When the PC freezes, stutters, or displays blue screensThe first thing we think is that Windows is malfunctioning or that some program is causing problems. However, in many cases the real cause lies in the hardware or its drivers, such as the outdated graphics driversAnd that's where the diagnostic tools They make all the difference. Among all the options the system offers, Windows Performance Recorder (WPR) and Windows Performance Analyzer (WPA) They are the most powerful tools for understanding what is happening "inside".
Finding hardware problems using Windows Performance Recorder isn't just for Microsoft engineers. Anyone with a little patience can capture a trace (ETL trace), open it in WPA, and figure out if the problem lies with the CPU, RAM, SSD, a poorly optimized driver, or something else. GPU that gets hot or a device that won't go to sleep. In this article, we'll cover everything: from the signs that indicate hardware failure, to advanced use of WPR/WPA, including the best extra tools to complete the diagnosis and, if necessary, file a warranty claim with supporting evidence.
What is Windows Performance Recorder and how does it help you with your hardware?
Windows Performance Recorder (WPR) is the recording tool in the Windows Performance ToolkitIt is capable of recording almost all system activity in ETL files: CPU, memory, disk, network, drivers, devices, power, sleep states, etc. It can be used both from the graphical interface (WPRUI.exe, included in the Windows ADK) and from the command line (WPR.exe), which comes pre-installed from Windows 8 onwards.
WPR works using recording "profiles," which are predefined sets of ETW events designed to analyze specific types of problems: CPU-intensive use, crashes, disk latency, abnormal power consumption, memory leaks, excessive wait times between threads, or even the system's behavior in modern standby mode (Connected Standby). You can also create custom XML profiles if you need something very specific.
Windows Performance Analyzer (WPA) is the perfect complement. It's a graphical tool that opens ETL traces and displays them in highly detailed graphs and dynamic tables. There you can see CPU peaks per process, I/O delays, device states, thread wait times, memory consumption per call stack, and much more. Ideal for uncovering problematic drivers and hardware components.
Both tools are part of the Windows Performance Toolkit (WPT), available within the Windows Assessment and Deployment Kit (Windows ADK). WPR in console mode is already installed on the system, but to use the WPR and WPA GUIs, you need to install the ADK. And, in the case of WPA, you need .NET Framework 4.5 or higher.
Capture traces with WPR to detect hardware problems
Before you can analyze anything in depth with WPA, you need a good ETL trace, and that means recording at the right time and with the right profile. The advantage of WPR is that you can do this both in a guided way (graphical interface) and fully scriptable with the command line.
To start a recording with the graphical interfaceYou have to do this:
- Search for “Windows Performance Recorder” in the Start menu and open it.
- Click on Start using the default Top-Level Priority Assessment profile, which already serves most scenarios for CPU, memory, disk, and general latencies.
- If you need something more specific, you can expand More options and choose CPU profiles, power usage, memory, etc., as well as adjust the level of detail.
When you work from the console, the control is even greater.For example, if you suspect a power consumption or hardware sleep state problem, you can use the power profile with: wpr -start Power to begin recording and, once the problem has been reproduced (playing a game, launching a heavy app, leaving the system at rest, etc.), run wpr -stop filename.etl to save the tracking. This way of working is ideal if you want to automate captures or if you simply prefer to avoid the GUI.
Advanced use of WPA to analyze the ETL trace
Once you have your ETL file, The focus shifts to Windows Performance AnalyzerWPA opens from the Start menu, but also directly from WPR after recording is complete if you select the "Open in WPA" option. When loading the trace, you will see several docked windows around one or more tabs of Analysis.
The Chart Explorer groups all available charts. For tracking, categorize your data into CPU, memory, disk, network, power, devices, and more. From there, you can drag the charts you're interested in to the Analysis tab, or simply double-click to open them. Each chart comes with an associated data table that functions like a highly flexible pivot table.
WPA data tables are key to isolate hardware problemsThey have "key" columns (to the left of the vertical gold bar), data columns (between the gold and blue bars), and columns that can be used as chart elements (to the right of the blue bar). You can reorder columns, make any field a key, group, sort, and filter, and even define predefined column combinations with the column selector.
In addition, WPA allows you to open multiple independent Analysis tabseach with its own timescale. So you can, for example, have one tab focusing on CPU and memory throughout the entire session, and another focused on a 10-second stretch where a GPU failure or disk bottleneck is suspected.
Diagnose CPU, memory, and disk bottlenecks with WPR/WPA
Many problems that seem "Windows-related" are actually due to excessive CPU, RAM or disk usage caused by a driver, a faulty application, or even a defective hardware component. The infamous "bottlenecks"The appropriate WPR/WPA profiles and graphs allow for fairly accurate location of the source.
To high CPU usageThe default profile or the specific "CPU Usage" profile in WPR is sufficient. In WPA, the key graph is "CPU Usage (Sampled)" or something similar. In the table, using the process and call stack, or the process and threads, as keys helps to see which executable and which function are monopolizing CPU cycles. Sorting by sample count or cumulative time makes it relatively easy to identify the culprit.
When you suspect memory leaks There are several fronts: virtual memory, pool, and heaps. The graphs for “VirtualAlloc Commit Lifetimes”, “Pool Usage”, and “Heap Allocations” show, by type, process, and stack, which component is allocating memory without releasing it.
To slow I/O or disk problems You can combine WPR/WPA with utilities such as CrystalDiskInfoThe trace shows you which processes and access patterns are saturating the drive. CrystalDiskInfo, in turn, tells you if the disk has SMART errors, high temperatures, or reallocated sectors. Combining both sources tells you whether it's a purely software problem or if the hardware is about to fail.
The correlation with the Event Viewer and the Reliability Monitor It's also gold. If, for example, you detect a massive CPU spike associated with a graphics driver just before a "Kernel-Power" event or a critical error, you have a strong candidate for the source of the hardware failure or poor driver-system interaction.
Analyze modern standby and platform states
On modern laptops with connected standby modeOne very common problem is excessive battery drain while the device is “apparently” idle. This is where several WPA-specific graphs come into play, which deserve a separate discussion:
- Platform inactive status.
- DRIPS.
- PDC resistance activity.
- Device Dstate.
The platform's idle state graph reflects the time the SoC spends in each sleep state.Each platform numbers these states in its own way. Therefore, it's advisable to consult the SoC manufacturer's documentation to determine which index corresponds to the deepest low-power state (DRIPS). The important data here is the percentage of time spent in that state: if the DRIPS percentage is above 90%, the battery has a long lifespan; if it remains around 80% or below, something is preventing the platform from "sleeping" properly.
To see this percentage in detail, it is best to open the associated table view.Filter by platform state and display the “% Duration” column. This gives you a quick overview of how long the system has spent in each sleep level and whether the DRIPS deep state is receiving the attention it deserves during modern standby sessions.
The DRIPS chart, meanwhile, lists which components are active Throughout the monitoring process: PDC triggers, devices, and CPU activity. This reveals who is maintaining power references and who is cutting off DRIPS. Triggers (BI, WNS, NCSI, image download managers, etc.) should operate in short bursts; if one remains active for an extended period, it disrupts deep sleep and becomes the prime suspect.
Devices, D states and correlation with SleepStudy
In addition to software activators, Physical devices also have their own energy statesThese states are typically labeled D0 to D3, where D0 represents maximum performance and D3 represents shutdown or deep sleep. Low-power states within the SoC are usually defined by the manufacturer, while those of external devices tend to be standardized by class.
The Device Dstate graph of the modern standby profile in WPA It focuses precisely on those devices that, according to the Platform Energy Engine (PEP), can block the SoC's DRIPS state. If you see, for example, that the Wi-Fi adapter, a USB controller If a PCIe controller spends a lot of time in D0 when it should be sleeping, you have a candidate for draining the battery or generating constant interruptions.
SleepStudy, Windows' modern standby energy report, is a great complement to WPA. In fact, there is a Direct correlation between SleepStudy fields and WPA graphs:
- “Triggers” in the report correspond to the PDC resistance activity graph.
- “Processors” with the CPU idle state graph.
- “Fx Devices” with Device Dstate.
- “PDC Phases” with the PDC notification phase chart.
- Network information can appear in PDC activity, Device Dstate, or generic network events.
The mapping table between SleepStudy and WPA is very useful when you want validate a hardware problemFor example, if SleepStudy indicates that a certain network adapter has been very active during a session, in WPA you can access the Device Dstate graph, locate that adapter and see when it has been active, in what D state and under what conditions, cross-referencing it with other CPU or DRIPS graphs.
Mastering the WPA interface: tables, view profiles, and filters
WPA is not just a pretty graphics viewer, it's a very powerful data analysis toolThat's why it's worth investing a few minutes in adapting the interface to your way of working and making the most of its pivot tables, filters, and view profiles.
Each chart offers three view modes:
- Graphics only.
- Data table only.
- Graph + table.
Using the design icons to the right of the title bar, you can switch between these views as needed. For serious hardware analysis, combining a graph and a table in the same tab is usually the most convenient approach.
Tables allow you to customize columns and layouts, while Selection filters make it easier to focus only on what's important.If you select one or more rows in the table and use the "Filter to selection" option, WPA hides everything else. This, combined with highlighting a specific time range, allows you to study a single process or device in detail during the exact phase in which you suspect the problem.
To avoid repeating the work each time, you can create and export view profiles From the Profiles menu. Once you have a convenient profile for analyzing CPU and memory, another for power and device status, and another for memory leaks, you can save and apply them to new traces with a single click. You can even set a startup profile so that WPA always opens with your preferred distribution.
Native Windows tools to complete the diagnosis
WPR and WPA are the heavyweights of the analysis, but they're not alone. Windows comes with a host of built-in utilities that work very well with these traces and help you confirm or rule out hardware problems without installing anything else.
- El Performance monitor (PerfMon) It allows you to monitor live CPU, memory, disk, network, and many other specific counters. It's ideal for detecting anomalous patterns before launching a WPR capture. From it, you can create Data Collector Sets that continuously record counters. If something goes wrong, you'll already have data to cross-reference with the traces.
- The Resource MonitorFor its part, it offers a more user-friendly view of which processes are using up CPU, disk, network, or memory. If your PC is running slowly, simply open it and see which executable is consuming the resources.
- The Windows Memory Diagnostic tool It starts before the operating system and puts the RAM through an intensive test. This is very useful when you're experiencing random crashes, blue screen errors, or data corruption that could be caused by faulty RAM modules. Once the test is complete, Windows will tell you if any errors were found. If the answer is yes, it's time to consider replacing the modules.
- The Event Viewer and Reliability Monitor complete the circleThe first logs every hardware and software incident (disks, controllers, unexpected shutdowns, etc.), while the second provides a timeline scoring system stability and highlighting critical errors.
Apply stress tests and third-party tools
There are times when hardware only fails "when it is pushed." A GPU that handles the desktop but crashes when launching a game, a CPU that performs perfectly for light tasks but can't handle Prime95, or an SSD that works... until you subject it to intensive write operations. For these kinds of cases, stress tests are essential.
- Prime95 is a classic for stress testing CPUs and RAM.By setting up the Blend test, you can push the processor and memory almost to their limits, while monitoring temperatures with HWMonitor or similar tools and capturing traces with WPR to see what's happening internally.
- FurMark or GpuTest perform a similar role with the GPUThis tests push the graphics card to very high temperatures. If artifacts, screen freezes, driver crashes, or sudden shutdowns appear during these tests, the graphics hardware or its power supply is likely faulty. WPR/WPA can also help determine if the GPU is generating excessive interrupts or causing PCIe bus saturation.
- Memtest86, CrystalDiskInfo, HWiNFO, HWMonitor, CPU-Z and GPU-Z They complete the battery of external tools: the first ones focus on the health of RAM and disks (including SMART values, temperature and errors), while HWiNFO and HWMonitor allow monitoring of sensors throughout the system (voltages, fan RPM, temperatures).
From test to report: how to use WPR/WPA to claim warranty
Detecting a hardware failure is good, but often you need to prove it. to a manufacturer or a technical service so they will accept the repair or replacement under warranty. This is where all the information gathered with WPR/WPA and the other tools becomes ammunition.
The first is clearly identify the critical indicators: recurring blue screens with error codes related to memory, disk or power; sudden shutdowns under load; strange noises from fans or disks; temperatures that spike even with normal tasks; SMART errors on the storage drive.
From there, it is advisable generate a small technical “dossier”A good minimum package usually includes: Reliability Monitor reports (screenshots showing dates and types of failure), a DxDiag file saved in text with hardware and driver information, HWMonitor or HWiNFO screenshots showing abnormal temperatures or voltages, Memtest86 or CrystalDiskInfo results, and of course one or more ETL traces analyzed with WPA, where the abnormal behavior is objectively shown.
WPA is highly recommended note down the methodology: what WPR profile was used, what time period the trace covers, what exactly was done (playing games, rendering, leaving the computer in modern standby, etc.), what graphs were analyzed, and what specific values indicate the problem (for example, a device blocking DRIPS 80% of the time or a driver constantly consuming CPU).
With all those documented and chronologically ordered dataThe conversation with the manufacturer changes completely. It's no longer about "my PC is malfunctioning," but about "this RAM module is generating errors in Memtest86, this SSD is in an orange health state, and this CPU trace shows a freeze even without user load," something much harder to ignore or attribute to a simple software bug.