windows 8.1 - Win 8.1 High non-paged pool RAM usage

On a spectre x360 laptop w 8GB of RAM running win 8.1, i noticed stuff getting really sluggish.
In task Maanger I could see I was using an obscene amount of RAM (7GB/8GB) but perusing details and soring by Memory desc did not reveal culprit.

After some internet-ing I found that a common issue was non-paged pool size being large where the root cause is possibly a driver memory leak. sure enough, my non-page pool size was 3.2 GB even after restarting.

Under task manager->details, I tried to sort by NP Pool column, but the highest item had only 200k.

At a loss, I decided to try out a much touted solution: the registry modification of clearing the page file at shutdown. open regedit and

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

look for ClearPageFileAtShutDown and set to 1.

After i did this, I rebooted and viola, RAM at idle down to ~2GB.

Can anyone help explain why this works?
Is there a way I can troubleshoot what the original issue was so that I can set this back to 0?

Answer

First, start with poolmon to see which driver is causing the high usage.

Install the Windows WDK, run poolmon ("C:\Program Files (x86)\Windows Kits\8.1\Tools\x64\poolmon.exe"), sort it via P after pool type so that non paged is on top and via B after bytes to see the tag which uses most memory.

Now look which pooltag uses most memory as shown here:

Now open a cmd prompt, go to C:\Windows\System32\Drivers (cd C:\Windows\System32\Drivers) and run the findstr command to see which driver uses this tag:

Now look at the file properties, find the driver version and look for an update.

If the pooltag only shows Windows drivers or is listed in the pooltag.txt ("C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\triage\pooltag.txt")

you have use xperf to trace what causes the usage. Install the WPT from the Windows SDK, open a cmd.exe as admin and run this:

xperf -on PROC_THREAD+LOADER+POOL -stackwalk
PoolAlloc+PoolFree+PoolAllocSession+PoolFreeSession -BufferSize 2048
-MaxFile 1024 -FileMode Circular && timeout -1 && xperf -d C:\pool.etl

capture 30 -60s of the grow. Open the ETL with WPA.exe, add the Pool graphs to the analysis pane.

Put the pooltag column at first place and add the stack column. Now load the symbols inside WPA.exe and expand the stack of the tag that you saw in poolmon.

Now find other 3rd party drivers which you can see in the stack. Here the Thre tag (Thread) is used by AVKCl.exe from G-Data. Look for driver/program updates to fix it.