This PowerShell script (Watch-TopWriteIO.ps1) helps administrators monitor the top processes writing to disk in real time. It displays output in the console and can optionally log results to a CSV file for later analysis.
Requirements
- Windows Server 2016 or newer (also works on Windows 10/11)
- PowerShell 5.1+
- Administrator privileges (for performance counters)
What the Script Does
- Collects live disk write I/O from running processes
- Sorts by bytes written per second
- Displays the top X processes
- Optionally logs data to CSV with timestamp
- Supports refresh interval, screen clearing, and logging options
Parameters
| Parameter | Description |
|---|
-RefreshSeconds | Refresh rate in seconds (default: 10) |
-Clear | Clears the console between each output |
-Log | Enables CSV logging (appends to file) |
-FilePath | CSV log file path (default: working directory) |
-Top | Number of top processes to display and log (default: 10) |
Example Usage
.\Watch-TopWriteIO.ps1
.\Watch-TopWriteIO.ps1 -Top 20 -Clear
.\Watch-TopWriteIO.ps1 -Log -FilePath "C:\Logs\IO-Monitor.csv"
CSV Logging Behavior
- If the file doesn't exist, it creates one with headers.
- If the file exists, it appends new rows.
- Each row includes
Process, WriteIO_BytesPerSec, and Timestamp. - Timestamp format:
yyyy/MM/dd HH:mm:ss
Notes
- Processes may appear with suffixes (e.g.
chrome#1) due to multiple instances. - Script uses
Get-Counter, which is more consistent than Get-Process on Server versions. - Ideal for diagnosing FSLogix or RDS disk I/O issues.
Troubleshooting
| Issue | Solution |
|---|
| "Access Denied" or no output | Run PowerShell as Administrator |
| No visible output | Verify Performance Logs and Alerts service is running |
| Missing expected processes | Try increasing -Top or check if process is actively writing |
