T The Triage ManualTechnical Guides for IT Emergencies
P3 · Endpoint & Device Management

Windows 10 / 11 Performance Degradation — Diagnosis, Optimisation, and Remediation

Windows 10 and Windows 11 endpoints exhibit sustained high CPU, disk, or RAM usage, slow boot times, and UI unresponsiveness due to accumulated startup programs, misconfigured power plans, background services (SysMain/Windows Search) causing HDD thrashing, bloatware, driver issues, or malware. Diagnosis proceeds through Task Manager and Resource Monitor to identify the dominant resource consumer, then applies targeted remediations: power plan correction, startup pruning, service disablement on HDD systems, visual effect reduction, disk cleanup, SFC/DISM repair, driver updates, and malware scanning. Most changes require an elevated session and a reboot to take full effect.

Indicators

Likely causes

Diagnostic steps

  1. Open Task Manager with Ctrl+Shift+Esc. Navigate to the Performance tab for system-wide overview, then the Processes tab. Sort CPU, Memory, and Disk columns descending. Note any process consistently above 10% CPU or showing sustained high Disk MB/s. Run: taskmgr
    Establishes which specific processes are responsible for resource exhaustion — all subsequent remediation steps depend on this baseline identification.
  2. Open Resource Monitor: run 'resmon' from Run or elevated PowerShell. Review the Disk tab — sort by Total (B/sec) descending to identify disk-thrashing processes. Review the CPU tab for processes with consistently high Average CPU. Cross-reference with Task Manager findings.
    Provides deeper per-process I/O and CPU wait metrics than Task Manager, essential for pinpointing SysMain/WSearch disk thrashing or spinning background processes that Task Manager aggregates.
  3. Enumerate all startup programs and their system impact. In Task Manager: Startup tab — note all items marked 'High' impact. In elevated PowerShell: Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location, User | Format-Table -AutoSize
    Determines how many programs load at logon and which are contributing to slow boot and post-logon performance degradation — identifies candidates for disablement.
  4. Check the current active power plan: powercfg /getactivescheme — compare against expected plan. List all plans with: powercfg /list
    A Power Saver plan actively limits CPU frequency via throttling and can make capable hardware feel sluggish; this must be ruled out before deeper investigation.
  5. Check available free space and storage type on C: drive. Run in elevated PowerShell: Get-PSDrive -Name C | Select-Object Used, Free, @{Name='FreeGB';Expression={[math]::Round($_.Free/1GB,2)}}. If HDD, also check fragmentation via dfrgui or: Optimize-Volume -DriveLetter C -Analyze -Verbose
    Less than 10–15% free space severely impacts page file and temp file performance; fragmentation compounds this on HDDs. SSD systems are not affected by fragmentation.
  6. Review the 50 most recent System and Application errors and warnings in Event Viewer. Run in elevated PowerShell: Get-EventLog -LogName System -EntryType Error,Warning -Newest 50 | Format-Table TimeGenerated, EventID, Source, Message -AutoSize — also check Application log for repeated service crash or disk error events.
    Identifies hardware errors (disk failures, memory faults), driver crashes, or repeatedly failing services that may be the actual root cause of resource exhaustion rather than configuration issues.
  7. Run System File Checker in an elevated command prompt: sfc /scannow — wait for completion. Then run DISM repair: DISM /Online /Cleanup-Image /RestoreHealth — this uses Windows Update as the repair source and may take 20–40 minutes.
    Detects and repairs corrupted OS files that can cause services to consume excessive CPU in retry loops; DISM must be run first if SFC reports unfixable errors as it repairs the component store SFC depends on.
  8. Check RAM totals and current consumption. Total RAM: Get-CimInstance Win32_PhysicalMemory | Measure-Object -Property Capacity -Sum | Select-Object @{Name='TotalRAM_GB';Expression={[math]::Round($_.Sum/1GB,2)}}. Current usage: Get-CimInstance Win32_OperatingSystem | Select-Object FreePhysicalMemory, TotalVisibleMemorySize, @{Name='UsedRAM_GB';Expression={[math]::Round(($_.TotalVisibleMemorySize - $_.FreePhysicalMemory)/1MB,2)}}
    Confirms whether the system has genuinely insufficient RAM (under 4 GB effective) or whether RAM is being consumed by rogue processes, informing the decision to tune virtual memory settings.

Resolution path

Prevention

Tools

References

windows-10windows-11performanceoptimisationslow-boothigh-cpuhigh-disk-usagehigh-memorystartup-programspower-plansysmainsuperfetchwindows-searchsfcdismvisual-effectspage-filedefragtrimmalwaredriversendpointdesktop-supportresource-monitortask-managerhddssdwinsat