When a Windows machine becomes slow, reinstalling the operating system is often treated as the first move. It should usually be much later in the process.
A reinstall changes many variables at once, creates avoidable recovery work, and can hide the real cause: a failing disk, too little free space, an aggressive startup application, an incomplete update, thermal throttling, or a workload that has simply outgrown the hardware.
Here is the read-only triage sequence I use before making changes.
1. Confirm scope, ownership, and recovery options
Before opening an administrative shell, answer four questions:
- Is this the owner's device, or do they have written authority to manage it?
- Is important data backed up, and has the backup been tested recently?
- What must not be changed during this session?
- What is the observed symptom: slow boot, slow login, high disk usage, application lag, update failure, or random freezes?
Write down the Windows version, device model, approximate age, time of the last known-good state, and any recent software or driver changes. A short timeline is more useful than “it has been slow for months.”
2. Establish a baseline
Start with built-in tools and capture findings before changing anything.
Get-ComputerInfo |
Select-Object WindowsProductName, WindowsVersion, OsBuildNumber,
CsModel, CsTotalPhysicalMemory
Get-Volume |
Select-Object DriveLetter, FileSystemLabel, FileSystem,
HealthStatus, SizeRemaining, Size
Low free space is a common contributor, but do not delete files merely because a drive is full. Identify what owns the space, confirm retention requirements, and agree on what may be removed.
Check the storage device's reported health:
Get-PhysicalDisk |
Select-Object FriendlyName, MediaType, HealthStatus,
OperationalStatus, Size
This is not a complete hardware diagnostic. If the disk reports an unhealthy state, the priority becomes backup and replacement planning—not “cleanup.”
3. Inventory startup pressure
Use Task Manager's Startup Apps page for impact estimates, then collect the configured startup entries:
Get-CimInstance Win32_StartupCommand |
Select-Object Name, Command, Location, User
Do not disable everything. Security tools, accessibility software, device utilities, synchronization clients, and business agents may be required. For each candidate, record the owner, purpose, and rollback action before disabling it.
4. Look for a time-correlated system error
Instead of scrolling through every event, limit the initial sample to recent high-severity events:
$start = (Get-Date).AddDays(-7)
Get-WinEvent -FilterHashtable @{
LogName = 'System'
Level = 2
StartTime = $start
} -MaxEvents 50 |
Select-Object TimeCreated, ProviderName, Id, Message
An error in the log is not automatically the cause. Look for repetition and correlation with the user's timeline. Record event IDs and providers; avoid pasting logs containing personal or company data into public tools.
5. Verify system files without repairing yet
These commands are useful when corruption is plausible and you want evidence before repair:
DISM.exe /Online /Cleanup-Image /ScanHealth
sfc.exe /verifyonly
ScanHealth and verifyonly are diagnostic choices. Repair commands change system state and should come later, after backup status and rollback expectations are clear.
6. Separate software limits from hardware limits
During a controlled reproduction of the problem, watch CPU, memory, disk active time, and the specific process involved. A machine with 4 GB of RAM running a modern browser, conferencing software, security agents, and development tools may be behaving exactly as its hardware allows.
That distinction matters. Software cleanup cannot honestly promise to turn insufficient hardware into a fast workstation.
7. Finish with a written decision
A useful triage session should end with one of these outcomes:
- No change: evidence is insufficient or the risk is too high.
- Low-risk change: a small, reversible action with an explicit rollback.
- Escalation: hardware diagnostics, vendor support, data recovery, or a specialist is required.
- Rebuild plan: a reinstall is justified, with backups, license information, required applications, and restore testing prepared first.
The deliverable is not “I ran a cleaner.” It is a record of observations, actions, exclusions, and next steps.
A transparent service note
I currently offer a fixed-scope remote Windows health check: up to 75 minutes covering storage, startup items, updates, and basic security state, followed by written findings. The price is CNY 499 per device.
I only work on devices the client owns or is authorized to manage. Backup status and scope are confirmed first. I do not install pirated software, bypass licenses, access unrelated files, or provide network-restriction circumvention. Hardware repair and guaranteed speed improvements are outside the scope.
If that scope fits your situation, the intake form is here: https://docs.google.com/forms/d/e/1FAIpQLSc_qNpMHC0IAQWhqw2LTDflcfJ7s-3hyL0q-VkzyjT4YbqaFw/viewform
