SLAC logo

Performance Tuning Windows NT

22 April 2003

SLAC Home NT Home System Administration

Written by Scott B. Suhy, Consultant with Microsoft Consulting Services, responsible for enterprise architecture, design, and optimization for Fortune 500 companies.   Email



Would it not be nice if there were no traffic bottlenecks during your everyday task of going to work? No traffic lights, fender benders, car problems, detours, people pulling out in front of you, people in the left hand lane going less than the speed limit, four lane highways narrowing down to two lanes.... This is rather unrealistic, just like with a computer system it is unrealistic to expect at some point in time there will not be a limit to the amount of memory, CPU, or I/O being consumed by internal or external processes.

You might also say that it might be nice to know how long it was going to take you to get to work in the morning (with some expected normal variation). Users of a computer system have the same expectation. They expect their jobs to finish in an acceptable amount of time without bottlenecks in the system slowing them down.

If there were bottlenecks on your way to work each day, I suppose you could optimize or tune the trip (reduce bottlenecks) by possibly finding an alternate route, car pooling, taking advantage of a car pool lane, taking a bus, or even changing your working hours (possibly to the evening when there is no traffic and the only thing keeping you from getting to work any faster is the speed limit and possibly the size of your engine). Computer systems have the same optimizations (run jobs during off peak hours, etc.). As with transportation systems, there is also the same lack of environmental control with a computer system. For example, it is not realistic to think that there will always be the same amount of traffic (on the road or in your computer system), it's also not realistic to think that you have control over the traffic (on the road or in your computer system). Problems always occur (a rain storm causing increased slowdowns on the road or one user consuming a great deal of the bandwidth of the server's memory, CPU, or I/O). Managing, as well as expecting, the problems, and knowing what to do when they occur is the key.

Once you feel you have the trip optimized, you might also think about taking some statistics, daily, weekly, or monthly, such as the amount of time it takes you to arrive at the office, number of red lights you got rather than green, and so on. This type of information will allow you to make future decisions on such things as "If I stop to get gas in the morning, how much earlier will I have to leave the house?" Of course you would also have to know how much time it would take you at the gas station (another set of statistics). The same thing goes for your computer system. It's called Capacity Planning.

The following information provides you with tips on areas of the Microsoft® Windows NT™ operating system in which you should pay attention (What to Watch). It also gives you a few rules/guidelines to use to optimize the system (What You Can Do). Once you take each of these areas into consideration, your system should be optimized. Once you feel your system is optimized it is then time to gather data on current capacity. The data will allow you to do the following:

This information is rather technical in nature and assumes that you already know a great deal about Microsoft Windows NT™ Workstation and Microsoft Windows NT Server operating systems. However, it only touches the surface of optimization. Many books could be written on the subject. Consequently, this paper neglects to explain many details and assumes you know where to get information about the hardware and software concepts mentioned. If you stumble upon a concept that is not explained in detail, you may want to refer to the Microsoft Windows NT Resource Kit, Server Message Block specification (which can be obtained from Microsoft), Microsoft TechNet, or any book that details network architecture (such as the book Local Area Networks by James Martin or LAN Times Encyclopedia of Networking by Tom Sheldon).


Before diving into any Performance Tuning, it is necessary to go over some definitions and terms.


For the purpose of this paper, I refer to the word task as a series of computer instructions, the execution of which involves work to be performed by one or more computer components or resources (for example, CPU, memory, hard disk, and network adapters).

The amount of time it takes to complete a task can be divided up among the several resources that are involved in the task's execution-some resources will be responsible for small amounts of the total time, others will be responsible for larger amounts.


The single resource that consumes the most time during a task's execution is that task's bottleneck. Bottlenecks can occur because resources are not being used efficiently, resources are not being used fairly, or a resource is too slow or too small. Let me try to elaborate on this point with the following example.

Example.If a task takes 2.2 seconds to complete, with .2 seconds spent executing instructions in the CPU and 2 seconds retrieving data from the disk (assuming both are not overlapping in time), the disk is the bottleneck in the task. If the CPU were replaced with one twice as fast, task execution time would drop from 2.2 to 2.1 seconds. This would be approximately a 4.5% increase in productivity. However, if the disk controller were replaced with one twice as fast, it would drop the disk access time from 2 seconds to 1 second, dropping the total execution time from 2.2 to 1.2 seconds. This would be approximately a 45% increase in productivity.

It would be easy if the previous example were on a workstation running the Microsoft MS-DOS® operating system, but we are dealing with a multitasking OS. One thing to always keep in mind, especially in a multitasking OS, is that resolving one bottleneck will always lead to the next one.

Windows NT System Tuning

The goal in tuning Windows NT is to determine what hardware resource is experiencing the greatest demand (bottleneck), and then adjusting the operation to relieve that demand and maximize total throughput. A system should be structured so that its resources are used efficiently and distributed fairly among the users. This is not as difficult as it sounds, assuming you use a few good rules/guidelines and have a thorough understanding of the computing environment. For example, in a file and print server environment, most of the activity at the server is in support of file and print services. This tends to cause high disk utilization because of the large number of files being opened and closed. It also causes the network interface card(s) to endure a heavy load because of the large amount of data that is being transferred. Memory typically does not get a heavy load in this environment (memory usage however can be heavy due to the large amount of system memory that may be allocated to file system cache). Processor utilization is also typically low in this environment. In contrast, a server application environment (for example, other Microsoft BackOffice products such as Microsoft SQL Server™ database server for PC networks, Microsoft Mail electronic mail system, Microsoft Systems Management Server centralized management for distributed systems, and Microsoft SNA Server) is much more processor and memory bound than a typical file and print server environment because much more actual processing is taking place at the server. The disk and network tend to be less utilized, due to a smaller amount of data being sent over the wire and to the disk. Understanding these generalizations is not enough; the only way to get an idea of the utilization of the resources is to monitor them, and one of the most powerful tools that you can use is the Windows NT Performance Monitor.

Performance Monitor is a graphical tool for measuring the performance of your own Windows NT-based computer or other Windows NT-based computers on a network. It is located in the Administrative Tools group of both the Windows NT Workstation and Windows NT Server products. On each computer, you can view the behavior of objects such as processors, memory, cache, threads, and processes. Each of these objects has an associated set of counters that provide information on such things as device usage, queue lengths, and delays, as well as information used for throughput and internal congestion measurements. It provides charting, alerting, and reporting capabilities that reflect current activity along with ongoing logging. You can also open log files at a later time for browsing and charting as if they were reflecting current activity.

Before spending money to add more hardware or replace existing hardware with faster, it's best to use Performance Monitor to first tune the system to make the most efficient use of existing resources. Here are a couple of examples of where the tool may be useful:

Example. If we find that the CPU is 100% utilized, before replacing it with a faster CPU or adding another one, we should identify and analyze the process that is utilizing the bulk of the CPU time. We may find that the processor cycles are being consumed by a disk controller requiring PIO. In this case a DMA disk controller will then reduce processor utilization.

Example. If we determine the hard disk is full, before adding additional disk drives, identify how much of the page file is being utilized. You may find that the system page file size is initialized at 100 MB, but there is never more than 40 MB of it being used. Instead of purchasing another disk, we could adjust the size of the page file.

Typical Questions

If you talk to our product support engineers or our consultants in the field and ask them about the tuning questions they most frequently hear, you may find the following:

  • How do I determine how well an application is performing?
  • How can I support my environment in a proactive manner?
  • How do I know what component of my system is the most limiting (the bottleneck)?
  • How can I ensure my system is performing the best it possibly can perform?
  • How do I determine what size system I need based on the following criteria?
  • How do I know when to upgrade?
  • All of these questions play some part in performance tuning. We are going to focus mostly on answering questions 2, 3, and 4, primarily by focusing our attention on exploring each of the primary components of a computer system-the memory, processor, and the I/O subsystem (e.g., disks and networks). From this standpoint, performance tuning means ensuring that every user gets a fair share of available resources of the entire system. Once you feel you have 2, 3, and 4 under control, you can start focusing on 5 and 6, which are more capacity planning issues. Once you have 5 and 6 under control, you will be able to answer number 1, and more important, do "What If" analysis.

    Tuning for "Memory" Performance

    Lack of memory is by far the most common cause of serious performance problems in computer systems. If you read no further in this document you could just answer by saying "Memory!", if anyone ever asks you how to improve the performance of a system.

    Memory contention arises when the memory requirements of the active processes exceed the physical memory available on the system; at this point, the system is out of memory. To handle this lack of memory the system starts paging (moving portions of active processes to disk in order to reclaim physical memory). At this point, performance decreases dramatically. Consider the following example. If the average instruction in a computer takes approximately 100 nanoseconds to execute and disk access takes somewhere on the order of 10s of milliseconds, how many times slower would the machine run, if there were 1 paging operation per instruction? If you answered 100,000 you would be correct! Let's hope things don't get that bad....

    To optimize overall performance, steps must be taken to ensure that main memory is used as efficiently as possible and thus paging is held to a minimum. As you will see in the next section, you can tell how loaded system memory is by watching how the system pages.

    What to Watch

    img00002.gif (27828 bytes)

    What You Can Do

    Tuning for "Processor" Performance

    A processor (running at a given clock speed) can execute a set number of instructions per second. Therefore, if a processor is switched among multiple threads that all have work to do, a given thread will take x (x being the number of simultaneously executing threads) times longer to complete a given task.

    There are times when a thread has no work to do, such as when waiting for user input, or when waiting for another thread to finish a related operation. As long as the thread is in this waiting state, it will not be scheduled for execution and, thus, does not take up any CPU time. Since most Microsoft Windows®-type applications spend a considerable amount of time with their threads in this waiting state, there may be little performance degradation when running multiple Windows-based applications.

    Some applications are considered CPU intensive. A CPU-intensive application almost always has work to do and spends very little, if any, time in the waiting state. For example, the following C program consumes 100% of the CPU. When additional applications are started, their performance, and that of the CPU-intensive application, will be less than optimal since all must share the processor's time. This is an example of how NOT to write an application; a better approach would be to create an event or wait on a semaphore.




    The figure below shows the application's utilization of the CPU.

    img00003.gif (15226 bytes)

    What to Watch

    If the "Processor % Processor Time" counter consistently registers at or near 100%, the processor may be the bottleneck. ('System % Total processor time" can be viewed for multiprocessor systems.) If this occurs you need to determine WHO or WHAT is consuming the CPU. To determine which process is using up most of the CPU's time, monitor the "Process objects % Processor Time" for all of the process instances (as in the previous figure).

    What You Can Do

    img00004.gif (6196 bytes)

    Use this dialog box to change the relative responsiveness of applications that are running at the same time. When more than one application is running in Windows NT, by default the foreground application receives more processor time, and so responds better, than applications running in the background. (You can also use the Windows NT SDK utility PVIEW to set individual application priorities.)

    You may also use the START command to alter the priority of a program as it is started. This command can take /low, /normal, /high, and /realtime switches to start programs with varying levels of priority.

    Gotcha. Never start processor-bound applications at real-time priority.

    Considerations for 16-Bit Applications

    Tuning for "Disk" Performance

    As you might have guessed, disk performance is the single most important aspect of I/O performance. It affects many other aspects of system performance. Good disk performance enhances virtual memory performance and reduces the elapsed time required to load programs that perform a great deal of I/O, and so on.

    If you discover a disk bottleneck, the first thing you need to determine is whether it's really more memory that you need. If you are short on memory, you will see the lost performance reflected as a disk bottleneck.

    Gotcha. Because disk counters can increase disk access time by approximately 1.5% on a 386/20, Windows NT does not automatically activate these counters at system startup. To activate disk counters, type diskperf -y at the command prompt and restart the computer. On a 486 or better system, the hit is not apparent.

    What to Watch

    img00005.gif (16212 bytes)

    What You Can Do

    Tuning for "Network" Performance

    Network performance problems can have basically three forms, each of which cause the network protocol to have to transmit each block of data many times (or error out) causing performance problems.


    The Windows NT Server service's responsibility is to establish sessions with remote stations and receive SMB (Server Message Block) request messages from those stations. (SMB requests are typically used to request the Server service perform I/O-such as open, read, or write on a device or file located on the Windows NT Server station).

    Workstation (Redirector)

    When applications or users issue Connect, Open, Read, or Write requests on path-names that reference a redirected drive (net use z: \\server\share), the request is forwarded to the local Windows NT redirector. The redirector then packages up the request and forwards it down to the transport (TCP/IP, NBF, or NWLINK) and out onto the wire to be picked up by a server. So, as you can see, a great deal of the redirector's network performance is tied directly to how well the server responds to its requests. However, there are a few issues to be aware of on the redirector side.


    One of the primary jobs of Netlogon is to keep the user account database in sync on all of the backup domain controllers with the primary domain controller.

    Transport (NBF, TCP/IP, NWLink, and so on)

    The transport drivers function is to transport network data submitted by applications (such as the redirector, e-mail, Microsoft SQL Server, and so on) to other network stations. Windows NT ships with a variety of transport drivers such as TCP/IP, NBF (NetBEUI), and NWLink. All of these transports export a TDI interface on top and an NDIS (Network Driver Interface Specification) on the bottom. (Windows NT also ships with AppleTalk and DLC, however, these do not have a TDI interface.)

    Physical (Network Adapter)

    Capacity Planning

    Now that you have your system optimized to where you are very comfortable with its performance (today), it's time to start collecting data that will help you in the future. The following counters are a good starting point for resource capacity planning:

    Object >Counter(s) Processor % Processor Time, Interrupts/sec

    MemoryPages/sec, Cache Faults/sec, Available Pages, Commit Limit, Committed Bytes

    Paging File Usage Peak

    Physical Disk % Disk Time, Avg. Disk Seconds/Transfer

    Logical Disk % Free Space

    Redirector Bytes Total/sec, Current Commands

    Server Bytes Total/sec, Server Sessions, Pool Paged Peak, Pool Nonpaged Peak, Work Item Shortages

    There is a new service included in the Windows NT Resource kit called DATALOG.EXE. It will allow you to capture the data and forward it to a data store where it can be gathered up later to be used for trend analysis.

    Once you have identified your system's thresholds based on the data, you will probably want to set up Performance Monitor Alerts. For example, you may want to set an alert on the "Physical Disk Free Megabytes" on your file server's logical drives if it hits a certain threshold, "Paging File % Usage" if it hits 80 or 90%, and "Redirector NetworkErrors/sec."

    There is a great deal more information about Capacity Planning, and the issues surrounding it, in the Windows NT Resource Kit volume 3 by Russ Blake. It details issues relating to Log concentration and Archiving as well as other important details.


    The motivation behind system tuning is to get the most you can out of the hardware you already own. If you decide that an upgrade is your only solution, you will find that your investment in performance tuning pays off. Your work will show you how the system should be upgraded. If you have done your homework, you will know whether you need more memory, faster disks, or a completely new processor. However, if you recorded your system's performance history, you not only did your homework, but you've studied enough to pass the test because now you can tell about latent demand and system growth.


    Software Companies You May Want to Investigate



    © 1995 Microsoft Corporation.




    Owner: Ilse Vinson & Desktop-Admin