Find Out Which Process Is Keeping the Disk Busy

Queue length and response time say whether the disk is saturated. A high queue with low throughput is a slow disk, not a busy one.

Get-Counter '\PhysicalDisk(*)\% Disk Time','\PhysicalDisk(*)\Avg. Disk Queue Length','\PhysicalDisk(*)\Avg. Disk sec/Transfer' -SampleInterval 1 -MaxSamples 3 | Select-Object -ExpandProperty CounterSamples | Select-Object InstanceName,Path,CookedValue
Get-PhysicalDisk | Select-Object FriendlyName,MediaType,HealthStatus,Size

**Get-Process** with the read and write counters shows the top talkers per process, which is the fastest way to spot a runaway indexer or an antivirus scan.

Get-Process | Sort-Object -Property @{e={$_.ReadOperationCount}} -Descending | Select-Object -First 10 Name,Id,@{n='ReadMB';e={[math]::Round($_.ReadTransferCount/1MB)}},@{n='WriteMB';e={[math]::Round($_.WriteTransferCount/1MB)}}

The Disk tab lists every file with its read and write rate and the owning process. That is the bridge from a busy disk to an actual path.

resmon.exe
# Disk tab > Disk Activity > sort by Total (B/sec)
# read the File column and the Image column
Get-CimInstance Win32_Process | Where-Object Name -match 'SearchIndexer|MsMpEng|svchost' | Select-Object Name,ProcessId,CommandLine

Windows Search, Defender, the update service and a backup tool cause most sustained I/O. Each has its own state and its own schedule.

Get-Service WSearch,WinDefend,wuauserv | Select-Object Name,Status,StartType
Get-ScheduledTask | Where-Object TaskName -match 'Defrag|Backup|Scan' | Select-Object TaskName,State,@{n='Last';e={($_ | Get-ScheduledTaskInfo).LastRunTime}}
Get-MpComputerStatus | Select-Object QuickScanStartTime,FullScanStartTime,RealTimeScanDirection

A busy disk at 03:00 is maintenance; at 10:00 it is a problem. Matching the counters with the task schedule turns the observation into a cause.

Get-WinEvent -LogName System -MaxEvents 50 | Where-Object Id -in 1,2,3 | Select-Object TimeCreated,Id,ProviderName -First 5
Get-ScheduledTask -TaskName 'ScheduledDefrag' -ErrorAction SilentlyContinue | Get-ScheduledTaskInfo | Select-Object LastRunTime,NextRunTime,LastTaskResult
powercfg /getactivescheme

Move the maintenance window, pause the indexer for a folder, or limit the backup's throughput. Killing the service is a test, not a solution.

Get-ScheduledTask -TaskName 'ScheduledDefrag' | Disable-ScheduledTask
Get-Service WSearch | Stop-Service
Get-Service WSearch | Start-Service
Get-Counter '\PhysicalDisk(*)\Avg. Disk Queue Length' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object InstanceName,CookedValue