Disk Usage Too High Since Windows 10 Updates

Topic

New Reply

Hello All,

Before assenting to the most recent Windows updates, disk usage on this machine while idling seldom rose above 5%. The system drive is an SSD, there’s an internal spinning drive used for File History, and there’s an external USB drive used for system image backups. The drive usage schedule at the time this snapshot was taken would be that only File History might be running. But there haven’t been so many changes to the volume of the files on the computer that I don’t see how that could account for the increased activity.

What could I use to track down which of the drives is creating the increased activities? I’m not used to Process Explorer although I tried it and didn’t notice anything that way — although I don’t yet know what I’m looking for.

Thank you

Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

Reply | Quote

Replies

[Bundaburra]

I use an old (but still working) program called DriveGLEAM, which sits in the tray and displays activity for each drive in the system.  It doesn’t matter whether each drive is a physical drive, or a partition, or an external USB drive, or even a partition on an external USB drive;  if it has a drive letter it will show up.  The icon for each drive changes colour according to activity;  red if the drive is being written to, green if it is being read from, yellow if both at once, and blue if the drive is idle.  It’s not perfect, but it’s indicative of activity on each drive.  Not sure about SSD, because I don’t have one, but DriveGLEAM is worth a try.  It’s free, by the way, and can also display other useful information such as memory and CPU use.  There’s a download for it on majorgeeks.

Windows 10 Pro 64 bit 20H2

• This reply was modified 5 years, 1 month ago by Bundaburra.
• This reply was modified 5 years, 1 month ago by Bundaburra.

2 users thanked author for this post.

Mr. Austin, rodcallen

Reply | Quote

There is a fair bit of activity post updates. Leave it a couple of days and see if it’s still an issue.

cheers, Paul

1 user thanked author for this post.

Mr. Austin

Reply | Quote

Mr. Austin wrote:

What could I use to track down which of the drives is creating the increased activities?

Task Manager displays separate utilization for each disk on the Performance tab.

1 user thanked author for this post.

Mr. Austin

Reply | Quote

It’s not drive information that you need. You want to know specifics. When doing forensic work involving drive writes, I use these three freeware portable tools by Nir Sofer:

1) FileActivityWatch
2) AppReadWriteCounter
3) FolderChangesView

4 users thanked author for this post.

Elly, Mr. Austin, DriftyDonN, wavy

Reply | Quote

Carl wrote:

It’s not drive information that you need. You want to know specifics.

Task Manager can give specifics as to what service/task is using disks.  In the Processes view click the % Disk column header and it will sort according to highest usage.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

2 users thanked author for this post.

Elly, Bluetrix

Reply | Quote

[Mr. Austin]

Thanks for the leads everyone

The drive activity subsided to the normal levels I’d seen before on the machine. But it looks like when it occurs again I’ll have the analytics tools y’all provided to suss it out

Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

• This reply was modified 5 years, 1 month ago by Mr. Austin.

Reply | Quote

Carl wrote:

You want to know specifics.

Carl, agreed. I will want to know what software is writing to what drive, and why it’s choosing that drive. If/when the behavior occurs again it looks like the tools you suggested will help me find that 

Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

Reply | Quote

As a side note Michael, it’s normal for an increase in disk activity for a period of time after performing an update.

For example, the MSRT (Malicious Software Removal Tool), if part of the update, will begin a scan after reboot and upon completion will send telemetry data to Microsoft (unless disabled).

Other updates may perform house cleaning chores upon reboot. You may also see the indexing service kick in depending upon settings.

2 users thanked author for this post.

ajaks, Mr. Austin

Reply | Quote

The Windows Task Manager can easily tell you what drive is being used in the “Performance” tab.

And then if you view the “Processes” tab sorted by the disk column (by clicking on the top row of that column) it will reveal which task(s) is(are) using the disk the most.

Once you have that info you can use other tools to drill down into the details. But I normally leave the computer on overnight after an update so that it can run all of its internal routines. Then it usually settles down. If not, then it often comes down to a scheduled task that can be disabled in “Task Scheduler” if necessary.

Windows 10 Pro 22H2

1 user thanked author for this post.

Mr. Austin

Reply | Quote

Thanks very much Carl and JohnW I’d surmised things like those would go on in the background but I didn’t know. I’m justifiably suspicious about Windows 10’s processes is why I asked the questions.

In the several days since Microsoft’s new patches, my spot-checks of the drives’ activities have shown them remaining as low as this fairly powerful machine had shown in its past – 1% to 2% while ‘idling’ amid internet, e-mail, Spotify and 3rd-party security software processes.

This box was sold as “VR ready” with a 480 GB SSD drive I swapped for a 2 TB Western Digital SSD, and its factory-installed 3 TB Toshiba spinning storage drive. Its third drive I added is a spinning 8 TB, Seagate USB 3.x back-up. 32 GB RAM and 8 Intel cores so he machine has enough horsepower and torque to do most anything I’ll want. Including a virtual hypervisor if I eventually decide I want that. Video editing or sound editing is this box’s most resource intensive use.

Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

Reply | Quote

[Mr. Austin]

JohnW wrote:

And then if you view the “Processes” tab sorted by the disk column (by clicking on the top row of that column) it will reveal which task(s) is(are) using the disk the most.

So what I’m hunting for is which disk is using the most processes… on account’a because the only process showing high disk usage is the ntoskernal.exe. Task Manager doesn’t specify which disk it’s reading/writing to.

The latest elevated disk usage, just now, probably came about because I just flashed the machine’s BIOS. The machine shut itself off and on after twice the flash utility was run. Then this screen resulted the 2nd time.

So I rebooted into the BIOS into Boot Configuration, and then and re-pointed its boot sector from ‘local’ to auto-recovery.

 

Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

• This reply was modified 5 years ago by Mr. Austin.
• This reply was modified 5 years ago by Mr. Austin.

Reply | Quote

I get a slightly different version of the American Megatrends screen after re flashing the  BIOS / UEFI.  (attached)

My screen does not have your error message, but you’ll notice it’s still obtusely worded and  confusing.  HOWEVER, since there is no other logical choice, I “enter setup to recover bios setting”.  It just takes me to the my  regular UEFI setup screen and the BIOS version that is showing is the correct NEW version I re-flashed to install.  From there, I check a few things then hit “save and exit”.  At this point the actual ROM re-flash is finalized and it takes a few moments and sometimes another auto restart.  Once done, the boot starts and proceeds normally.  I’ve re-flashed this machine (desktop Asus X299 Mark 1 motherboard) 3 or 4 times without errors or nasty surprises.

Hope this helps.

Desktop Asus TUF X299 Mark 1, CPU: Intel Core i7-7820X Skylake-X 8-Core 3.6 GHz, RAM: 32GB, GPU: Nvidia GTX 1050 Ti 4GB. Display: Four 27" 1080p screens 2 over 2 quad.

1 user thanked author for this post.

Mr. Austin

Reply | Quote

Mr. Austin wrote:

So what I’m hunting for is which disk is using the most processes… on account’a because the only process showing high disk usage is the ntoskernal.exe. Task Manager doesn’t specify which disk it’s reading/writing to. The latest elevated disk usage, just now, probably came about because I just flashed the machine’s BIOS. The machine shut itself off and on after twice the flash utility was run. Then this screen resulted the 2nd time.

If you look into the task manager, then click on the performance tab, & look down at the bottom you will see “Open Resource Monitor”.

In Resource Monitor there are a wealth of details available in the “Disk” tab. It actually shows each file name and complete path, including the drive letter, being accessed in columns showing “Read | Write | Both” , which can be sorted by clicking on the top row.

 

Windows 10 Pro 22H2

1 user thanked author for this post.

Mr. Austin

Reply | Quote

TechTango wrote:

HOWEVER, since there is no other logical choice, I “enter setup to recover bios setting”.

TechTango… thanks! I didn’t expect someone else to have a similar mainboard so thank you!

I’ve tinkered with options on the way this machine’s BIOS is set at this writing. The only one which will boot to Windows is to ‘recover’ the MBR/GPT sector each time, instead of local control. But instead of booting through one clean BIOS screen like it did before the flash, it gives me two, and then boots into Windows.

Because of their second instruction shown on my photo I also tried changing the SATA setting from AHCI to Intel Raid. That cheefully provides a BSOD.

I think I’ll engage Asus about this. I’ve seldom flashed a BIOS on any machine. This experience with Asus, which should have gone flawlessly because I ain’t a turnip about computers, makes me think their gear is unnecessarily sensitive. Unacceptable for the kind of mainboard they say it is.

Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

Reply | Quote

JohnW wrote:

If you look into the task manager, then click on the performance tab, & look down at the bottom you will see “Open Resource Monitor”.

JohnW – Thank you. Those are exactly the meters I was looking for. Never had to use ’em. But they give me clues on where to look for what. The main drive is an SSD, and one spinner is internal one is external. It’s the spinners which are sucking most of the operations, which is what I wanted to make sure of.

Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

Reply | Quote

Mr. Austin wrote:

Those are exactly the meters I was looking for. Never had to use ’em. But they give me clues on where to look for what.

If you need to drill deeper, Sysinternals Process Explorer (from Microsoft) is a good way to go.

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded.

Windows 10 Pro 22H2

1 user thanked author for this post.

Mr. Austin

Reply | Quote

[Mr. Austin]

TechTango wrote:

the actual ROM re-flash is finalized and it takes a few moments and sometimes another auto restart.

Hey Tech Tango… The machine now boots OK – except – it goes through two separate BIOS screens before booting into Windows.

Are you sure it’s OK to RE-flash a BIOS if the correct version already shows in the BIOS itself? Is that a common practice when something in the BIOS is suspected to be awry?

Long story short, Asus tech is un-reachable because they’re intensely ignorant Chat system thinks I’m providing it the wrong motherboard serial number.  Danke.

 

Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

• This reply was modified 5 years ago by Mr. Austin.
• This reply was modified 5 years ago by Mr. Austin.
• This reply was modified 5 years ago by Mr. Austin.
• This reply was modified 5 years ago by Mr. Austin.

Reply | Quote