> ## Documentation Index
> Fetch the complete documentation index at: https://docs.derekdinh.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Diagnosing and Resolving Windows Performance Issues

> Spot CPU, RAM, and disk bottlenecks in Task Manager, trim startup bloat, run Disk Cleanup, scan for malware, and tune power settings for peak performance.

A sluggish Windows PC is one of the most common support tickets, but "slow" can mean very different things: a high-CPU process grinding everything to a halt, a full hard drive causing constant disk thrashing, too many programs launching at startup, or malware quietly consuming resources in the background. Rather than guessing, this guide takes a systematic approach — starting with Task Manager to measure what is actually happening, then working through targeted fixes for each bottleneck type.

## Step 1 — Establish a Baseline with Task Manager

Before changing anything, gather objective data about where the resource constraint actually is.

<Steps>
  <Step title="Open Task Manager in detail view">
    ```powershell theme={null}
    # Open Task Manager
    taskmgr
    ```

    Or press **Ctrl + Shift + Esc**, then click **More details** if the compact view is shown.
  </Step>

  <Step title="Check the Performance tab">
    Click the **Performance** tab and note the real-time graphs for:

    * **CPU** — If consistently above 80–90%, a process is consuming excessive cycles.
    * **Memory** — If **In Use** is within 500 MB of your total RAM, you are memory-constrained.
    * **Disk** — If the active disk time graph is pegged at or near 100%, storage is the bottleneck.
    * **GPU** — High GPU usage is expected during video/games but should be near zero at idle.
  </Step>

  <Step title="Identify the bottleneck">
    Whichever resource shows near-100% utilization is your primary target. If multiple resources are saturated simultaneously, start with CPU or RAM — resolving those often reduces disk pressure too.
  </Step>
</Steps>

<Note>
  On a freshly booted PC, allow 5–10 minutes for Windows Update, indexing, and background services to settle before measuring. Initial post-boot CPU and disk usage is naturally elevated.
</Note>

***

## Step 2 — Identify High-CPU Processes

Once you have confirmed the CPU is your bottleneck, the next step is to identify which process is responsible and whether it is a legitimate Windows activity or something that needs to be addressed.

<Steps>
  <Step title="Sort by CPU usage">
    In Task Manager's **Processes** tab, click the **CPU** column header to sort processes by CPU consumption, highest first. Identify any process consistently above 15–20% at idle.
  </Step>

  <Step title="Investigate unknown processes">
    Right-click any suspicious process and choose **Open file location** to see the binary's path. Legitimate Windows processes live in `C:\Windows\System32` or `C:\Windows\SysWOW64`. A process running from `%AppData%`, `%Temp%`, or a random folder warrants further investigation.

    ```powershell theme={null}
    # Get all running processes with full path and CPU time
    Get-Process | Select-Object Name, CPU, Path |
        Sort-Object CPU -Descending | Select-Object -First 20
    ```
  </Step>

  <Step title="Check for Windows Update or Search Indexing activity">
    `MsMpEng.exe` (Windows Defender), `SearchIndexer.exe`, and `TiWorker.exe` (Windows Update) are common high-CPU culprits immediately after a reboot or update. Wait 15–20 minutes — they normally throttle themselves once finished.
  </Step>

  <Step title="Use Resource Monitor for deeper analysis">
    ```powershell theme={null}
    resmon
    ```

    Resource Monitor's **CPU** tab shows per-process CPU time broken down by thread and includes which files and handles a process has open — useful for distinguishing legitimate indexing from runaway processes.
  </Step>
</Steps>

***

## Step 3 — Check RAM Usage and Identify Memory Hogs

High memory usage can slow the system significantly as Windows begins paging data to disk. Identifying the process consuming the most RAM is the key to deciding whether to close applications, investigate a memory leak, or add more physical memory.

<Steps>
  <Step title="Sort by memory usage">
    In the **Processes** tab, click the **Memory** column to sort by RAM consumption. Look for any single process consuming an unexpectedly large amount (e.g., a browser tab using 2 GB+).
  </Step>

  <Step title="Identify memory leaks">
    A memory leak appears as a process whose memory consumption grows continuously over hours without being released. Open Resource Monitor (**resmon**) and watch the **Memory** tab over time.
  </Step>

  <Step title="Check physical RAM health if usage looks normal">
    If the system uses 70–80%+ RAM at idle with no obvious process cause, the installed RAM may be less than expected (a DIMM may have failed or not be seated) or the system simply needs more RAM for the workload.

    ```powershell theme={null}
    # Check total and available physical memory
    Get-CimInstance Win32_OperatingSystem |
        Select-Object TotalVisibleMemorySize, FreePhysicalMemory
    ```
  </Step>
</Steps>

***

## Step 4 — Disable Unnecessary Startup Programs

Every program configured to launch at login consumes RAM and CPU during boot and often continues running in the background. Reducing startup programs is one of the highest-impact, lowest-risk performance improvements available.

<Steps>
  <Step title="Open the Startup tab in Task Manager">
    In Task Manager, click the **Startup** tab. Each entry shows the program name, publisher, and its **Startup impact** rating (Low / Medium / High).
  </Step>

  <Step title="Disable high-impact, non-essential programs">
    Right-click any program you do not need immediately on login and choose **Disable**. Safe candidates to disable include:

    * Chat or messaging apps (Teams, Slack, Discord, Zoom)
    * Creative suite helpers (Adobe Updater, Creative Cloud)
    * Gaming platform overlays (Steam, Epic Games Launcher)
    * Printer or scanner software

    <Warning>
      Do **not** disable your antivirus, VPN client required for domain access, or corporate endpoint management agents. Disabling these can create security gaps or prevent domain authentication.
    </Warning>
  </Step>

  <Step title="Use Task Scheduler for deeper startup control">
    Some programs bypass the standard startup list and register with Task Scheduler.

    ```powershell theme={null}
    # List all enabled scheduled tasks that run at login or startup
    Get-ScheduledTask |
        Where-Object { $_.Triggers.CimClass.CimClassName -match 'Logon|Boot' -and $_.State -eq 'Ready' } |
        Select-Object TaskName, TaskPath
    ```
  </Step>

  <Step title="Restart and measure improvement">
    After disabling startup programs, restart the machine and use Task Manager to compare CPU and RAM baseline against the earlier measurements.
  </Step>
</Steps>

***

## Step 5 — Free Up Disk Space with Disk Cleanup

A drive that is more than 90% full causes significant performance degradation, especially on systems where the page file and temporary files compete for the remaining space. On spinning hard drives the effect is even more pronounced.

<Steps>
  <Step title="Run Disk Cleanup">
    ```powershell theme={null}
    # Launch Disk Cleanup for the C: drive
    cleanmgr /d C:
    ```

    Check all boxes, paying particular attention to **Temporary files**, **Recycle Bin**, and **Downloaded Program Files**.
  </Step>

  <Step title="Clean up system files (requires admin)">
    In Disk Cleanup, click **Clean up system files** (requires admin elevation). This adds options for **Windows Update Cleanup**, **Previous Windows installations**, and **Delivery Optimization Files**, which can reclaim many gigabytes.
  </Step>

  <Step title="Use Storage Sense for automated cleanup">
    ```powershell theme={null}
    # Open Storage Sense settings
    Start-Process "ms-settings:storagesense"
    ```

    Enable Storage Sense and configure it to run automatically and delete temp files older than 14–30 days.
  </Step>

  <Step title="Identify large files consuming space">
    ```powershell theme={null}
    # Find the 20 largest files on C: (may take a few minutes)
    Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
        Sort-Object Length -Descending |
        Select-Object -First 20 FullName,
            @{Name='SizeMB'; Expression={[math]::Round($_.Length/1MB,2)}}
    ```
  </Step>
</Steps>

<Note>
  If the system drive is an HDD, also run **Defragment and Optimize Drives** (`dfrgui`). Do **not** defragment SSDs — Windows handles SSD optimization (TRIM) automatically and manual defragmentation unnecessarily wears the drive.
</Note>

***

## Step 6 — Scan for Malware

Malware — particularly cryptominers, adware, and rootkits — frequently manifests as unexplained high CPU or network activity. Always rule this out before deeper hardware or OS-level investigation.

<Steps>
  <Step title="Run a full Windows Defender scan">
    ```powershell theme={null}
    # Run a full Windows Defender scan from the command line (admin required)
    Start-MpScan -ScanType FullScan
    ```

    Or open **Windows Security → Virus & threat protection → Scan options → Full scan → Scan now**.
  </Step>

  <Step title="Run Windows Defender Offline Scan for persistent threats">
    Some malware can hide from a scan performed while Windows is running. The offline scan runs before Windows loads:

    ```powershell theme={null}
    # Schedule an offline (pre-OS) scan on next reboot
    Start-MpWDOScan
    ```
  </Step>

  <Step title="Use Malicious Software Removal Tool (MSRT) as a second opinion">
    ```cmd theme={null}
    mrt /F:Y
    ```

    MSRT is updated monthly via Windows Update and targets the most prevalent active malware families.
  </Step>

  <Step title="Check network activity for suspicious connections">
    ```powershell theme={null}
    # Show all active TCP connections with owning process
    Get-NetTCPConnection -State Established |
        Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort,
            @{Name='Process'; Expression={(Get-Process -Id $_.OwningProcess).Name}} |
        Sort-Object Process
    ```

    Investigate any process with persistent outbound connections to unknown IP addresses.
  </Step>
</Steps>

***

## Step 7 — Adjust the Power Plan to High Performance

Windows defaults to the **Balanced** power plan, which throttles CPU frequency to save energy. On desktops and plugged-in laptops, switching to **High Performance** or **Ultimate Performance** can noticeably improve responsiveness.

<Steps>
  <Step title="Check the current power plan">
    ```powershell theme={null}
    powercfg /getactivescheme
    ```
  </Step>

  <Step title="Switch to High Performance">
    ```powershell theme={null}
    # List all available power schemes
    powercfg /list

    # Activate High Performance (standard GUID)
    powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    ```
  </Step>

  <Step title="Enable Ultimate Performance (Windows 10/11 Pro and Enterprise)">
    ```powershell theme={null}
    # Reveal and activate Ultimate Performance plan
    powercfg /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
    ```

    Run `powercfg /list` again to get the new GUID, then activate it with `powercfg /setactive <GUID>`.
  </Step>

  <Step title="Set via the Control Panel UI">
    ```powershell theme={null}
    # Open Power Options directly
    powercfg.cpl
    ```

    Select **High performance** (or click **Show additional plans** if it is hidden).
  </Step>
</Steps>

<Warning>
  Do **not** set laptops running on battery to High Performance — it will drastically reduce battery life and can cause thermal issues. Apply this setting only to plugged-in desktops or workstations, or create a separate power plan that activates automatically on AC power.
</Warning>

***

## Quick Diagnostic Reference

Use these entries to quickly investigate specific performance symptoms that do not fit neatly into the steps above.

<Accordion title="CPU is at 100% but no single process shows high usage">
  This usually indicates kernel activity or interrupt handling. In Resource Monitor → CPU, look at the **Interrupts** and **DPCs** rows. High DPC latency often points to a faulty driver (network, audio, or storage). Run **LatencyMon** (free tool) to identify the offending driver.
</Accordion>

<Accordion title="Disk is at 100% but drive has plenty of free space">
  On systems with HDDs, check **Superfetch/SysMain** (`SysMain` service). While generally beneficial, it can cause excessive disk thrashing on low-RAM machines. Also check for Windows Update running in the background. For SSDs showing 100% disk, check if the AHCI driver is current.
</Accordion>

<Accordion title="Performance degrades over a single session but recovers after reboot">
  This pattern strongly indicates a memory leak. Use **Performance Monitor** (`perfmon`) to create a data collector set tracking the **Private Bytes** counter for all processes. Identify which process's private bytes grow without bound.
</Accordion>

<Accordion title="Machine is slow only during certain hours">
  Scheduled tasks (backups, AV scans, indexing, Windows Update) may be triggering during business hours. Open **Task Scheduler** (`taskschd.msc`) and review tasks scheduled to run at those times. Reschedule them to off-hours.
</Accordion>

***

## Escalation Criteria

Escalate to Tier 2 or hardware specialist if any of the following apply:

* CPU or RAM usage remains critically high after disabling startup programs, removing malware, and closing all user applications — a reinstall or hardware upgrade evaluation is warranted.
* Disk shows 100% utilization despite no heavy workloads and the drive is less than 80% full — run `chkdsk` and consider drive replacement if SMART data shows reallocated sectors.
* SMART data from the disk reports critical errors (use `Get-Disk` and check `OperationalStatus`, or run CrystalDiskInfo).
* Switching to High Performance plan makes no difference and thermal throttling is suspected — clean the cooling system or escalate for hardware inspection.
* Malware scan detects threats that cannot be fully remediated — isolate the machine from the network immediately and escalate to the security team.