Windows Memory Manager and system cache: paging, page combining, and lazy write

Short answer

This series examined seven settings for paging, page combining, kernel heaps and the file cache. In Windows 11 25H2, the read code for each of them was found. Practical benefit depends on the setting and the operating conditions.

DisablePageCombining disables background page combining: the memory manager stops performing this work, but RAM usage may increase. DisablePagingExecutive keeps pageable driver code in physical memory; the benefit is usually small. The remaining settings apply only to specific kernel or storage tasks, or already have suitable default values in 25H2.

What was examined

For each value, the following were checked:

1. the exact registry path and type;
2. the default value set by the Windows 11 25H2 code;
3. related values of the same subsystem;
4. the system read code and the moment it executes;
5. range limits, value conversion and units of measurement;
6. the direct effect and the boundaries of applicability.

Besides the read code, we checked where the setting is applied, what consequences its change has and in which scenarios it may be useful. The mere presence of a setting is not enough for a recommendation.

Scope of research and evidence

• Windows 11 25H2 x64, build 26200.9168.
• Kernel settings were matched against the main configuration table ntoskrnl.exe and the code that applies them in Memory Manager and Cache Manager.
• Runtime accesses were checked with system registry tracing. Reads at phase 0 and at the beginning of phase 1 may be absent from a normal boot trace: the tracing driver starts recording later.
• For user processes, reading of the value in ntdll.dll was checked separately. For HeapDeCommitFreeBlockThreshold in 25H2, a read was found in the kernel, but user process heaps do not use this setting.
• Static analysis of system components does not replace a repeat on a physical PC, a different build or a different type of storage device.

Canonical settings

Registry path	Value	Type	Default Windows 11 25H2	Application
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management	DisablePagingExecutive	REG_DWORD	0	Paging of pageable code of system drivers
same path	DisablePageCombining	REG_DWORD	0	Background combining of identical physical pages
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager	HeapDeCommitFreeBlockThreshold	REG_DWORD	0x1000 (4 KB) for kernel heap	Decommit threshold for free blocks of kernel-mode heap
same path	ModifiedWriteMaximum	REG_DWORD	1 unit = 1 MB	Upper limit of modified page writer after clamp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management	EnableAsyncLazywrite	REG_DWORD	2	Asynchronous Cache Manager mode
same path	CacheUnmapBehindLengthInMB	REG_DWORD	8 MB	Unmap window behind sequential reads
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel	SplitLargeCaches	REG_DWORD	0	Representation of cache topology between processor groups

DisablePagingExecutive

What it does

With 0, the Windows memory manager can page out pageable sections of system code and drivers to backing storage. With 1, pageable code of system drivers is kept in physical memory.

The read code was found in ntoskrnl.exe at an early stage of kernel initialization. The value is used in MmResetDriverPaging, MmPageEntireDriver and when loading system images. It is applied before normal user registry tracing begins. A restart is required for the new state to take effect.

Values and limits

• 0: the standard Windows state, paging is allowed.
• 1: pageable sections of system drivers are kept in RAM.
• The setting spends RAM to reduce subsequent loads of system code back into memory; the disk itself does not become faster.

Usefulness

The setting prevents subsequent paging out and loading of these driver sections. It does not disable a separate constantly running CPU checking thread. On a modern system with sufficient RAM, the benefit is usually very small: even without the setting, the code can remain in memory for a long time. When RAM is scarce, forcibly keeping it there worsens the memory shortage.

The reading of the setting and the direction of the system effect are confirmed by the ntoskrnl.exe code.

DisablePageCombining

What it does

With 0, the memory manager starts a background task that finds and combines identical physical pages. With 1, this task does not perform combining.

In ntoskrnl.exe, the background page combining code was found with the pool tag MmCb, which confirms the presence of the mechanism.

Values and limits

• 0: page combining is allowed, the standard Windows state.
• 1: combining is disabled.
• Disabling reduces the background work of the memory manager, but may increase RAM usage.

Usefulness

Disabling is useful if page combining creates noticeable background load and the system has free RAM. Usually this task is not very active, so the effect is very small. With a limited amount of memory, the RAM savings from combining are more useful than the saved processor time.

The read code and the background task are confirmed in ntoskrnl.exe. Microsoft describes page combining and the trade-off between processor work and RAM savings.

HeapDeCommitFreeBlockThreshold

What it does

The value sets the decommit threshold for a free block of the kernel heap. With a larger threshold, such operations for large free blocks occur less often.

In Windows 11 25H2, the read code is located in ntoskrnl.exe, and the application of the setting is associated with the kernel function RtlCreateHeap. In ntdll.dll, no corresponding read code for heaps of ordinary processes was found.

Values and limits

• The default value in the code for the kernel heap: 0x1000 (4 KB).
• 0x40000 (256 KB) is a valid threshold for the kernel heap.
• Historical Microsoft documents described a user-mode scenario of the same name from older Windows versions, so it cannot be automatically carried over to Windows 11 25H2.

Usefulness

For ordinary applications there is practically no benefit: their heaps do not use this value. The setting can change the frequency of memory decommit only in the kernel heap. Without a measured problem with exactly that, the expected effect is very small.

The kernel-mode read is confirmed in ntoskrnl.exe. The effect for user processes in 25H2 is not confirmed.

ModifiedWriteMaximum

What it does

The setting defines the upper limit for the modified page writer. The code uses units of 256 pages, that is, one unit equals 1 MB.

Normalization in Windows 11 25H2:

• 0 is converted to 1 unit, that is, 1 MB;
• values greater than 0x40 are limited to 0x40;
• the maximum effective limit is 64 MB, or 16 384 pages.

The mechanism starts active writing approximately when a quarter of the specified limit is reached. Increasing the limit changes the moment writing starts and the amount of accumulated modified pages. The speed of the disk itself does not increase because of this.

Usefulness

With a larger limit, more modified pages accumulate before active writing begins. Writing may start less often, but the amount of not yet saved data and the size of the next write portion grow. If there is no specific writing problem, leave the default value. The effective limit is capped at 64 MB.

The read code, units of measurement and range limit are confirmed in ntoskrnl.exe. The setting of the same name from old Microsoft documents about BitLocker belongs to a different subsystem; those documents are not used here as a source.

EnableAsyncLazywrite and related values

What it does

EnableAsyncLazywrite controls asynchronous lazy writing of Cache Manager. In the 25H2 code, the default value 2 is set: this mode is already enabled.

Related values of the same subsystem:

Value	Default 25H2	Role
EnableAsyncLazywrite	2	General async lazy-write mode
EnableAsyncLazywriteMulti	2	Adjacent multi-volume mode
EnablePerVolumeLazyWriter	2	Per-volume lazy writer

0 disables asynchronous lazy writing. 1 requires a separate lazy writer handler mode on each volume. 2 enables the asynchronous mode without this requirement. Cache Manager re-reads the values when working with volume configuration.

Usefulness

Explicitly writing 2 repeats the standard Windows 11 25H2 configuration and improves nothing further. The setting is suitable primarily for diagnostics: the value 0 allows disabling the mechanism that is enabled by default.

The read was observed in system tracing and confirmed in ntoskrnl.exe. The default value 2 is confirmed by the code and by an independent description of registry settings compiled from reverse engineering results.

CacheUnmapBehindLengthInMB

What it does

The setting defines the distance in megabytes after which Cache Manager releases cached views left behind the current position of sequential reading.

The code that reads and applies the setting is located in ntoskrnl.exe and is called when mapping and reading the cache. The setting relates to sequential reading of large files; it does not disable the entire file cache.

Values and clamp

• 0 or a value greater than 128 is replaced by the code with 8.
• Working range: 1..128 MB.
• Code default: 8 MB.
• The Registry value units are exactly MB, not bytes.

Usefulness

The setting makes sense only for specialized tasks of sequential reading of large files. With a larger window, the cache mapping behind the current position is kept longer; with a smaller one, it is released earlier. For ordinary work, the standard value 8 MB is suitable; the benefit of manual tuning is usually small.

The read, application and range limit code is confirmed in ntoskrnl.exe. No modern public Microsoft documentation was found for this internal setting.

SplitLargeCaches

What it does

With 0, the cache topology description API returns a single entry for the corresponding structure covering several processor groups. With 1, entries are split by processor groups.

The read code is located in ntoskrnl.exe. The setting is used when processing the RelationCache relation in KeQueryLogicalProcessorRelationship.

Only the topology description returned by the system API changes. Allocated physical memory blocks are not split, and the probability of a shortage of a contiguous block does not decrease by itself.

Values and limits

• 0: the default value.
• 1: split topology entries by processor groups.
• A practical effect is possible primarily on systems with several processor groups, usually with more than 64 logical processors.
• On an ordinary single-group system there is no effect.

Usefulness

The setting is needed only by programs that request the cache topology on a machine with several processor groups. It does not change cache operation or memory allocation. For an ordinary desktop computer there is no benefit.

The read and application code is confirmed in ntoskrnl.exe. The value and purpose were cross-checked against the public reverse engineering description KiSplitLargeCaches.

Overall usefulness

Setting	Practical assessment
DisablePagingExecutive	Usually gives very little benefit by keeping more code in RAM
DisablePageCombining	Useful with a confirmed background page combining load and a large RAM reserve
HeapDeCommitFreeBlockThreshold	Acts only in the kernel; for ordinary applications there is no practical benefit
ModifiedWriteMaximum	Changes the conditions for writing modified pages; without an identified problem, leave the standard value
EnableAsyncLazywrite	The standard value 2 already enables the mechanism; writing it again improves nothing
CacheUnmapBehindLengthInMB	Sequential read setting; the standard 8 MB are suitable for ordinary work
SplitLargeCaches	Changes the topology description for several processor groups; on an ordinary system there is no effect

What is confirmed and what was not measured

The paths, types, default values, read code and timing of the settings listed above, as well as the range limits, are confirmed. The results relate to Windows 11 25H2 build 26200.9168. Behavior may differ with a different Windows update, amount of RAM, type of storage device or CPU topology.

For how to repeat the dynamic part of the observations, see How to check it yourself.

Restoring the state

To revert, return the standard values of the settings or delete the optional entries. Some values are applied on the next Windows boot.

The research and the tools used in it belong to the BoosterX developer, so the developer has a direct interest in the results. The methodology and the boundaries of applicability are described in this article; the conclusions can be verified against open data and the public sources listed below.

Public sources

• Memory combining, Microsoft Learn: the purpose of page combining and the CPU/RAM trade-off, checked 2026-09-01.
• Registry key that controls device driver and system code pagination to disk, Microsoft archive: the semantics of DisablePagingExecutive, checked 2026-09-01.
• HeapDeCommitFreeBlockThreshold, KB315407, historical Microsoft documentation: the old user-mode scenario and the 256 KB threshold, checked 2026-09-01.
• Windows system configuration descriptions, public RE description SplitLargeCaches, checked 2026-09-01.

The claims about the code were verified by static analysis of Windows 11 25H2 system components. Decompiled code, offsets, source traces and internal materials are not published.

Public sources checked: 2026-09-02.

Change history

• 2026-09-20: added a conflict-of-interest disclaimer and a link to self-verification of dynamic observations in the methodology.
• 2026-09-02: first publication; paths, defaults, clamps and the read code of the settings were confirmed, and the boundaries of practical usefulness were added.