Guided path: Memory deep dive
Step 1 of 6
Memory management
Virtual address spaces, paging, working sets, and how Windows tracks memory.
In 30 seconds
Virtual address space is carved into regions (VADs); physical RAM holds working sets while the pagefile backs evicted private pages.
You understand this if…
- ✓You can separate commit charge from physical RAM usage.
- ✓You know what triggers a hard page fault vs a soft fault.
Related labs
Hands-on exercises for this area — in the browser or on a Windows machine.
View all labsOfficial Microsoft docs
Closest official references related to this topic on Microsoft Learn.
Why it matters
Windows memory behavior explains crashes, slowdowns, isolation, and why one process cannot simply read another process' memory safely.
Mental model
Programs do not work with raw RAM addresses. They work in virtual address spaces that Windows maps, protects, and pages in or out.
Schematic
User VA space
Application allocations, heaps, stacks, mapped files, and loaded modules all appear here as virtual ranges.
Windows building blocks
Names and paths you can look for in Task Manager, Explorer, or documentation.
- Filepagefile.sys
Volume root
Backing store for evicted private pages
Go one level deeper
Extra detail for readers who want more precision before opening a child topic.
- Commit charge tracks promised virtual memory; physical RAM usage is a separate constraint.
- Superfetch (SysMain) and the file cache compete with process working sets for RAM.
How it works
- 1Each process gets its own virtual address space.
- 2Windows tracks mappings and protections for those regions.
- 3The Memory Manager decides what stays resident and what can be paged out.
Key terms
- Virtual address space
- The private logical address map a process uses.
- Working set
- The set of pages currently resident in physical memory for a process.
- Page file
- Disk-backed storage used when memory content is paged out.
A browser with many tabs
Each process sees what looks like a large private memory space, but Windows maps only the pages actually needed right now.
Common misconception
Virtual memory is not fake memory. It is the abstraction that lets Windows isolate, protect, and efficiently manage real physical memory.
Guided exercise
Use this topic to move from theory into practice.
- 1Open Memory metrics lab and switch between the three scenarios.
- 2For each, explain why working set can be lower than commit.
- 3On Windows, open Task Manager → Details and add Working set and Commit size columns.
Go deeper
VAD tree
How Windows tracks ranges of virtual memory for a process.
Pool & heap
Kernel pool tags and user-mode heaps as different allocation worlds.
Paging & page faults
How Windows brings pages in from disk and when the page file is used.
Working set & trimming
Which pages stay resident for a process and how Windows reclaims memory under pressure.
You should read next
Ranked from your current topic, related links, branch depth, and any active guided path.
intermediate
VAD tree
How Windows tracks ranges of virtual memory for a process.
Next step in your guided path
intermediate
Paging & page faults
How Windows brings pages in from disk and when the page file is used.
Go deeper in this branch
intermediate
Working set & trimming
Which pages stay resident for a process and how Windows reclaims memory under pressure.
Go deeper in this branch
Related topics
VAD tree
How Windows tracks ranges of virtual memory for a process.
Paging & page faults
How Windows brings pages in from disk and when the page file is used.
Working set & trimming
Which pages stay resident for a process and how Windows reclaims memory under pressure.
Processes & threads
How Windows represents work, isolates applications, and schedules execution.
Executive & subsystems
Core OS services and the user-mode environments that sit on top of them.