SOLVED: What is The Windows PagePool & NonPagePool

It is not uncommon for users and even newbie techs to think that files are on your computers’ hard drive are being processed directly by the CPU, but they are not. The CPU cannot work on files from hard drive, because it is far too slow. To manipulate files, the CPU requests them to be moved into RAM (memory).

Because your computer RAM (memory) is always many times smaller than the capacity of your hard drive storage, files get moved in and out of memory. This process is called “paging”.

However, we also have to consider the operating system itself. When a computer boots up, it needs to “page” files required for the OS to run, into memory and most of those files (i.e your keyboard driver) need to stay in memory the entire time the computer is running.

As you might expect, this results in two categories of memory paging:

1. Paged Pool: This is the portion of system memory that can be paged, or written, to disk when not in use. This allows the system to free up physical memory for other processes. The handles for kernel objects are stored in the paged pool, so the number of handles you can create is based on available memory.
2. Non-Paged Pool: This is the portion of system memory that must stay in physical memory and cannot be written to disk. This type of memory is used for data that might be accessed when the system can’t handle page faults, such as when it executes interrupt service routines (ISRs) and deferred procedure calls (DPCs), which are functions related to hardware interrupts.

---

---

The Windows kernel’s pool manager operates in “kernel mode“, using regions of the system’s virtual address space for the memory it sub-allocates. The pool manager operates similarly to the C-runtime and Windows heap managers that execute within user-mode processes.

Note that managing these resources is handled by the Windows Operating System so manual intervention is typically not necessary unless diagnosing specific system issues.

---