Diagnose a Slow Windows Workstation

Step 1 — Interview the user (2 minutes)

Before touching the machine, ask:

• When did it start? (today / gradually / after an update)
• What's slow specifically? (boot, login, one app, everything)
• Any recent changes? (new software, VPN, docking station)

Step 2 — Open Task Manager and capture the baseline

Press Ctrl+Shift+Esc on the user's machine (or via a remote session).

1. Click More details if collapsed.
2. On the Processes tab, sort by CPU, then Memory, then Disk. Note the top 3 in each.
3. Switch to the Performance tab and screenshot CPU, Memory, Disk, and Network graphs.
4. Open the Startup apps tab and note anything with High impact.

Step 3 — Check Resource Monitor for disk queue and latency

1. Click Open Resource Monitor at the bottom of Task Manager's Performance tab.
2. Go to the Disk tab. Look at Response Time (ms). Sustained values over 25 ms indicate a bottleneck; over 100 ms suggests a failing drive.

Step 4 — Review Reliability Monitor for recent crashes

Run perfmon /rel from Start. Look for clusters of red X's in the last 7 days — these often reveal the trigger (driver, app crash, update).

Step 5 — Check disk health and free space

1. Open Settings → System → Storage. Ensure the system drive has at least 15% free.
2. Open an elevated PowerShell and run Get-PhysicalDisk | Select FriendlyName, MediaType, HealthStatus, OperationalStatus.

Step 6 — Verify Windows Update and driver status

Go to Settings → Windows Update. Install pending updates. Then check Device Manager for yellow warning icons.

Step 7 — Run a Microsoft Defender quick scan

Open Windows Security → Virus & threat protection → Quick scan. Escalate to a full scan if anything is found.

Step 8 — Remediate based on findings

• High CPU from a specific process: update or reinstall the app; check for a known bug.
• Memory pressure: close heavy apps; check if the machine meets the app's minimum RAM; consider a hardware upgrade.
• High disk latency + HDD: recommend SSD upgrade or device replacement.
• Too many startup apps: disable High-impact items the user doesn't need at boot.
• Malware detected: follow IR policy.
• Nothing obvious: reboot, then recheck. If it returns, collect a WPR trace and escalate.

Step 9 — Verify and document

Have the user try the slow workflow again. Record the root cause, remediation, and any follow-up (e.g., scheduled SSD upgrade) in the ticket.

Using Microsoft Graph to pull device context

Graph doesn't expose live performance counters, but it does provide the device posture signals an admin needs before remoting in: hardware specs, compliance state, last sync, pending updates, and Defender alerts. Combine these with the local diagnostics in the script section.

1. Get the managed device record

GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=deviceName eq '{deviceName}'

Response includes: osVersion, totalStorageSpaceInBytes, freeStorageSpaceInBytes, physicalMemoryInBytes, complianceState, lastSyncDateTime, id.

2. Get pending / failed updates for the device

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices/{id}/windowsProtectionState

Returns real-time Defender state: signature version, last scan time, real-time protection enabled, and tamper protection status.

3. Get Defender for Endpoint alerts (if licensed)

GET https://graph.microsoft.com/v1.0/security/alerts_v2?$filter=contains(evidence/any(e: e/deviceName), '{deviceName}')&$top=25

4. Trigger a remote Defender quick scan

POST https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{id}/windowsDefenderScan
Content-Type: application/json

{
  "quickScan": true
}

5. Sync the device to pull latest policy / updates

POST https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{id}/syncDevice

Auth: Use an app registration with DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.PrivilegedOperations.All, and SecurityAlert.Read.All. Acquire a token via client-credentials flow and pass it as Authorization: Bearer {token}.

PowerShell diagnostic walkthrough

The downloadable script below runs a full diagnostic sweep. Here's what each section does and why:

Top processes by CPU, memory, and disk

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, Id, CPU, WorkingSet64

Shows the heaviest CPU consumers. Repeat sorting on WorkingSet64 for memory.

Disk health via SMART

Get-PhysicalDisk | Select-Object FriendlyName, MediaType, HealthStatus, OperationalStatus
Get-StorageReliabilityCounter -PhysicalDisk (Get-PhysicalDisk) | Select DeviceId, Temperature, ReadLatencyMax, WriteLatencyMax

Free disk space

Get-Volume | Where-Object DriveLetter | Select DriveLetter, FileSystemLabel,
  @{n='FreeGB';e={[math]::Round($_.SizeRemaining/1GB,1)}},
  @{n='FreePct';e={[math]::Round(($_.SizeRemaining/$_.Size)*100,1)}}

Startup items and their impact

Get-CimInstance Win32_StartupCommand | Select Name, Command, Location, User

Recent reliability events (crashes, app hangs)

Get-WinEvent -LogName Application -MaxEvents 200 |
  Where-Object { $_.LevelDisplayName -in 'Error','Critical' } |
  Select TimeCreated, ProviderName, Id, Message -First 20

Pending reboots and updates

Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'

Defender status

Get-MpComputerStatus | Select AMServiceEnabled, RealTimeProtectionEnabled,
  AntivirusSignatureLastUpdated, QuickScanEndTime, FullScanEndTime

Run Start-MpScan -ScanType QuickScan if the last scan is stale.

Running the full script

Save the script below as Invoke-WorkstationDiagnostics.ps1. Run it elevated, locally or via Invoke-Command against a remote machine:

Invoke-Command -ComputerName PC-0123 -FilePath .\Invoke-WorkstationDiagnostics.ps1 -Credential (Get-Credential)

The script writes a timestamped report to C:\Temp\ that you can attach to the ticket.