpi,
                sizeof(mpi)
            );
            
            if (status == 0) {
                printf("Memory priority set to %lu\n", priority);
            } else {
                printf("Failed to set memory priority: 0x%lX\n", status);
            }
        }
    }
    
    // Alternatively, use SetProcessInformation (Windows 8+)
    // Requires PROCESS_SET_INFORMATION access right
}
 
// Demonstrate background mode
void runAsBackground() {
    printf("Setting process to background mode...\n");
    
    // This lowers both CPU and memory priority
    BOOL result = SetPriorityClass(GetCurrentProcess(), 
                                   PROCESS_MODE_BACKGROUND_BEGIN);
    
    if (result) {
        printf("Now running in background mode:\n");
        printf("  - Reduced CPU priority\n");
        printf("  - Reduced memory priority\n");
        printf("  - Reduced I/O priority\n");
        
        // Do background work here...
        
        // Return to normal mode
        SetPriorityClass(GetCurrentProcess(), PROCESS_MODE_BACKGROUND_END);
        printf("Returned to normal mode\n");
    } else {
        printf("Failed: %lu\n", GetLastError());
    }
}
 
// Query current memory priority
void queryMemoryPriority() {
    // Using GetProcessInformation (Windows 8+)
    MEMORY_PRIORITY_INFORMATION mpi = {0};
    
    SIZE_T returnLength;
    BOOL result = GetProcessInformation(
        GetCurrentProcess(),
        ProcessMemoryPriority,
        &mpi,
        sizeof(mpi)
    );
    
    if (result) {
        const char* names[] = {
            "Lowest", "Very Low", "Low", "Medium",
            "Below Normal", "Normal", "High"
        };
        printf("Current memory priority: %s (%lu)\n",
               mpi.MemoryPriority < 7 ? names[mpi.MemoryPriority] : "Unknown",
               mpi.MemoryPriority);
    }
}

Foreground Boost Matters

Windows automatically boosts memory priority for the foreground window's process. This is why switching to an app feels responsive—the system prioritizes its memory over background tasks. Applications can also manually adjust priority, but the foreground boost is automatic and immediate.

Working Set Analysis and Tuning

Analyzing working set behavior is essential for performance tuning, both for individual applications and system-wide configuration. The goal is to ensure critical applications have sufficient resident memory while preventing any single application from monopolizing RAM.

Key Analysis Questions:

Is the working set stable or growing? Unbounded growth suggests memory leaks
How much is private vs. shared? Shared pages are memory-efficient
What's the fault rate? High hard faults indicate insufficient RAM
What percentage is actually accessed? Large unused allocations waste RAM
How does stress testing affect it? Peak load may need more memory

Working Set Analysis Tools

Using VMMap (Sysinternals) for Working Set Analysis:
════════════════════════════════════════════════════════════════════════════
 
VMMap provides the most detailed view of process virtual memory.
 
1. Open VMMap and select target process
 
2. Key Views:
 
   SUMMARY VIEW:
   ┌────────────────────┬─────────────┬─────────────┬─────────────┐
   │ Type               │ Size        │ Committed   │ Working Set │
   ├────────────────────┼─────────────┼─────────────┼─────────────┤
   │ Image (exe/dll)    │ 156 MB      │  89 MB      │  45 MB      │
   │ Mapped File        │  32 MB      │  32 MB      │  12 MB      │
   │ Heap               │ 234 MB      │ 178 MB      │  89 MB      │
   │ Stack              │  16 MB      │   2 MB      │   1 MB      │
   │ Private Data       │ 512 MB      │ 256 MB      │ 128 MB      │
   │ Shareable          │  64 MB      │  64 MB      │  32 MB      │
   └────────────────────┴─────────────┴─────────────┴─────────────┘
   
   Working Set << Committed indicates cold/paged-out memory
   Large Private Data working sets may indicate data processing app
 
3. WORKING SET COLUMNS:
   - Total WS: All resident pages
   - Private WS: Exclusively this process
   - Shareable WS: Could be shared
   - Shared WS: Actually shared (counted once in system)
 
4. IDENTIFY ISSUES:
   
   Large Heap with small WS ratio:
   → Memory allocated but not actively used
   → Possible memory leak or over-allocation
   
   Large Private Data:
   → Heavy data processing
   → May need more RAM for optimal performance
   
   Image WS much smaller than committed:
   → Code being paged out
   → Consider SSD or more RAM.
   
5. TIMELINE VIEW:
   - Shows working set size over time
   - Identify growth patterns
   - Catch memory leaks early

Healthy Working Set Signs

•Stable size over time (not growing unbounded)
•High private-to-shared ratio for data apps
•Low page fault rate (<50/sec typically)
•WS close to committed (active usage)
•Quick recovery after background period

Working Set Problems

•Continuous growth (memory leak)
•Committed >> WS (over-allocation)
•High fault rate (memory pressure)
•Frequent large WS drops (heavy trimming)
•WS thrashing (grow→trim→grow cycle)

Summary: Windows Working Sets

We've explored the Windows working set model in depth—from fundamental concepts through management algorithms to practical analysis techniques. Let's consolidate the key takeaways:

Key Takeaways

•Working Set = Resident Pages — Only pages currently in physical RAM, not total virtual memory allocated.
•Private vs. Shared WS — Private WS shows true per-process impact; shared pages (DLLs) are counted once in system memory but appear in each process.
•Working Set Manager balances memory — Continuously trims cold pages from processes based on age, priority, and pressure level.
•Min/Max limits configure behavior — Minimum protects critical pages; maximum prevents monopolization. Use sparingly.
•Memory priority affects trim order — Background apps trimmed first; foreground apps automatically boosted.
•Analysis tools are essential — VMMap, Performance Monitor, and Resource Monitor reveal working set health and problems.

What's Next:

With working sets understood, we'll explore memory pools—the kernel-mode memory management structures that provide allocation services to the kernel itself and device drivers. Understanding pools is essential for diagnosing kernel memory issues and understanding overall system memory consumption.

Page Complete

You now understand the Windows working set model—how Windows tracks memory residency, how the working set manager balances memory between processes, and how to analyze and tune working set behavior for optimal performance.

3 / 5

Loading learning content...

Operating SystemsWindows Memory Management

Windows Memory Management

LevelAdvanced

Duration90 mins

TopicWindows Memory Management

3 / 5

Working Sets

The Dynamic Dance of Memory Residency

What You Will Learn

Working Set Fundamentals

Key Working Set Metrics:

Working Set Size: Total physical memory currently mapped to the process
Private Working Set: Pages exclusively owned by this process (not shared)
Shareable Working Set: Pages potentially shared with other processes (DLLs, mapped files)
Shared Working Set: Pages actually shared (currently mapped in multiple processes)

The Working Set List:

Each process maintains a Working Set List (WSL) data structure that tracks which virtual pages are currently in RAM. This list enables efficient operations:

Lookup: Is page X in RAM? (O(1) via page table flag)
Enumeration: Which pages should be considered for trimming?
Aging: Which pages haven't been accessed recently?
Replacement: When trimming, which pages to remove first?

Working Set Types in Task Manager
Metric	Definition	Typical Use Case
Working Set	Total physical pages mapped	Quick memory usage overview
Working Set (Private)	Pages only this process uses	True process memory consumption
Working Set (Shared)	Shared pages (DLLs, mapped files)	Collaboration with other processes
Private Bytes	Committed private memory (may not all be resident)	Total private memory obligation
Commit Size	Total committed memory	Full memory commitment

Private vs. Shared Working Set

Working Set Examination
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
#include <windows.h>
#include <psapi.h>
#include <stdio.h>
 
void examineWorkingSet() {
    HANDLE hProcess = GetCurrentProcess();
    
    // Get basic working set information
    PROCESS_MEMORY_COUNTERS_EX pmc = {0};
    pmc.cb = sizeof(pmc);
    
    if (GetProcessMemoryInfo(hProcess, (PROCESS_MEMORY_COUNTERS*)&pmc, sizeof(pmc))) {
        printf("Working Set Metrics\n");
        printf("════════════════════════════════════════════════════\n");
        printf("Working Set Size:        %8llu KB\n", 
               pmc.WorkingSetSize / 1024);
        printf("Peak Working Set:        %8llu KB\n", 
               pmc.PeakWorkingSetSize / 1024);
        printf("Private Usage:           %8llu KB\n", 
               pmc.PrivateUsage / 1024);
        printf("Page Fault Count:        %8lu\n", 
               pmc.PageFaultCount);
        printf("Quota Page Pool Usage:   %8llu KB\n", 
               pmc.QuotaPagedPoolUsage / 1024);
        printf("Quota NonPage Pool:      %8llu KB\n", 
               pmc.QuotaNonPagedPoolUsage / 1024);
    }
    
    // Get detailed working set information
    // First call to get required buffer size
    ULONG_PTR workingSetSize = 0;
    QueryWorkingSet(hProcess, NULL, 0);  // Gets ERROR_BAD_LENGTH but sets up
    
    // Allocate buffer for working set pages
    SIZE_T bufferSize = sizeof(PSAPI_WORKING_SET_INFORMATION) + 
                        sizeof(PSAPI_WORKING_SET_BLOCK) * 100000;
    PSAPI_WORKING_SET_INFORMATION* wsInfo = 
        (PSAPI_WORKING_SET_INFORMATION*)malloc(bufferSize);
    
    if (QueryWorkingSet(hProcess, wsInfo, (DWORD)bufferSize)) {
        printf("\nWorking Set Pages: %llu\n", (ULONGLONG)wsInfo->NumberOfEntries);
        
        // Analyze page types
        ULONG_PTR sharedCount = 0, privateCount = 0;
        ULONG_PTR protCounts[8] = {0};  // Protection histogram
        
        for (ULONG_PTR i = 0; i < wsInfo->NumberOfEntries; i++) {
            PSAPI_WORKING_SET_BLOCK block = wsInfo->WorkingSetInfo[i];
            
            if (block.Shared) sharedCount++;
            else privateCount++;
            
            // Protection is 3 bits
            protCounts[block.Protection]++;
        }
        
        printf("  Shared pages:  %llu\n", (ULONGLONG)sharedCount);
        printf("  Private pages: %llu\n", (ULONGLONG)privateCount);
        printf("\nProtection breakdown:\n");
        const char* protNames[] = {
            "NoAccess", "ReadOnly", "Execute", "ExecuteRead",
            "ReadWrite", "WriteCopy", "ExecuteRW", "ExecuteWriteCopy"
        };
        for (int p = 0; p < 8; p++) {
            if (protCounts[p] > 0) {
                printf("  %-20s: %llu pages\n", protNames[p], 
                       (ULONGLONG)protCounts[p]);
            }
        }
    }
    
    free(wsInfo);
}
 
// Query working set limits
void queryWorkingSetLimits() {
    SIZE_T minWS, maxWS;
    DWORD flags;
    
    if (GetProcessWorkingSetSizeEx(GetCurrentProcess(), &minWS, &maxWS, &flags)) {
        printf("\nWorking Set Limits:\n");
        printf("  Minimum: %llu MB\n", minWS / (1024 * 1024));
        printf("  Maximum: %llu MB\n", maxWS / (1024 * 1024));
        printf("  Flags:   0x%X\n", flags);
        
        if (flags & QUOTA_LIMITS_HARDWS_MIN_ENABLE) {
            printf("    - Hard minimum enabled\n");
        }
        if (flags & QUOTA_LIMITS_HARDWS_MAX_ENABLE) {
            printf("    - Hard maximum enabled\n");
        }
    }
}

The Working Set Manager

When Does Trimming Occur?

The Working Set Manager activates in several scenarios:

Available Memory Falls Below Threshold: When free + standby pages drop below a watermark
Working Set Exceeds Maximum: A process grows beyond its configured maximum
System-Wide Memory Pressure: Multiple processes competing for limited RAM
Proactive Aging: Background trimming of cold pages even without immediate pressure
Memory Priority Rebalancing: High-priority processes need RAM from low-priority ones

Trimming Algorithm:

The trimmer uses a sophisticated algorithm combining:

Age: How recently was the page accessed? (Reference bit sampling)
Access Pattern: Hot pages are protected; cold pages are candidates
Protection Priority: Some pages get extra protection (e.g., kernel mappings)
Process Priority: Low-priority processes trimmed before high-priority ones

Working Set Trimming Mechanics

Windows Working Set Trimming Algorithm
════════════════════════════════════════════════════════════════════════════
 
TRIGGER CONDITIONS:
┌─────────────────────────────────────────────────────────────────────────┐
│ Memory Manager checks system state ~1 second intervals:                │
│                                                                         │
│ Available Pages = Free + Zeroed + Standby lists                        │
│                                                                         │
│ IF Available < LowMemoryThreshold                                      │
│    → Aggressive trimming initiated                                     │
│ ELSE IF Available < PlentifulMemoryThreshold                           │
│    → Background/gentle trimming                                         │
│ ELSE                                                                    │
│    → No trimming needed (allow working sets to grow)                   │
└─────────────────────────────────────────────────────────────────────────┘
 
TRIMMING PROCESS (for each process):
┌─────────────────────────────────────────────────────────────────────────┐
│ 1. Calculate trim target based on:                                      │
│    - Current working set size vs. minimum                               │
│    - Process memory priority (0-7)                                      │
│    - System memory pressure level                                       │
│                                                                         │
│ 2. Age all pages in working set:                                        │
│    - Clear reference bits to track future access                       │
│    - Pages not accessed since last check are "aged"                    │
│    - Multiple age levels (0 = hot, higher = colder)                    │
│                                                                         │
│ 3. Select trim candidates:                                              │
│    - Start with coldest (highest age) pages                            │
│    - Skip pages with special protection                                 │
│    - Skip pages below minimum working set                               │
│                                                                         │
│ 4. Remove selected pages:                                               │
│    - Unmap from process page tables                                    │
│    - Add to Modified list (if dirty) or Standby list (if clean)       │
│    - Update working set list                                            │
└─────────────────────────────────────────────────────────────────────────┘
 
PAGE AGE BITS:
┌─────────────────────────────────────────────────────────────────────────┐
│ Each page in the working set has associated age bits:                  │
│                                                                         │
│ Age = 0: Accessed since last aging pass (HOT - protected)              │
│ Age = 1: Not accessed for 1 pass                                       │
│ Age = 2: Not accessed for 2 passes                                     │
│ Age = 3+: Not accessed for multiple passes (COLD - trim candidate)    │
│                                                                         │
│ On each aging pass:                                                     │
│ - If reference bit set → reset age to 0, clear reference bit          │
│ - If reference bit clear → increment age                               │
│                                                                         │
│ This is similar to "Clock" algorithm with multiple hands               │
└─────────────────────────────────────────────────────────────────────────┘
 
MEMORY PRIORITY LEVELS (Windows 8+):
┌─────────────────────────────────────────────────────────────────────────┐
│ Priority │ Description              │ Trim Behavior                     │
│──────────┼──────────────────────────┼───────────────────────────────────│
│    0     │ Idle/Background          │ Trimmed first, aggressively       │
│    1     │ Very Low                 │ Trimmed before normal             │
│    2-3   │ Low                      │ Trimmed before normal             │
│    4-5   │ Normal                   │ Standard trim behavior            │
│    6-7   │ High/Critical            │ Protected, trimmed last           │
└─────────────────────────────────────────────────────────────────────────┘

Soft vs. Hard Trimming

Working Set Limits: Minimum and Maximum

Each process has configurable minimum and maximum working set sizes that influence how the working set manager treats it during memory balancing.

Minimum Working Set:

Default: ~200 pages (~800 KB on x64)
Can be increased: By applications needing guaranteed resident memory
Costs quota: Minimum working set reserves commit against process
Requires privilege: SE_INCREASE_WORKING_SET_NAME for large values

Maximum Working Set:

The maximum working set is a ceiling—the process cannot grow beyond this size. When it tries to fault in pages beyond the maximum, existing pages are first trimmed.

Default: Very large (system dependent, often ~1 GB+ on x64)
Can be reduced: To limit memory-hungry applications
Hard vs. Soft: Can be enforced strictly or as a guideline

Working Set Limit Configurations
Scenario	Min WS	Max WS	Effect
Default process	~800 KB	~1-8 GB	Normal behavior, flexible sizing
Real-time audio	50-100 MB	200 MB	Guaranteed resident pages for latency
Background service	Default	50 MB	Prevents memory hogging
Database buffer pool	Large (GBs)	Large	Keeps critical data resident
Constrained container	Default	Limit	Enforces memory limit

Configuring Working Set Limits
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
#include <windows.h>
#include <stdio.h>
 
// Set working set limits for current process
BOOL setWorkingSetLimits(SIZE_T minMB, SIZE_T maxMB, BOOL hardMin, BOOL hardMax) {
    SIZE_T minBytes = minMB * 1024 * 1024;
    SIZE_T maxBytes = maxMB * 1024 * 1024;
    
    DWORD flags = 0;
    if (hardMin) {
        flags |= QUOTA_LIMITS_HARDWS_MIN_ENABLE;
    }
    if (hardMax) {
        flags |= QUOTA_LIMITS_HARDWS_MAX_ENABLE;
    }
    
    BOOL result = SetProcessWorkingSetSizeEx(
        GetCurrentProcess(),
        minBytes,
        maxBytes,
        flags
    );
    
    if (!result) {
        DWORD err = GetLastError();
        printf("Failed to set working set limits: %lu\n", err);
        
        if (err == ERROR_PRIVILEGE_NOT_HELD) {
            printf("Need SE_INC_WORKING_SET_NAME privilege for large minimum\n");
        }
        return FALSE;
    }
    
    printf("Working set limits set: %llu MB - %llu MB\n", 
           (ULONGLONG)minMB, (ULONGLONG)maxMB);
    return TRUE;
}
 
// Lock pages in memory (prevent ANY trimming)
BOOL lockCriticalPages(LPVOID address, SIZE_T size) {
    // Requires SE_LOCK_MEMORY_NAME privilege (usually admin + policy)
    BOOL result = VirtualLock(address, size);
    
    if (!result) {
        printf("VirtualLock failed: %lu\n", GetLastError());
        printf("Usually requires:\n");
        printf("  1. Admin privileges\n");
        printf("  2. Group policy: Lock pages in memory\n");
        return FALSE;
    }
    
    printf("Locked %llu KB in memory\n", (ULONGLONG)(size / 1024));
    return TRUE;
}
 
// Trigger working set trim (release unused pages)
void trimCurrentProcess() {
    // Setting both to (SIZE_T)-1 triggers empty working set
    // This is rarely useful except for testing/initialization
    
    // Better: Set to current size minus some margin to release cold pages
    PROCESS_MEMORY_COUNTERS pmc = {0};
    pmc.cb = sizeof(pmc);
    GetProcessMemoryInfo(GetCurrentProcess(), &pmc, sizeof(pmc));
    
    SIZE_T currentWS = pmc.WorkingSetSize;
    SIZE_T targetWS = (SIZE_T)(currentWS * 0.5);  // Trim to 50%
    
    printf("Attempting to trim from %llu MB to %llu MB\n",
           (ULONGLONG)(currentWS / 1024 / 1024),
           (ULONGLONG)(targetWS / 1024 / 1024));
    
    // Empty working set completely (testing only)
    SetProcessWorkingSetSize(GetCurrentProcess(), (SIZE_T)-1, (SIZE_T)-1);
    
    // Then set reasonable limits
    SetProcessWorkingSetSizeEx(
        GetCurrentProcess(),
        200 * 4096,     // 800 KB min
        targetWS,       // Target max
        0               // Soft limits
    );
    
    GetProcessMemoryInfo(GetCurrentProcess(), &pmc, sizeof(pmc));
    printf("New working set: %llu MB\n", 
           (ULONGLONG)(pmc.WorkingSetSize / 1024 / 1024));
}

Large Working Set Minimum Risks

Memory Priority and Background Apps

Memory Priority Levels (0-7):

Processes and individual pages can have different priorities:

Level	Category	Behavior
0	Idle/Background	Trimmed first; standby pages repurposed first
1-2	Very Low/Low	Background processes
3-4	Normal (default)	Standard interactive applications
5-6	High	Foreground/important applications
7	Critical	System-critical processes

How Memory Priority Affects Behavior:

Trimming Order: Low-priority processes are trimmed before high-priority ones
Standby Repurpose: When RAM is needed, standby pages from low-priority processes are repurposed first
Page Lifetime: High-priority pages stay in standby longer before being repurposed
Soft Page Faults: Only help if your standby pages haven't been repurposed

Memory Priority Management
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
#include <windows.h>
#include <stdio.h>
 
// Memory priority levels
#define MEMORY_PRIORITY_LOWEST          0
#define MEMORY_PRIORITY_VERY_LOW        1
#define MEMORY_PRIORITY_LOW             2
#define MEMORY_PRIORITY_MEDIUM          3
#define MEMORY_PRIORITY_BELOW_NORMAL    4
#define MEMORY_PRIORITY_NORMAL          5
#define MEMORY_PRIORITY_HIGH            6
 
// Information class for process memory priority
typedef enum _PROCESS_INFORMATION_CLASS {
    ProcessMemoryPriority = 0x27
} PROCESS_INFORMATION_CLASS;
 
typedef struct _MEMORY_PRIORITY_INFORMATION {
    ULONG MemoryPriority;
} MEMORY_PRIORITY_INFORMATION;
 
typedef NTSTATUS (NTAPI *pNtSetInformationProcess)(
    HANDLE ProcessHandle,
    PROCESS_INFORMATION_CLASS ProcessInformationClass,
    PVOID ProcessInformation,
    ULONG ProcessInformationLength
);
 
void setMemoryPriority(HANDLE hProcess, ULONG priority) {
    // Modern Windows API approach
    MEMORY_PRIORITY_INFORMATION mpi = {0};
    mpi.MemoryPriority = priority;
    
    HMODULE ntdll = GetModuleHandleW(L"ntdll.dll");
    if (ntdll) {
        pNtSetInformationProcess NtSetInformationProcess = 
            (pNtSetInformationProcess)GetProcAddress(ntdll, "NtSetInformationProcess");
        
        if (NtSetInformationProcess) {
            NTSTATUS status = NtSetInformationProcess(
                hProcess,
                ProcessMemoryPriority,
                &mpi,
                sizeof(mpi)
            );
            
            if (status == 0) {
                printf("Memory priority set to %lu\n", priority);
            } else {
                printf("Failed to set memory priority: 0x%lX\n", status);
            }
        }
    }
    
    // Alternatively, use SetProcessInformation (Windows 8+)
    // Requires PROCESS_SET_INFORMATION access right
}
 
// Demonstrate background mode
void runAsBackground() {
    printf("Setting process to background mode...\n");
    
    // This lowers both CPU and memory priority
    BOOL result = SetPriorityClass(GetCurrentProcess(), 
                                   PROCESS_MODE_BACKGROUND_BEGIN);
    
    if (result) {
        printf("Now running in background mode:\n");
        printf("  - Reduced CPU priority\n");
        printf("  - Reduced memory priority\n");
        printf("  - Reduced I/O priority\n");
        
        // Do background work here...
        
        // Return to normal mode
        SetPriorityClass(GetCurrentProcess(), PROCESS_MODE_BACKGROUND_END);
        printf("Returned to normal mode\n");
    } else {
        printf("Failed: %lu\n", GetLastError());
    }
}
 
// Query current memory priority
void queryMemoryPriority() {
    // Using GetProcessInformation (Windows 8+)
    MEMORY_PRIORITY_INFORMATION mpi = {0};
    
    SIZE_T returnLength;
    BOOL result = GetProcessInformation(
        GetCurrentProcess(),
        ProcessMemoryPriority,
        &mpi,
        sizeof(mpi)
    );
    
    if (result) {
        const char* names[] = {
            "Lowest", "Very Low", "Low", "Medium",
            "Below Normal", "Normal", "High"
        };
        printf("Current memory priority: %s (%lu)\n",
               mpi.MemoryPriority < 7 ? names[mpi.MemoryPriority] : "Unknown",
               mpi.MemoryPriority);
    }
}

Foreground Boost Matters

Working Set Analysis and Tuning

Key Analysis Questions:

Is the working set stable or growing? Unbounded growth suggests memory leaks
How much is private vs. shared? Shared pages are memory-efficient
What's the fault rate? High hard faults indicate insufficient RAM
What percentage is actually accessed? Large unused allocations waste RAM
How does stress testing affect it? Peak load may need more memory

Working Set Analysis Tools

Using VMMap (Sysinternals) for Working Set Analysis:
════════════════════════════════════════════════════════════════════════════
 
VMMap provides the most detailed view of process virtual memory.
 
1. Open VMMap and select target process
 
2. Key Views:
 
   SUMMARY VIEW:
   ┌────────────────────┬─────────────┬─────────────┬─────────────┐
   │ Type               │ Size        │ Committed   │ Working Set │
   ├────────────────────┼─────────────┼─────────────┼─────────────┤
   │ Image (exe/dll)    │ 156 MB      │  89 MB      │  45 MB      │
   │ Mapped File        │  32 MB      │  32 MB      │  12 MB      │
   │ Heap               │ 234 MB      │ 178 MB      │  89 MB      │
   │ Stack              │  16 MB      │   2 MB      │   1 MB      │
   │ Private Data       │ 512 MB      │ 256 MB      │ 128 MB      │
   │ Shareable          │  64 MB      │  64 MB      │  32 MB      │
   └────────────────────┴─────────────┴─────────────┴─────────────┘
   
   Working Set << Committed indicates cold/paged-out memory
   Large Private Data working sets may indicate data processing app
 
3. WORKING SET COLUMNS:
   - Total WS: All resident pages
   - Private WS: Exclusively this process
   - Shareable WS: Could be shared
   - Shared WS: Actually shared (counted once in system)
 
4. IDENTIFY ISSUES:
   
   Large Heap with small WS ratio:
   → Memory allocated but not actively used
   → Possible memory leak or over-allocation
   
   Large Private Data:
   → Heavy data processing
   → May need more RAM for optimal performance
   
   Image WS much smaller than committed:
   → Code being paged out
   → Consider SSD or more RAM.
   
5. TIMELINE VIEW:
   - Shows working set size over time
   - Identify growth patterns
   - Catch memory leaks early

Healthy Working Set Signs

•Stable size over time (not growing unbounded)
•High private-to-shared ratio for data apps
•Low page fault rate (<50/sec typically)
•WS close to committed (active usage)
•Quick recovery after background period

Working Set Problems

•Continuous growth (memory leak)
•Committed >> WS (over-allocation)
•High fault rate (memory pressure)
•Frequent large WS drops (heavy trimming)
•WS thrashing (grow→trim→grow cycle)

Summary: Windows Working Sets

We've explored the Windows working set model in depth—from fundamental concepts through management algorithms to practical analysis techniques. Let's consolidate the key takeaways:

Key Takeaways

•Working Set = Resident Pages — Only pages currently in physical RAM, not total virtual memory allocated.
•Private vs. Shared WS — Private WS shows true per-process impact; shared pages (DLLs) are counted once in system memory but appear in each process.
•Working Set Manager balances memory — Continuously trims cold pages from processes based on age, priority, and pressure level.
•Min/Max limits configure behavior — Minimum protects critical pages; maximum prevents monopolization. Use sparingly.
•Memory priority affects trim order — Background apps trimmed first; foreground apps automatically boosted.
•Analysis tools are essential — VMMap, Performance Monitor, and Resource Monitor reveal working set health and problems.

What's Next:

Page Complete

3 / 5