perfmon.exe

Windows ProcessMicrosoft Corporation

Also called perfmon, performance monitor, perfmon.msc, reliability monitor

WindowsSystem Component

Performance Monitor. It launches the MMC performance snap-in (perfmon). It is not Task Manager.

What you need to know

perfmon is Performance Monitor, not Task Manager.

perfmon.exe starts Performance Monitor, the counter and Data Collector Set console (MMC). taskmgr.exe is Task Manager's live process list. Ending perfmon does not close Task Manager. WmiApSrv may start if you ask for WMI-backed counters.

Safe?: Yes, in System32
Same as Task Manager?: No. This is Performance Monitor
Can I end it?: The MMC / perfmon window closes

Feex says

If I want counters and logs, I open perfmon. I do not treat Task Manager's Performance tab as this snap-in, and I do not end taskmgr to close Performance Monitor.

What is perfmon.exe?

perfmon is Performance Monitor, not Task Manager. This launcher opens the performance snap-in. taskmgr.exe is the Ctrl+Shift+Esc window. mmc.exe may appear as the console host beside it.

What does it do?

It opens counters, reports, and collector sets. It does not end processes (Task Manager) and it does not replace msconfig.

Why is it running?

You ran perfmon, Reliability Monitor, or a shortcut to a Data Collector Set. A leftover copy means the console is still open.

Is it safe?

Usually safe

System32 perfmon.exe is Microsoft. A perfmon.exe in Downloads is not. This is still not taskmgr.exe.

A legitimate copy normally runs from:

C:\Windows\System32\perfmon.exe

Performance Monitor launcher
Live process list: taskmgr.exe
Console host may also show mmc.exe

Can I end it?

Closes Performance Monitor

Ending perfmon.exe closes that console. Task Manager stays. Collector sets already saved can keep running as scheduled tasks, which is not taskmgr.

Can I remove it?

Do not delete perfmon.exe. Stop a Data Collector Set from the snap-in if that was the goal. Do not delete System32\taskmgr.exe.

Should it start with Windows?

You launch it, or a scheduled collector does. Task Manager Startup apps are a different list.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Follows the sample interval and counter count
Memory: Moderate for a busy MMC log
Disk: BLG / report files if you log
Network: Remote counters if you pointed at another PC

File information

perfmon.exe file information
Executable name	perfmon.exe
Common legitimate path	C:\Windows\System32\perfmon.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

People end taskmgr thinking they stopped a collector

Data Collector Sets live under Performance Monitor. Task Manager is only the live view. Open perfmon to stop the log.

WmiApSrv appears and they reset WMI

A WMI-backed counter can start the performance adapter. That is expected. This exe is still Performance Monitor, not Task Manager.

Troubleshooting

Diagnose before you change anything destructive.

perfmon /rel versus Ctrl+Shift+Esc

Reliability Monitor is this stack. Task Manager is taskmgr.exe. Use the window you actually wanted.

Stop Data Collector Sets in the snap-in, do not delete Task Manager

Scheduled logs survive closing the UI. Leave System32\perfmon.exe and taskmgr.exe in place.

Technical details

perfmon.exe technical details
Image name	perfmon.exe
Role	Performance Monitor launcher

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: perfmon · Performance Monitor command
Microsoft Learn: Windows Performance Monitor · MMC snap-in for counters and Data Collector Sets, not Task Manager
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.