Guide · Windows 11 and 10

Non-paged pool memory leak: how to find the driver behind it

When memory disappears and no program in Task Manager owns it, a driver is often leaking kernel memory. Pool tags show which one.

Updated 5 October 2026 · 5 min read

What the non-paged pool is

Besides the memory your programs use, Windows and every driver need memory for the kernel. That memory comes from two pools. The paged pool can be written out to the page file when RAM is short. The non-paged pool cannot: it must always stay in RAM, because it holds data the system may need at moments when it cannot wait for the disk.

That is why a leak there hurts. A driver that allocates non-paged memory and never frees it takes RAM that nothing can reclaim, not even by closing programs. The usual story is a PC that is fine after a restart and slowly gets sluggish over days, with Task Manager's process list adding up to far less than the memory in use.

Step 1: confirm it is growing

A big number by itself is not a leak, because the size depends on your hardware and drivers. What matters is the trend. Open Task Manager, go to Performance, choose Memory, and read Non-paged pool at the bottom. Note it after a restart, then again after a day of normal use.

For a record, use Performance Monitor (perfmon) and add the counter \Memory\Pool Nonpaged Bytes. A line that climbs for hours and never comes back down, while you do the same work, is the leak signature. A line that rises and falls with activity is normal.

Step 2: find the pool tag

Every allocation from the pool carries a four-character pool tag, chosen by the driver's author when it calls ExAllocatePoolWithTag. Ideally each driver has its own tags, so the tag using the most memory points to the driver responsible.

Microsoft's tool for this is PoolMon (poolmon.exe), which ships in the Windows Driver Kit. Install the kit, or copy poolmon.exe from its tools folder, and run this in an administrator terminal:

poolmon /p /b

/p shows only the non-paged pool and /b sorts by bytes used, so the biggest tag is at the top. To compare over time, save snapshots with poolmon /p /b /n snap1.log, then snap2.log a few hours later. You are looking for a tag whose bytes keep rising, with allocations that outnumber frees. Adding /g shows a Mapped_Driver column using Microsoft's pooltag.txt, which names many Windows components and common drivers.

Step 3: turn the tag into a driver

A tag is stored inside the driver file as plain text, so you can search for it. Microsoft's own method is findstr. In an administrator command prompt, run (replace Abcd with your tag):

findstr /s /m /l Abcd C:\Windows\System32\drivers\*.sys

The /m switch prints only file names and /l treats the tag as literal text. If nothing is found, search upward and also try C:\Windows\System32\DriverStore\FileRepository. Then open the file's Properties, Details tab to see its product name, company and version.

This is a text match, not proof. A four-letter string can appear in more than one file, and some tags belong to Windows itself. Microsoft's own write-up warns that a tag may not be unique to one driver. Treat the result as a lead: if the tag is the one that keeps growing and a third-party driver contains it, that driver is the suspect.

Step 4: what to do next

1. Update the driver from the hardware or software maker's site. Network adapters, VPN and virtual-adapter software, antivirus, backup and virtualization tools are common sources of kernel drivers.
2. Roll it back in Device Manager (device Properties, Driver tab, Roll Back Driver) if the leak began after an update.
3. Uninstall the product that installed it, if you do not need it, and restart. Do not delete .sys files by hand; Windows logs errors at every start for a driver whose file is gone.
4. Install Windows updates. If the tag belongs to a Windows component, a later build may fix it.
5. Report it. Give the maker the tag, the file name and version, and your growth figures.

Restart after any change and measure again. If the line is flat for a day, you have your answer.

In Cosmo Cleaner

Release 1.2.0 builds these steps into the Memory tab, so you do not need the Driver Kit. On Kernel pools, the table lists pool tags with their non-paged and paged bytes, live allocations (allocations minus frees) and growth per minute, and can be sorted by any of them. While the view is open Cosmo Cleaner keeps sampling, and after about five minutes of samples it flags tags that only grow with a Leak suspect badge.

The Find driver button on a row scans the installed driver files for that tag and lists the candidates, with how many files it searched. It is the same lookup as the findstr step, and it says so: the result is a text match, not proof of which driver allocates the tag. The Drivers tab then lists loaded kernel drivers with their versions and signatures, and can roll back a device's driver, with an Undo.

Questions