Diagnose a Slow Windows 11 PC

Diagnose a slow Windows 11 PC and test safe fixes without admin access.

Introduction

30 Second Summary

When a PC slows down, every click starts to feel like a guess. Random fixes can waste time or change something important without revealing the real cause.

In this project, you will build a Windows 11 performance first-aid report for one real workload. Your evidence will guide safe user-level fixes plus a repeatable restart test.

What You'll Build

Picture repeating the slow routine after a restart to reveal a defensible result: improved, unchanged, or worse.

By the end of this project, you'll have:

A live performance baseline where Task Manager reveals the busiest CPU, memory, and disk activity during your familiar workload.
A health and event timeline that pairs Windows Security status with the nearest relevant Event Viewer entry. A documented no-match result keeps unrelated errors out of your diagnosis.
A safe first-aid result with visible startup, cleanup, and scan evidence. An administrator-ready summary supports any remaining issue.
Secret Mission: Run a controlled A/B test on one optional startup app. Keep the final state supported by your measurements.

Are there any prerequisites?

You need a Windows 11 PC that reaches the desktop through a standard account without administrator access. The project also requires permission to restart the PC plus a familiar app or browser routine that often feels slow.

Before We Start

Start by locking in one repeatable performance problem before any hands-on checks. Your one-sentence description will identify the slow app or routine plus the normal behavior you expect.

Set Up a Safe Diagnostic Workspace

Your saved workload description gives this investigation one clear target. A safe diagnostic workspace protects your open work before the PC slows down again.

Verified access to the built-in tools prevents risky guesswork. An access restriction is valid evidence about what your standard account can reach.

In this step, get ready to:

Protect your open work with two user-level safety rules.
Confirm Task Manager and Settings are accessible.
Confirm Windows Security and Event Viewer are accessible or record any restrictions.

Set safe boundaries

Diagnostic work is safest when the limits are written down before you inspect anything. These rules keep the session focused on observation.

Save every open document using its app's save control.
Return to the performance evidence record from earlier.
Add this safety rule: I will not enter administrator credentials during this project.
Add this safety rule: I will not delete personal files or settings I do not recognize.
Confirm that your workload description remains above the two safety rules.

That safety net is now in place. Your open work stays protected while you gather evidence.

Stay Within Your Standard Account

An administrator prompt can feel like a blocker. Recording it gives you useful evidence without changing account permissions.

Leave any credential fields empty. Close the prompt without entering administrator credentials.

Open Task Manager and Settings

Task Manager provides a live view of resource use. Settings confirms that your standard account can open a core Windows 11 control surface.

Press Ctrl + Shift + Esc to open Task Manager.
Select Processes if another view is active.
Check that the CPU, Memory, and Disk column headings are visible.
Record Task Manager as opened in your performance evidence record when the window appears.
Record Task Manager as restricted if the shortcut does not produce an accessible window.

When access succeeds, you should see running entries beneath the CPU, Memory, and Disk columns. This confirms that Task Manager is ready for the live baseline.

Select Start on the taskbar.
Type Settings in Start search.
Select Settings in the search results.
Record Settings as opened when the window appears.
Record Settings as restricted if the window remains inaccessible.

You should see the Settings window under your current standard account. Your evidence record now shows whether both tools are available.

Check Windows Security and Event Viewer

Windows Security confirms whether its health page is available to this account. Event Viewer confirms whether the local event history can be opened.

Select Start on the taskbar.
Type Windows Security in Start search.
Select Windows Security in the search results.

You should see the Windows Security home page. This confirms that the app opens under your standard account.

Select Device performance & health in Windows Security.
Record Device performance & health as opened when the page appears.
Record Windows Security as restricted if the page remains inaccessible.

You should see the Device performance & health page or have a recorded restriction. Organization policy can limit this page on managed PCs.

Select Start on the taskbar.
Type Event Viewer in Start search.
Select Event Viewer in the search results.
Record Event Viewer as opened when its window appears.
Record Event Viewer as restricted if its window remains inaccessible.

You should see the Event Viewer window without entering administrator credentials. This confirms that the final evidence tool is available.

Why Built-In Tools?

Built-in Windows 11 tools keep the diagnosis inside standard-account permissions. This approach avoids extra downloads.

The same toolset keeps each later change tied to evidence. Your final retest can then use the same workload.

Before the final check, do you expect every tool to remain available without administrator credentials?

Confirm that Task Manager shows the Processes view with CPU, Memory, and Disk columns.
Confirm that the Settings window remains open.
Confirm that Windows Security shows Device performance & health.
Confirm that the Event Viewer window remains open.
Review your performance evidence record for an opened or restricted result for all four tools.

You should now have Task Manager resource columns, a Settings window, Device performance & health, and Event Viewer available. If policy blocks a tool, your record should name the restriction.

Is a Tool Restricted?

Record the restricted tool's name. Record the screen or prompt that appeared.

Continue with the tools your account can access. Do not attempt to bypass the restriction.

Help me document a Windows 11 tool restriction safely.

Your safe diagnostic workspace is ready. Next, you'll reproduce the familiar slowdown while Task Manager captures the live resource pressure.

Capture the Slowdown in Task Manager

Your safe diagnostic workspace is ready. The next challenge is catching the slow moment while it is happening.

A quiet baseline gives you a reference point. The two-minute workload shows what changes when the PC feels slow.

Slowdowns often fade before you can explain them. This step turns that short window into evidence you can compare later.

In this step, get ready to:

Record a quiet Processes-tab baseline.
Reproduce the familiar workload for two minutes.
Test the effect of closing one recognized unused app.

Record the quiet baseline

A performance baseline captures resource activity before your workload starts. It gives you a calm state to compare with the slow moment.

Switch back to Task Manager from earlier.
Select Processes in the left navigation.
Pause the selected workload so it is not actively running.
Add a pre-workload baseline section to your performance evidence record.
Record the visible CPU activity exactly as Task Manager shows it.
Record the visible Memory activity exactly as Task Manager shows it.
Record the visible Disk activity exactly as Task Manager shows it.

Why Capture a Quiet Baseline?

Resource activity changes from moment to moment. The quiet baseline shows what the PC was doing before your familiar workload added pressure.

The comparison helps you connect a busy resource with the time when responsiveness changes.

Missing a Resource Column?

Maximize the Task Manager window to give the resource columns more room.
Record the restriction in your performance evidence record if Task Manager remains unavailable.
Continue without trying to bypass the restriction.

Ask for help with the view you see by selecting Help me find the Task Manager resource columns..

Run the two-minute workload

A useful comparison repeats the workload you described earlier. Keeping the routine consistent makes the busy entries easier to connect with the slowdown.

Position Task Manager so the resource columns remain visible.
Confirm that Processes is still selected.

Before you start the workload, consider whether CPU, Memory, or Disk will become busiest.

Record the current time as the workload start time.
Start the familiar app or browser routine from your workload description.
Repeat the familiar routine for two minutes.
Record the first moment when the slowdown appears.
Record the busiest recognizable entry under CPU during the workload.
Record the busiest recognizable entry under Memory during the workload.
Record the busiest recognizable entry under Disk during the workload.

Before you let the workload settle, consider whether Task Manager will preserve the exact peak after the slow moment passes.

Stop interacting with the workload after two minutes.
Watch the Task Manager values for several updates.

You will see the live values continue to change after the workload settles. A peak that has passed is no longer preserved in those columns.

What Did the Live View Miss?

Task Manager keeps updating the current resource activity. Its live columns do not preserve the exact state of an earlier freeze after that activity passes.

Your timestamp preserves when the slowdown happened. Your written observations preserve what was busy at that moment.

Test one safe app closure

One small change can show whether an unused app is adding pressure. The candidate must be recognizable to you.

Protect Open Work

Closing an app can discard unsaved changes. Your earlier save keeps this test controlled.

Leave security software untouched. Leave accessibility tools untouched.

Review the current Processes list for a recognizable app you are not using.
Record a no-safe-closure decision if no app meets both conditions.
Switch to the qualifying app window if one is available.
Confirm that work in the qualifying app is saved.
Close the qualifying app with its normal window control.

Before you repeat the slow action, consider whether closing the unused app will change responsiveness.

Repeat the slowest part of your familiar workload once.
Return to Task Manager.
Observe whether CPU activity changed.
Observe whether Memory activity changed.
Observe whether Disk activity changed.
Record the responsiveness effect in your performance evidence record.
Record the resource activity effect in your performance evidence record.

Your record now shows the effect you observed. If no app was safe to close, it shows that decision instead.

Before you review the finished record, consider whether resource activity or slowdown timing gives the clearest clue.

Compare your performance evidence record with the checklist below.

What Your Record Should Contain

The existing workload description.
The existing safety rules.
The existing tool-access results.
A pre-workload Processes-tab baseline.
A two-minute workload observation.
The busiest recognizable CPU app or process.
The busiest recognizable Memory app or process.
The busiest recognizable Disk app or process.
The time when the slowdown appeared.
The observed effect of closing a recognized unused app.

You caught the slowdown while it was happening, which turns a vague complaint into evidence. Next, you will pair that live snapshot with health status from Windows Security and history from Event Viewer.

Trace Health Warnings and Crashes

Your Task Manager baseline captured resource pressure while the slowdown was happening. Once the freeze ends, those live numbers cannot preserve what happened.

You will now add health status from Windows Security. You will also use Event Viewer to look for an Application event near the time of a recent freeze or crash.

In this step, get ready to:

Document the Windows Security health report.
Inspect the Application log near the time of a recent freeze or crash.
Capture the closest relevant Application event or a valid no-match result.

Review device health warnings

The Device performance & health page summarizes areas that Windows checks for potential problems. Its status marks help you identify recommendations that support your diagnosis.

Switch back to Windows Security from earlier.
Select Device performance & health.

You should see each available health area marked with a green check or a yellow mark.

Record every visible health area with its green check or yellow mark in your performance evidence record.
Rewrite each visible recommendation in your own words in the same record.
Leave any restricted setting unchanged.
Record any access restriction in your performance evidence record.

How to Read the Health Report

A green check means Windows reports no issue for that area.
A yellow mark means that area needs attention.
A recommendation gives you evidence to retain for the later administrator handoff.

Device Health Page Missing?

Organization policy can hide Device performance & health on a managed PC. Your access-restriction note preserves that result without bypassing the policy.

Help me understand a restricted Device performance & health page.

Match Application events to the slowdown

Application events preserve time-based evidence after a freeze has ended. A nearby Error entry gives you a clue to compare with the workload.

Matching timestamps can feel fiddly because the log can contain unrelated events.

Switch back to Event Viewer from earlier.
Expand Windows Logs in the left pane.
Select Application.
Use the recorded date and time to focus on the recent freeze or crash.
Inspect nearby Error entries for the familiar app or process from your workload.

You should now have either a plausible time match to inspect or no matching Application event.

Why Time Matching Matters

Treat a nearby event as a clue. Time proximity helps connect it to the slowdown without claiming automatic root-cause proof.

An unrelated event can send an administrator in the wrong direction. A documented no-match result is useful evidence.

Record the event evidence

The event detail view shows the fields that make a clue useful for escalation. A consistent record lets an administrator continue from your evidence.

Double-click the closest relevant event if one matches the recorded time.
Record its Source.
Record its Date and Time.
Record its Event ID or error code.
Summarize its message in one short sentence.
Record No matching Application event if no entry matches the time.

Your record now contains either a time-matched clue with its identifying details or the explicit no-match result.

Before you verify the record, do you expect the slowdown to line up with an Application event?

Return to Windows Security from earlier.
Confirm every visible health status is recorded.
Confirm every recommendation is paraphrased.
Return to Event Viewer from earlier.
Confirm Application remains selected under Windows Logs.
Review your completed performance evidence record.

You should see the Device performance & health findings beside either the relevant Application event details or No matching Application event.

That is the missing history captured. Your live baseline now has health context plus time-based evidence.

Your diagnosis now connects live resource pressure with Windows health information and event history. Next, you will use this evidence to choose safe user-level fixes.

Apply Safe User-Level Fixes

Your live baseline now has health information plus time-based event evidence. Those clues support focused changes to the performance contributors you can safely control.

This step stays within your standard account permissions. Administrator-level repair remains part of the handoff if these changes do not improve the PC.

In this step, get ready to:

Review startup impact in Task Manager.
Clean recognized temporary items through Settings.
Run a Quick scan in Windows Security.

Control startup load

Startup apps launch when you sign in. An optional app with greater startup impact can consume resources before you begin your familiar workload.

Return to Task Manager from earlier by pressing Ctrl + Shift + Esc.
Select Startup apps in the left navigation.
Review the Startup impact shown for each app you recognize.
Identify one recognized optional app that you do not need at sign-in.

Protect Essential Software

Security software protects the PC. Accessibility tools support how someone uses it.

Input software controls connected devices. Backup software protects files.

Hardware-control software can manage device features. Leave every uncertain app unchanged.

Prefer a suitable app marked High Impact or Medium Impact when one is available.
Record the optional app's name in your performance evidence record.
Record its Startup impact.
Select the optional app.
Select Disable.
Record that protected software stayed unchanged.
Document a no-change decision if no listed app is clearly optional.

That careful choice keeps the startup test focused on one optional app. You should now see that app disabled or have a written reason for making no change.

Can't Make a Safe Startup Choice?

Leave the app unchanged if you cannot identify its purpose.
Record the restriction if device policy prevents the change.
Keep the current setting while you confirm what the app does.

Use the app name to get targeted help without changing its state: Help me decide whether this Windows startup app is optional and safe to disable.

Clean recognized temporary items

Cleanup recommendations groups storage items that Windows considers removable. Your review determines which temporary items belong in this controlled test.

Switch back to Settings from earlier.
Select System.
Select Storage.
Select Cleanup recommendations.

You should now see the cleanup categories available to your signed-in account.

Keep Personal Files Protected

Removing files can feel risky. This cleanup stays limited to temporary items you recognize.

A previous Windows installation can support a return to an earlier Windows version. Removing it cannot be undone through this project.

Review every item under Temporary files.
Leave personal files unselected.
Leave Downloads unselected.
Leave Files synced to the cloud unselected.
Leave every previous Windows installation item unselected.
Select only temporary items that you recognize.

Your selection should now contain only deliberate temporary-item choices. Every excluded personal category should remain unselected.

Select Clean up if you chose recognized temporary items.
Record the cleanup categories you reviewed.
Record the temporary-item cleanup result.
Document a no-cleanup result if no item was safe to select.

Your cleanup stayed within the boundary you set. The evidence record now reflects only storage that you deliberately approved for removal.

Can't Find a Safe Cleanup Item?

Record that no recognized temporary items were available if the list is empty.
Leave an item unselected if its purpose is unclear.
Record any policy restriction if Cleanup recommendations is unavailable.

Get help interpreting the category before selecting it: Help me understand a Windows Cleanup recommendations item before I remove it.

Run a Quick scan

A Quick scan checks common locations where malware can run. Its result adds a security check to your performance evidence.

Return to Settings from earlier.
Select Privacy & security.
Select Windows Security.
Select Virus & threat protection.
Select Quick scan.

You should see the scan begin or receive a prompt that requires a decision.

An administrator prompt is a safe stopping point for this standard-account project. A restart request is also recorded without approval because the controlled restart belongs to the next step.

Wait for Quick scan to finish if no prompt interrupts it.
Record the completed scan result.
Record any request for administrator credentials.
Stop that action without entering administrator credentials.
Record any request to restart.
Stop that action without approving the restart.

Quick Scan Unavailable?

Record the restriction if organization policy hides Virus & threat protection.
Keep the blocked result for your administrator handoff.
Avoid attempts to bypass the restriction.

Use the restriction you can see to get targeted help: Help me interpret why Quick scan is unavailable on my standard Windows account.

Before you check, which of your three results do you expect to remain visible when you return to each tool?

Return to Startup apps in Task Manager.
Confirm the chosen app is disabled or review your documented no-change decision.
Return to Cleanup recommendations in Settings.
Confirm the cleanup result or review your documented no-cleanup decision.
Return to Virus & threat protection in Windows Security.
Confirm the Quick scan result or review the blocked prompt you recorded.

You should now see the chosen startup app disabled or have a documented no-change decision. Your performance evidence record should also contain the cleanup result plus the Quick scan result or blocked prompt.

Your safe fixes now have visible states plus written reasons. Next, you will restart the PC and repeat the same two-minute workload to measure the impact.

Restart, Retest, and Decide

Your before baseline captured the slow workload before any safe changes took effect. Your cleanup result is recorded too.

A restart applies the startup decision before you repeat the same workload under similar conditions. The comparison turns a feeling into evidence you can use or hand to an administrator.

In this step, get ready to:

Restart the PC with your work saved.
Repeat the same two-minute workload with Task Manager available.
Label the outcome and prepare an administrator handoff summary.

Restart and let the desktop settle

A restart closes open apps. Saving first protects your work. The restart gives your after-test a clear starting point.

Save any open work.
Select the Start button on the taskbar.
Select Power.
Select Restart.
Sign back in with the same standard account.
Wait until the desktop responds normally.
Wait until the taskbar responds normally.

That restart gives your after-test a consistent starting point. Your startup decision now applies to this session.

Repeat the two-minute workload

The after snapshot becomes useful when the workload matches your original test. Keep the duration and starting conditions as similar as possible.

Before you begin, do you expect the same CPU, Memory, or Disk activity to become busiest again?

Open Task Manager by pressing Ctrl + Shift + Esc.
Select Processes in the left navigation.
Recreate the workload conditions from your before test.
Start a two-minute timer.
Use the familiar workload normally until the timer ends.

This is the same observation window you used for the before baseline. The matching duration makes the comparison more credible.

Record the busiest recognizable entry under CPU with its displayed value.
Record the busiest recognizable entry under Memory with its displayed value.
Record the busiest recognizable entry under Disk with its displayed value.
Record the slowdown timing from this retest.
Record that no slowdown appeared when the workload stays responsive.

Strong work. Your after baseline now captures the busiest CPU, Memory, and Disk entries from a repeatable test.

Retest hard to compare?

Wait for unexpected update activity to settle before repeating the test.
Repeat the workload with the same app inputs from your before baseline.
Repeat the full two-minute observation window when an unrelated interruption affects the result.

Get help comparing an interrupted retest.

Label the result and prepare the handoff

The outcome label captures the direction of the change. Your recorded observations provide the evidence behind that label.

How to choose the outcome label

Use improved when responsiveness is better under similar conditions. Support the choice with your after observations.
Use unchanged when responsiveness and resource activity show no meaningful difference.
Use worse when responsiveness declines under similar conditions. Support the choice with the increased pressure or slowdown timing you recorded.

Before you compare the two baselines, which outcome do you think the recorded evidence supports?

Compare the before CPU observation with the after CPU observation.
Compare the before Memory observation with the after Memory observation.
Compare the before Disk observation with the after Disk observation.
Compare the slowdown timing from both tests.
Choose improved, unchanged, or worse as the final outcome.
Identify the top recognizable resource consumer across the comparison.

Your comparison now supports one clear outcome. The final label comes from the repeated workload instead of memory alone.

An administrator handoff keeps the evidence in one place. It gives an administrator a starting point when the result remains unchanged or gets worse.

Return to your performance evidence record from earlier.
Add a section titled Administrator Handoff Summary.
Add the selected workload to the summary.

The handoff now identifies the exact workload that was tested.

Add the before and after resource observations.
Add the top recognizable resource consumer.

The summary now shows what changed across the two-minute tests.

Add the Windows Security health finding from Device performance & health.
Add the relevant Event Viewer details or No matching Application event.

The handoff now connects the live baseline with the recorded health and event evidence.

Add the Quick scan result or blocked prompt.
Add the cleanup result from earlier.

The summary now records the safe checks completed before the retest.

Add the startup app decision with its recorded Startup impact.
Add the final improved, unchanged, or worse label.

The handoff now links your user-level change to the measured outcome.

Add every blocked administrator prompt from the project.
Add every blocked restart prompt from the earlier scan action.
Record that no blocked prompt occurred when your evidence contains none.
Review the completed summary against your performance evidence record.

You should now have an administrator-ready summary with the workload, both baselines, the top resource consumer, the supporting checks, the safe changes, and the final outcome.

That's a defensible diagnosis complete. You can now show what changed or give an administrator the evidence needed for the next repair decision.

Secret mission

A/B Test One Startup App

Test whether one optional startup app changes your PC's performance. You will compare two matching workload runs before choosing the app's final state from evidence.

Clean Up Your Resources

Choose how much of your completed diagnostic work to keep. Keeping these records has no ongoing cost because this project used built-in Windows 11 tools.

Resources you used:

Performance evidence record covering your before test, post-fix test, and controlled A/B test.
Administrator handoff summary containing the A/B comparison and final configuration reason.
Evidence-supported configuration for the recognized optional startup app.

Keep everything running

This option preserves your current configuration and evidence for future slowdowns.

Retain the performance evidence record for comparison with future tests.
Retain the administrator handoff summary for any issue that still needs support.
Leave the optional startup app in the final state supported by your A/B test.
Repeat the same two-minute workload if the performance problem returns.

Pause - I'll come back to this later

This option pauses the investigation without changing the evidence-supported configuration.

Make no further startup or cleanup changes.
Keep the optional startup app in its current final state.
Store the performance evidence record with the administrator handoff summary.
Resume with the same two-minute workload when you are ready to investigate again.

Delete - I don't want to use this again

Removing your written evidence is permanent. The administrator handoff remains useful until the performance issue is resolved.

Confirm that an administrator no longer needs your evidence.
Delete your performance evidence record from the app where you saved it.
Delete your administrator handoff summary from the app where you saved it.

The next actions apply only when the tested app is currently disabled and you want it to start automatically at sign-in.

Press Ctrl + Shift + Esc to open Task Manager.
Select Startup apps.
Select the recognized optional app from your A/B test.
Select Enable.

The app is now set to start automatically at sign-in.

Removed Temporary Files Stay Deleted

The Cleanup recommendations process already removed any temporary items you selected. This project has no restore path for those items.

Third-party recovery utilities remain outside this project.

Nice Work!

Excellent work! You built a Windows 11 performance first-aid report from repeatable observations. Your final evidence supports a user-level decision or a focused administrator handoff.

You've learned how to:

Reproduce a real slowdown with a repeatable two-minute workload in Task Manager. You captured the busiest CPU, Memory, and Disk activity before and after your changes.
Connect live pressure to health and event evidence. You recorded the Device performance & health status in Windows Security. You matched the slowdown time to the Application log in Event Viewer or documented No matching Application event.
Apply safe user-level fixes without administrator access. You repeated the same workload after a restart to label the result improved, unchanged, or worse. You prepared an administrator-ready handoff for any remaining issue.
Secret Mission: Run a controlled A/B test of one optional startup app. The app now finishes in the state supported by your measurements.

Ready to quiz yourself?