Windows Performance Counter Registry Locations

This article outlines the specific registry paths within the Windows Registry Editor (regedit) where hardware performance counter profiles, global performance library settings, and counter access permissions are defined and managed.

Perflib Counter Definitions and Global Permissions

The primary repository for performance counter service registration and baseline security settings is located under the Perflib (Performance Library) key:

• Registry Path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib

Key Configuration Values:

• RestrictGuestAccess: A DWORD value determining whether guest accounts can read performance counters (1 disables access, 0 enables access).
• Security: A binary security descriptor that defines the Access Control Lists (ACLs) for querying system-wide performance data.
• Language Subkeys (009, etc.): Subkeys containing Counter and Help multi-string values that define the system counter names, index IDs, and descriptions.

Service-Specific Performance Counter Profiles

Individual hardware components, drivers, and system services store their specific performance monitoring profiles and DLL pointers under the Services tree.

• Registry Path Template:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<ServiceName>\Performance

Key Hardware Counter Components:

• PerfOS (...\Services\PerfOS\Performance): Defines CPU, memory, and processor hardware counter profiles.
• PerfDisk (...\Services\PerfDisk\Performance): Defines physical and logical storage counter profiles.
• PerfProc (...\Services\PerfProc\Performance): Handles process-level thread and execution counter monitoring.

Required Values Inside Each Performance Key:

• Library: Path to the performance DLL exposing the hardware counters.
• Open: The entry-point function used to initialize counter collection.
• Collect: The function called to sample hardware counters.
• Close: The cleanup function.

ETW and Hardware Performance Monitoring (PMU) Permissions

Hardware performance counters accessed via Event Tracing for Windows (ETW) and Performance Monitoring Units (PMU) rely on security descriptors defined in the WMI registry branch.

• Registry Path:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security

Configuration Details:

• Individual GUID keys represent distinct ETW trace providers, including the kernel trace provider responsible for hardware profile counters (such as instruction cycles, branch mispredictions, and cache misses).
• Binary values inside these keys hold the discretionary access control lists (DACLs) that dictate which user groups (e.g., Performance Log Users, Administrators) can configure PMC profiling sessions.

User Rights and Execution Privileges

In addition to registry ACLs, hardware-level performance profiling requires specific user privilege assignments defined by Windows security policy:

• SeSystemProfilePrivilege (Profile system performance): Required for sampling hardware execution counters globally.
• SeProfileSingleProcessPrivilege (Profile single process): Required for monitoring performance counters on a per-application basis.