Diagnose a Slow Windows Workstation

Slow workstation complaints are one of the most common helpdesk tickets. The root cause can range from trivial (too many browser tabs, pending updates) to serious (failing disk, malware, memory leak in a line-of-business app). A structured diagnostic approach saves time, avoids unnecessary re-imaging, and produces evidence you can share with the user or escalate to vendor support.

Run this recipe when:

• A user reports their PC is slower than usual today or over the past few days.
• Login, boot, or application launch times have noticeably increased.
• Fans are running loudly, the machine feels hot, or Task Manager shows sustained high CPU/disk/memory.

This recipe focuses on Windows 10/11 workstations managed in a corporate environment. It collects telemetry first, analyzes bottlenecks second, and recommends remediation last — so you never apply a fix before you understand the cause.

After completing this recipe you will have:

• A snapshot of current CPU, memory, disk, GPU, and network utilization.
• A list of the top resource-consuming processes and startup apps.
• Disk health (SMART) status and free-space assessment.
• Recent Windows Update, driver, and reliability history.
• Malware / Defender scan results.
• A documented root cause (or a clear escalation path if hardware is suspect).
• Applied remediation and a verification that performance is restored.

Warnings & Gotchas

• Don't reboot before collecting data. A reboot clears the evidence (running processes, event logs in memory, Task Manager history). Always snapshot first.
• Don't run aggressive "cleaners" or registry tools. They rarely fix real issues and often break managed configurations (GPO, Intune policy, AV exclusions).
• Beware of privacy. Process lists may reveal personal apps. Get user consent before remote sessions and avoid screenshotting personal content.
• SMART "OK" is not a guarantee. A drive can be failing even if SMART reports healthy. If disk latency is sustained above 50 ms, treat the drive as suspect.
• High memory use is not always bad. Windows deliberately fills RAM with cache. Focus on committed memory and paging activity, not just "% used."
• Compliance: If you find unauthorized software or signs of compromise, follow your incident-response policy before taking further action.