Fix NDU.sys Memory Leak Reported in Perfmon on Windows 11

You open Performance Monitor Perfmon on Windows 11 and see that NDU.sys is consuming an abnormally high amount of non-paged pool memory. This memory leak can cause system slowdowns, application crashes, and even blue screen errors over time. The root cause is the Network Diagnostic Usage NDU driver, which collects telemetry about network usage and sometimes fails to release allocated memory. This article explains why NDU.sys leaks memory and provides four tested methods to stop the leak and recover system performance.

Why NDU.sys Leaks Memory on Windows 11

NDU.sys is the kernel-mode driver for the Network Diagnostic Usage component in Windows 11. Its job is to track network data usage per application so the system can display network statistics in Task Manager and Settings. The driver allocates non-paged pool memory to store per-process network counters. In some Windows 11 builds, a bug in the driver causes it to not free this memory when a monitored process exits. Over hours or days, the leaked pool memory grows without bound.

You can verify the leak using Performance Monitor Perfmon. Open Perfmon, expand Memory, select Non-Paged Pool Bytes, and add the NDU.sys process to the graph. If NDU.sys shows a steadily rising memory count that never drops, the leak is active. A healthy system shows NDU.sys using less than 50 MB of non-paged pool. A leaking system can show 500 MB or more, causing the system to run out of available memory.

Four Methods to Stop the NDU.sys Memory Leak

The most direct way to stop the leak is to disable the NDU driver or the services that load it. The following methods are ordered from least to most invasive. Method 1 and Method 2 are reversible and do not require a reboot. Method 3 and Method 4 prevent the driver from loading at boot and require a restart to take effect.

Method 1: Stop the Diagnostic Policy Service in Services.msc

The Diagnostic Policy Service DPS is the user-mode service that interacts with NDU.sys. Stopping DPS causes NDU.sys to release its memory allocations. This is the fastest fix and does not require a reboot.

1. Open Services Console
   Press Win + R, type services.msc, and press Enter. Click Yes if prompted by User Account Control.
2. Locate Diagnostic Policy Service
   Scroll down to Diagnostic Policy Service. The service name is DPS and its status appears in the Status column.
3. Stop the Service
   Right-click Diagnostic Policy Service and select Stop. The service stops immediately. NDU.sys memory usage drops within 30 seconds as the driver frees its pool.
4. Verify the Fix in Perfmon
   Open Perfmon again and check the Non-Paged Pool Bytes counter for NDU.sys. The value should decrease rapidly toward a normal level below 50 MB.

Method 2: Disable Diagnostic Policy Service Permanently

If the leak returns after a reboot, disable the DPS service permanently. This prevents NDU.sys from being loaded at all.

1. Open Services Console
   Press Win + R, type services.msc, and press Enter.
2. Open DPS Properties
   Right-click Diagnostic Policy Service and select Properties.
3. Change Startup Type to Disabled
   In the General tab, click the Startup type dropdown and select Disabled. Click Apply then OK.
4. Restart Windows 11
   Reboot the system. After restart, NDU.sys does not load, and the leak does not occur.

Note: Disabling DPS disables Windows diagnostic and telemetry services. Network usage statistics in Task Manager may stop updating. This is a trade-off for stability.

Method 3: Disable the NDU Driver via Registry

This method targets the NDU kernel driver directly. It is more precise than disabling DPS because it only affects NDU.sys and leaves other diagnostic components running.

1. Open Registry Editor
   Press Win + R, type regedit, and press Enter. Click Yes when UAC prompts.
2. Navigate to the NDU Driver Key
   Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDU. Paste this path into the address bar or browse manually.
3. Modify the Start Value
   Double-click the Start DWORD in the right pane. Change the Value data from 1 to 4. Value 1 means the driver loads automatically. Value 4 means the driver is disabled.
4. Restart Windows 11
   Close Registry Editor and restart the system. After reboot, NDU.sys is not loaded.

Method 4: Disable the NDU Driver Using Command Prompt

For users who prefer the command line, the sc tool can disable the NDU driver without touching the registry directly.

1. Open Command Prompt as Administrator
   Press Win + S, type cmd, right-click Command Prompt, and select Run as administrator. Click Yes.
2. Disable the NDU Driver
   Type the following command and press Enter:
   sc config NDU start=disabled
   Note the space after the equals sign. The command returns a success message if the change is accepted.
3. Restart Windows 11
   Reboot the system. The NDU driver no longer loads at startup.

If NDU.sys Memory Leak Continues After Disabling the Driver

In rare cases, disabling NDU.sys does not resolve the leak because another component re-enables the driver or a different driver causes the same symptom. The following scenarios cover edge cases.

NDU.sys Still Shows High Memory After Disabling DPS

If you stopped DPS but NDU.sys memory does not drop, the driver may be held open by a third-party network monitoring tool. Uninstall any third-party network monitoring software such as NetBalancer, GlassWire, or Wireshark. After removal, repeat Method 1 or Method 3.

Windows Update Re-enables the NDU Driver

A cumulative update for Windows 11 may reset the NDU driver Start value back to 1. After installing a Windows update, check the registry key at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDU. If Start is 1, set it back to 4 using Method 3 or Method 4.

Perfmon Shows a Different Driver Leaking Memory

If the memory leak persists but Perfmon shows a different driver such as WdiWiFi.sys or tcpip.sys, the issue is not NDU.sys. Run the Windows Memory Diagnostic tool to check for hardware problems. Press Win + R, type mdsched.exe, and press Enter. Choose Restart now and check for problems. Memory errors can cause drivers to behave incorrectly.

Item	Method 1 Stop DPS	Method 3 Disable NDU in Registry
Effect on NDU.sys	Stops driver activity immediately	Prevents driver from loading at boot
Requires reboot	No	Yes
Reversibility	Start DPS service again	Change Start value back to 1
Impact on other diagnostics	Disables DPS and all dependent services	Only affects NDU driver
Persistence after Windows Update	May be re-enabled by update	May be reset to 1 by update

Now you can identify the NDU.sys memory leak in Perfmon and stop it using the method that fits your environment. Start with Method 1 for an immediate fix. Use Method 3 or Method 4 for a permanent solution. After applying the fix, monitor Perfmon for 24 hours to confirm the non-paged pool memory stays below 50 MB. If the leak returns, check for Windows updates that may have re-enabled the driver and apply the registry change again.