Windows Slow Boot — Startup Applications, Services, Pending Updates, or Failing Disk

Indicators

• System takes significantly longer than baseline to reach logon screen or desktop (e.g., multiple minutes instead of seconds)
• Spinning dots or 'Please wait' / 'Getting Windows ready' displayed for extended periods during boot
• Windows Update progress screen ('Configuring Windows Updates — Do not turn off your computer') visible on boot
• Disk activity LED on physical hardware remains solid or erratic during boot with no visible progress
• Task Manager Startup tab shows one or more entries with 'High' startup impact rating
• Event Viewer > Windows Logs > System: Event ID 7 (disk source — bad block/disk error) present
• Event Viewer > Windows Logs > System: Event ID 11 (driver detected a controller error) present
• Event Viewer > Applications and Services Logs > Microsoft > Windows > Diagnostics-Performance > Operational: Event ID 100 (slow boot detected, total milliseconds recorded)
• Event Viewer Diagnostics-Performance: Event ID 101 (specific application delaying boot), Event ID 102 (service delaying boot), Event ID 103 (driver delaying boot) — each includes the component name and milliseconds of delay

Likely causes

• Excessive third-party applications configured to launch at startup, consuming CPU and disk I/O before the desktop is usable
• Unnecessary Windows services set to Automatic start, contending for resources during the critical boot sequence
• Pending Windows Update installation phases (pre-reboot staging or post-reboot configuration) executing during boot
• Corrupt or stuck Windows Update state (SoftwareDistribution or catroot2) causing repeated configuration attempts
• Failing or degraded physical HDD causing read retries and I/O timeouts against boot-critical files
• Fragmented HDD (not applicable to SSDs) causing excessive seek times for sequential boot file access
• Malware or unwanted software injected into the startup sequence adding latency and resource contention

Diagnostic steps

1. Review the Diagnostics-Performance event log. Open eventvwr.msc, navigate to Applications and Services Logs > Microsoft > Windows > Diagnostics-Performance > Operational. Filter for Event IDs 100, 101, 102, 103. Event ID 100 gives total boot time in milliseconds. Event IDs 101/102/103 name the specific application, service, or driver responsible and report the milliseconds of delay each caused.
   Identifies whether the slow boot is software-driven and pinpoints the exact component responsible — this is the fastest first step before touching anything.
2. Check Task Manager Startup tab. Press Ctrl+Shift+Esc, select the Startup tab, sort by 'Startup impact'. Note all entries rated High. On Windows Server or older systems use msconfig > Startup tab.
   Provides a prioritised list of logon-time auto-start applications and their measured performance impact — complements Diagnostics-Performance event data.
3. Check for disk errors. Open eventvwr.msc > Windows Logs > System, filter for Event ID 7 (source: disk) and Event ID 11 (source: disk or controller). Then from an elevated command prompt run: wmic diskdrive get status — result should be 'OK' for all drives. Any other value (e.g., 'Pred Fail', 'Unknown') indicates hardware degradation.
   Determines whether a failing disk is the primary root cause. If disk errors are confirmed, all software remediation is secondary — back up immediately and replace hardware.
4. Check Windows Update pending state. Open Settings > Windows Update and look for any updates stuck in 'Pending restart' or 'Configuring' state. From an elevated command prompt run: net stop wuauserv — then inspect C:\Windows\SoftwareDistribution\Download for partially downloaded or orphaned update packages.
   Confirms whether a stalled or looping update cycle is the cause of post-reboot configuration delays at boot.
5. Review services set to Automatic start. Open services.msc, sort by Startup Type column. Identify third-party or non-essential services set to Automatic that do not require immediate availability at boot. Compare against Event ID 102 findings from Step 1.
   Identifies service-layer boot contributors that are not visible in the Task Manager Startup tab, allowing targeted change to Automatic (Delayed Start).
6. If granular root-cause data is still needed after Steps 1–5, capture a boot performance trace. From an elevated command prompt run: wpr -start boot — then reboot the system. After login completes, immediately run: wpr -stop C:\bootlog.etl — then open the resulting .etl file with Windows Performance Analyzer (WPA) for a full boot phase breakdown including driver initialisation, service start, and process launch timelines.
   Provides the most detailed possible timeline of every driver, service, and process during boot — use this when Event Viewer data does not explain the full delay duration.

Resolution path

• 1. DISABLE HIGH-IMPACT STARTUP APPS: In Task Manager > Startup tab, right-click each High-impact entry that is non-essential and select Disable. On older systems use msconfig > Startup tab. Reboot and measure improvement via Diagnostics-Performance Event ID 100.
• 2. DELAY OR DISABLE NON-ESSENTIAL SERVICES: In services.msc, for identified non-critical third-party services set to Automatic, change Startup Type to 'Automatic (Delayed Start)' to move them out of the critical boot path. Do not alter essential Windows services. Reboot and compare boot time.
• 3. RESOLVE PENDING WINDOWS UPDATES: If updates are stuck in 'Pending restart' or 'Configuring', open an elevated PowerShell and run: Stop-Service wuauserv; Stop-Service bits; Stop-Service cryptsvc; Rename-Item C:\Windows\SoftwareDistribution SoftwareDistribution.old; Rename-Item C:\Windows\System32\catroot2 catroot2.old; Start-Service cryptsvc; Start-Service bits; Start-Service wuauserv — then restart and allow Windows Update to re-initialise cleanly.
• 4. REPLACE FAILING DISK (highest priority if disk errors confirmed): If Event ID 7 or 11 are present in System log, or wmic diskdrive get status returns anything other than 'OK', back up all data immediately. Replace the physical disk. Restore from backup or reimage onto the new drive. Do not defer this step.
• 5. RUN DISK DEFRAGMENTATION (HDD only — NOT SSD): For spinning hard drives only, from an elevated command prompt run: defrag C: /U /V — this defragments the volume and reports progress verbosely, improving sequential read performance for boot files. Never run defrag on SSDs.
• 6. SCAN FOR MALWARE IN STARTUP: Run Windows Defender Full Scan or Microsoft Safety Scanner offline to rule out malware injecting itself into the startup sequence. Remove any detections and reboot to measure improvement.

Prevention

• Audit startup applications quarterly using Task Manager > Startup tab — disable any software that does not require launch-at-boot (e.g., chat clients, media players, OEM vendor utilities).
• Maintain a regular Windows Update patching cadence to prevent large batched update installations that cause extended boot-time configuration phases.
• Deploy S.M.A.R.T. disk health monitoring proactively (e.g., CrystalDiskInfo, vendor storage utilities, or Intune/SCCM hardware inventory) to detect disk degradation before it causes boot failures or data loss.
• Use SSDs for all OS drives wherever operationally possible — SSDs eliminate seek-time issues and are significantly less susceptible to the I/O stalls that degrade HDD boot performance over time.
• Use Group Policy or MDM (Intune) to prevent unauthorised software from registering itself in the startup sequence on managed endpoints — enforce approved software lists via AppLocker or WDAC where risk warrants it.

Tools

• Event Viewer (eventvwr.msc) — review Diagnostics-Performance/Operational and System logs for boot timing and disk errors
• Task Manager (Ctrl+Shift+Esc) — Startup tab for identifying and disabling high-impact startup entries
• Services MMC (services.msc) — audit and modify service startup types
• msconfig — System Configuration tool for startup and service management (workstations / older Windows)
• wmic — query disk drive health via 'wmic diskdrive get status'
• Windows Performance Recorder (wpr.exe) — capture boot trace ETL files
• Windows Performance Analyzer (WPA) — visualise and analyse boot trace ETL files
• defrag.exe — disk defragmentation for HDDs only (do not run on SSDs)
• Windows Defender / Microsoft Safety Scanner — detect malware injected into startup path
• PowerShell — stop/start Windows Update services and rename SoftwareDistribution/catroot2 folders

References

• Microsoft Support — Tips to improve PC performance in Windows
• Microsoft Support — Windows Update troubleshooter
• Microsoft Docs — Windows Recovery Environment (WinRE) Technical Reference