What is this vmmem program that is using up all my CPU and memory?

Say you're minding your own business and you discover that this process called vmmem is using up all your memory and CPU. What is this guy and how do you make him stop?

The vmmem process is a virtual process that the system synthesizes to represent the memory and CPU resources consumed by your virtual machines. In other words, if you see vmmem consuming a lot of memory and CPU resources, then that means your virtual machines are consuming a lot of memory and CPU resources.

If you want to make it stop, shut down your virtual machines.

Bonus chatter: Strictly speaking, what it actually represents is the resources of the other virtual machines, since Windows itself is running in a virtual machine under the hypervisor. You may not be explicitly using the hypervisor, but some other features are built on top of the hypervisor.

Comments (7)
  1. Pepito de los palotes says:

    You mean Hyper-V virtual machines, right?

    1. I believe you are right. The bonus chatter hints about a bare-metal hypervisor. Hyper-V is the only one Microsoft has ever made. And since a Microsoft employee has written this, it is definitely about a Microsoft product. (Bonus chatter: This principle does not always hold about other company employees, even those whose competing products sell much stronger than Microsoft’s.)

  2. Joshua says:

    I suppose there’s no point killing vmmem.

    1. That would be like killing the “Idle cpu time” process

  3. Kazi says:

    As I can see in host’s task manager, CPU usage is assigned to vmmem, but RAM consumption is assigned to vmwp.exe. It doesn’t make sense for me. Why two processes per VM? One would be ideal, no?

    1. VMWP.EXE is a real process.

  4. Jonathan says:

    On my machine, I see a vmmem process consuming lots of memory (1.4GB private bytes, 350MB working set), but I have no Hyper-V machines running. The process runs as “NT VIRTUAL MACHINE\{some guid}” user. I even deleted all my Hyper-V machines – still vmmem remains.

    I presume it’s some implicit VM, like Windows Defender Application Guard uses to run Edge (and office?) – how can I determine that?

Comments are closed.

Skip to main content