Skip to content

Instantly share code, notes, and snippets.

@HelderMagalhaes

HelderMagalhaes/Windows-IFEO-PerfOptions.md

Last active September 7, 2025 16:11
Show Gist options
  • Save HelderMagalhaes/899766e74da8cd3923fd47c41c07b320 to your computer and use it in GitHub Desktop.
Save HelderMagalhaes/899766e74da8cd3923fd47c41c07b320 to your computer and use it in GitHub Desktop.
Download ZIP
Windows - Image File Execution Options (IFEO) - Performance Options (PerfOptions)
Raw
Windows-IFEO-PerfOptions.md

Windows: Image File Execution Options (IFEO) Performance Options (PerfOptions)

Index

Introduction

The PerfOptions registry key is barely documented. When used properly, it is key (no pun intended) for handling a set of performance-related corner cases:

  • Tame built-in system utilities and/or required third-party software
    • Often more aggressive than needed, these can significantly impact performance and responsiveness
  • Stand out from the crowd in busy workloads
    • Because most software uses the defaults, a machine with lots of running programs/background utilities can be "distracted" from its main goals
  • In existing/legacy software which doesn't properly (programmatically) set performance options
    • If a performance bottleneck is found, this mechanism may help retrofitting previous/already deployed versions
  • For software one is in control of, this can be used for longer-term experimentation before applying a proper (API-based) approach
    • For "short" (within same user/O.S.) or more dynamic sessions, consider using a tool like System Informer

Warning

Use with care: "playing" with the below settings can easily cause more harm then good. Knowledge on computer architecture and Windows internals recommended.

Key location

The PerfOptions key doesn't exist by default and is rarely seen in production. Can be specified, per executable, under the IFEO machine-wide key:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<filename>\PerfOptions

The <filename> placeholder meaning the executable's filename, no file extension included. See the example for details.

Subkeys and values

Type is REG_DWORD for all subkeys.

Process priority

CpuPriorityClass inheritance by child processes is limited by design to IDLE_PRIORITY_CLASS or BELOW_NORMAL_PRIORITY_CLASS.

I/O priority

IoPriority via the IFEO mechanism is limited to "Normal" and lower.

Page priority

pages with lower memory priority are trimmed before pages with higher memory priority

Working set limit

PerfOptions working set maximum is a hard limit. (That is, the working set will not be allowed to grow past that number.)

This subkey is mostly untested, essentially due to the already referred hard limitation, meaning the process will perform poorly if the value is too low.

Narrow match

PerfOptions is, by default, solely based on a case-insensitive filename match: niche use-cases, such as software naming clashes, launcher vs. main process named the same, copies in different paths, etc. need an additional key which can filter out undesired matches. The configuration is done via a UseFilter subkey (REG_DWORD type), to enable the behavior, and one or more keys (individual key name is irrelevant) containing FilterFullPath (REG_SZ type), targetting the exclusion.

Example

Canonical example showing how to set explorer.exe (Windows Explorer) to default values:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer\PerfOptions]
"CpuPriorityClass"=dword:00000002
"IoPriority"=dword:00000002
"PagePriority"=dword:00000005

Note

Related issue: A Windows Explorer performance regression, apparently introduced in Windows Server 2016 and fixed since 22H2, consisted in a lower page priority unexpectedly assigned to the process. That could impact far beyond the shell and file browser itself. Additional details in the report and follow-up comments. A registry entry containing the default PagePriority could help working around such behavior (untested).

In this case, more than one explorer.exe is usually available, e.g.:

  • C:\Windows\explorer.exe (Windows 64-bit native version)
  • C:\Windows\SysWOW64\explorer.exe (32-bit version on Windows 64-bit)

Assuming only the 64-bit native is to be addressed, the SysWOW64 path is to be excluded: use WinExp32bit as memorizable key name:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinExp32bit]
"UseFilter"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinExp32bit\ExcludeLauncher]
"FilterFullPath"="C:\Windows\SysWOW64\explorer.exe"

Acknowledgments

  • Ivan G. (aloneguid.uk) for sharing findings on this matter, which gave an important push while starting additional research on this
  • Geoff Chappell (geoffchappell.com) for sharing finding on the handling of same name executables, which covers an edge case which which I stumbled with in production (use-case actually missed by the original IFEO implementation)
  • Mark Russinovich (microsoft.com) et. al. for making Process Explorer I used extensively in the past (before switching to System Informer) for assessing some of these configurations and also for sharing relevant documentation including Windows Internals
  • dmex, Wen Jia Liu (wj32.org) et. al. for making Process Hacker (recently forked to System Informer), the advanced process utility used for assessing most of these configurations

References

© 2025 by Helder Magalhães, licensed under Creative Commons Attribution 4.0 International.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment