Hardware Performance Counter Registry Paths in Windows

This article provides a direct overview of where the Windows Registry stores configuration data for system-wide hardware performance counter profiles. In Windows, hardware performance counters (PMCs) allow kernel profilers, Windows Performance Recorder (WPR), and Event Tracing for Windows (ETW) to monitor CPU-level events such as cache misses, branch mispredictions, and instruction cycles. The following sections detail the exact registry paths used to manage and inspect these active profiles.

Primary Registry Key for Hardware Profile Sources

The global settings and default source mappings for hardware performance counter profiling are located in the following Windows Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\ProfileSource

Under this key, the operating system registers available hardware counter sources mapped directly to the processor’s Performance Monitoring Unit (PMU) via the Hardware Abstraction Layer (HAL). Values defined here determine the interval and default hardware architecture events tracked during system profiling.

Active Trace and Autologger PMC Configurations

When hardware performance counters are configured for system-wide ETW tracing or persistent logging across reboots, the active configurations are stored within the Autologger subkeys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\<Session_Name>

Key configuration values include:

• PmcConfig: Defines the active bitmask or event IDs for configured hardware counters.
• ProfileSource: Specifies the source ID representing the specific CPU counter event.
• Interval: Defines the sampling frequency (event threshold count) before generating an interrupt for profiling.

For system sessions configured via Windows Performance Recorder (WPR) or tracelog, active counter configurations may also temporarily register under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemTraceConfig.

Standard Performance Counter Libraries

To distinguish hardware CPU counters from software performance objects, standard system-wide performance counters (such as those queried by Performance Monitor or PerfOS) reside in:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib

While Perflib handles service and operating system metric registries, low-level CPU execution and hardware counter profile routing remains managed under the Control\WMI paths. Modifying hardware counter keys requires elevated administrative or SYSTEM privileges.