When analyzing performance issues on Windows Server 2003/2008, the "% Interrupt Time" counter in Performance Monitor often reveals hardware-related bottlenecks. This metric represents the percentage of time the processor spends handling hardware interrupts - signals from devices demanding immediate attention.

Here are the most effective tools for interrupt analysis:

1. Performance Monitor (PerfMon)
   - Counters to monitor:
     * Processor(_Total)\% Interrupt Time
     * Processor(*)\Interrupts/sec
     * System\Context Switches/sec

2. Windows Performance Recorder (WPR)
   - Command: wpr -start GeneralProfile -filemode

3. xperf (Windows Performance Toolkit)
   - Capture command: xperf -on DiagEasy
   - View command: xperf [trace.etl]

Here's a PowerShell script to identify potential interrupt sources:

# Get interrupt affinity policy information
Get-WmiObject -Query "SELECT * FROM Win32_DeviceBus" | 
Select-Object DeviceID, BusNum, BusType | 
Format-Table -AutoSize

# Check IRQ assignments
Get-WmiObject Win32_IRQResource | 
Select-Object Name, IRQNumber, Hardware | 
Sort-Object IRQNumber | 
Format-Table -AutoSize

# Monitor interrupt distribution across CPUs
$sample = 5
1..$sample | ForEach-Object {
    $stats = Get-Counter '\Processor(*)\% Interrupt Time'
    $stats.CounterSamples | 
    Where-Object { $_.InstanceName -ne '_Total' } | 
    Select-Object InstanceName, CookedValue
    Start-Sleep -Seconds 2
}

Frequent interrupt generators include:

• Network Interface Cards (NICs) - especially under heavy load
• Storage controllers with outdated drivers
• Faulty hardware components
• Antivirus real-time scanning

To update problematic drivers programmatically:

# List all devices with their interrupt usage
$devices = Get-PnpDevice | Where-Object { $_.Class -eq "System" }
$devices | ForEach-Object {
    $device = $_
    $irq = Get-WmiObject -Query "ASSOCIATORS OF {Win32_PnPEntity.DeviceID='$($device.DeviceID)'} WHERE ResultClass=Win32_IRQResource"
    [PSCustomObject]@{
        Name = $device.FriendlyName
        Manufacturer = $device.Manufacturer
        IRQ = $irq.IRQNumber
        Status = $device.Status
    }
}

For deeper analysis using the Windows Performance Toolkit:

# Capture trace with interrupt events
xperf -on PROC_THREAD+LOADER+INTERRUPT -stackwalk Interrupt -buffersize 1024 -MinBuffers 256 -MaxBuffers 256 -f kernel.etl

# After reproduction period
xperf -d merged.etl kernel.etl
xperf merged.etl

Key things to examine in the trace:

• ISR (Interrupt Service Routine) duration
• DPC (Deferred Procedure Call) latency
• Interrupt distribution across CPUs

Configuration recommendations:

# Set network adapter interrupt moderation (PowerShell)
Get-NetAdapter | ForEach-Object {
    Set-NetAdapterAdvancedProperty -Name $_.Name -DisplayName "Interrupt Moderation" -DisplayValue "Adaptive"
    Set-NetAdapterAdvancedProperty -Name $_.Name -DisplayName "Receive Side Scaling" -DisplayValue "Enabled"
}

# Disable unnecessary devices in BIOS:
# - Serial/parallel ports
# - Floppy controller
# - Legacy USB support

When diagnosing performance issues on Windows servers, particularly with older versions like Windows Server 2003/2008, high % Interrupt Time in Task Manager often points to hardware-related issues. Interrupts occur when hardware devices need CPU attention, and excessive interrupts can cripple system performance.

Here are the most effective tools for interrupt analysis:

• Performance Monitor (PerfMon): Built-in Windows tool for detailed performance analysis
• Windows Performance Analyzer (WPA): Advanced tool for deep system inspection
• Driver Verifier: Helps identify problematic drivers
• xperf: Part of Windows Performance Toolkit for ETW tracing

Here's a PowerShell script to identify problematic devices:

# Get interrupt information via WMI
Get-WmiObject Win32_PerfRawData_Counters_Interrupts | 
Select-Object Name, InterruptsPersec, PercentInterruptTime |
Sort-Object InterruptsPersec -Descending |
Format-Table -AutoSize

For deeper analysis with xperf (requires Windows Performance Toolkit):

xperf -on Diag+Latency+Interrupt -stackwalk Interrupt -buffersize 1024
# Let it run for 30-60 seconds during high interrupt activity
xperf -d interrupts.etl

Frequent causes of high interrupt time include:

• Faulty or outdated network drivers (especially in virtualized environments)
• Storage controller issues (AHCI/RAID drivers)
• USB controller conflicts
• Legacy hardware without proper power management

Example registry tweak for interrupt moderation (network cards):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0001]
"InterruptModeration"=dword:00000001
"InterruptModerationRate"=dword:00000100

For kernel-level debugging with WinDbg:

!irqlfind
!idt -a
!analyze -v

Remember to check the System Event Log for hardware-related errors, and consider updating BIOS/firmware for known interrupt-related issues.