PowerShell script to get performance counter data from Windows

1. Get all available counter sets

Execute the following script through Hexnode UEM to retrieve a complete list of available performance counter sets from the target Windows device.

How the script works:

When to use the script:

PowerShell script to get all available counter sets script helps administrators identify which sets correspond to the system components they want to monitor and determine the appropriate counter paths to use when collecting performance data. For example, they can examine the listed sets to find counters related to processor, memory, or network activity.

2. Fetch specific performance metrics

Deploy the following script via Hexnode UEM to retrieve performance counter data for a specific metric path obtained from the .PathsWithInstances property of the Get-Counter -ListSet command.

Syntax:

How the script works:

When to use the script:

Admins can deploy this script to troubleshoot device issues like app freezes, slow storage drives, or unresponsive applications. Querying a specific metric returns only the required data, reducing the overhead of querying entire counter categories and filtering out telemetry noise so administrators can isolate specific performance issues.

Example:

The following script retrieves the NTFS performance counter for operations taking longer than 30 seconds, helping administrators investigate slow file-saving operations or disk freezes on a managed Windows device:

How to read the output:

The numeric value shown beneath the CounterSamples field indicates the number of cluster allocation requests on drive C: that took longer than 30 seconds. 0 means no requests exceeded this duration, while 1 or higher indicates that one or more requests took longer than 30 seconds to complete.

3. Fetch specific performance metrics over a time interval

Execute the following PowerShell script through Hexnode UEM to get specific performance counter data at regular, repeating intervals.

Syntax:

How the script works:

When to use the script:

Admins can deploy this script to investigate issues such as CPU usage spikes, memory usage fluctuations, slow disk operations, or sudden changes in network activity. Collecting multiple samples at regular intervals helps admins to determine whether these changes are momentary or systemic on a managed Windows device.

Example:

The following script collects three samples of the specified NTFS performance counter at two-second intervals to check whether long-running disk operations continue across multiple readings. Sampling completes automatically once all three samples have been collected.

4. Fetch alphabetical list of counter sets

Execute the following script through Hexnode UEM to retrieve all available performance counter sets sorted alphabetically and formatted into a clean, readable table.

How the script works:

When to use the script:

Admins can deploy this script to view all available performance counter categories on a Windows device in alphabetical order and identify whether each counter set uses SingleInstance or MultiInstance before configuring targeted performance queries.

5. Fetch formatted path names using the Paths property

Deploy the following PowerShell script through Hexnode UEM to retrieve the standard metric path templates listed in the .Paths property of a specified performance counter set.

Syntax:

How the script works:

When to use the script:

Admins can deploy this script to retrieve valid counter path templates for a specific service or subsystem, such as LDAP, Active Directory, or DNS. The .Paths property returns the paths in the correct format, helping admins build targeted monitoring scripts without errors caused by incorrectly entered counter names or path syntax.

Example:

The following script retrieves all canonical counter path templates under the Ldap Client category, helping admins identify the exact metric paths for auditing domain controller lookup latency and authentication requests:

6. Fetch formatted path names using the PathsWithInstances property

Execute the following PowerShell script via Hexnode UEM to retrieve counter paths mapped to the active hardware and process instances currently running on the endpoint (such as specific disk partitions, CPU cores, or background processes).

While the .Paths property returns canonical counter path templates containing a wildcard (*), the .PathsWithInstances property resolves those templates into live system instance identifiers (such as 0 C: and _Total). This allows administrators to extract the exact path strings needed to target specific resources without guessing disk index numbers or core IDs.

Syntax:

How the script works:

When to use the script:

Admins can run this script when troubleshooting problems on a specific drive—such as slow file transfers, freezing disks, or high disk queue lengths. If a device has multiple hard drives, this script shows the exact path for each drive (like 0 C:), allowing admins to copy and use that path to monitor only the drive experiencing issues.

Example:

The following script retrieves all counter paths for the PhysicalDisk category, showing the exact paths for the C: drive (0 C:) and the combined total (_Total).

7. Fetch a single value for each counter in a counter set

Execute the following PowerShell script through Hexnode UEM to capture an instantaneous baseline snapshot of all metric values within a target single-instance counter set.

Syntax:

How the script works:

When to use the script:

Admins can use this script to retrieve all metrics within a single-instance counter set, such as Memory or System, in one execution. Viewing all related counter values together provides a snapshot of the subsystem’s current state, helping administrators identify unusual resource usage without querying each metric separately.

Example:

The following script retrieves all canonical counter paths under the Memory category and collects a single reading for each metric. This allows administrators to examine physical memory availability, commit limits, and memory pool allocations in a single execution:

8. Display an object’s property value

Execute the following PowerShell script through Hexnode UEM to capture a performance counter reading and expand all of its underlying property values (such as Path, InstanceName, CookedValue, RawValue, Timestamp, and status codes) into a detailed list view.

How the script works:

When to use the script:

Admins can use this script to investigate metric anomalies, verify the health of Performance Data Helper (PDH) providers, or identify the properties available for use in automation scripts. By displaying the underlying object properties and diagnostic metadata, the script helps admins check whether a counter is returning valid measurements and identify details such as its status, instance name, and timestamp. It also reveals the exact property names needed to extract specific metric values in custom scripts.

9.Retrieve performance data for a specific processor instance

Execute the following PowerShell script through Hexnode UEM to retrieve the processor usage reading for a specific logical processor instance on the target Windows device.

Syntax:

How the script works:

When to use the script:

Administrators can use this script when they need to monitor CPU usage for a particular logical processor instance instead of retrieving readings for all processor instances on the device. This helps admins to inspect individual processor usage without collecting unnecessary counter data.

Example:

The following script retrieves CPU usage data for logical processor instance 0 on the target Windows device:

10. Filter CPU usage readings by threshold

Execute the following PowerShell script through Hexnode UEM to filter processor instances operating below a defined utilisation threshold.

The example below displays CPU instances running below a 20% threshold:

How the script works:

When to use the script:

Admins can deploy this script to audit CPU workload distribution and identify underutilized logical processor instances. Filtering for processor instances operating below a specified threshold, such as 20%, helps admins detect uneven workload distribution or determine whether available processing capacity is being utilized effectively, without manually reviewing every counter reading.

11. Sort performance counter data

Execute the following PowerShell script through Hexnode UEM to check current CPU usage across all running processes and organize the results from highest to lowest.

How the script works:

When to use the script:

Admins can run this script to quickly identify which applications or background services are consuming the most processor power. Instead of scrolling through hundreds of unsorted processes, sorting the list from highest to lowest places the heaviest CPU consumers right at the top, making it easy to spot resource-draining software or troubleshoot performance slow-downs.