The Slow Computer: What It Usually Is and the Five-Minute Check

Wednesday, 08:35, at Redbrook Engineering. Halima in the estimating office has started arriving at twenty past eight to switch her desktop on. By the time it is usable it is nearly half past, and the first tender call is at nine. Her ticket says "Computer takes forever to start. Can I have a new one?" Underneath, because the desk's knowledge base card asked her to, she has written three timings: eleven minutes twenty, ten minutes fifty, eleven minutes five. These run from the power button to being able to open the estimating software. Ben takes the spare laptop up to her desk, plugs it into her network cable and times it: ninety seconds. He writes "the machine" in the note and opens the card that is the subject of this article. He has not touched anything yet, and he will not for another four minutes.

The slow computer is the slowness ticket where the number stays with one machine. The spare at the same desk doing the same task is quick, this one is not, so the cause is inside the box. The good news is that there are only about six places for it to be, and five of them can be checked in the time it takes the machine to start. This article is part of our The Vague Slowness Complaint series. It starts where the measurement article ends: with a task, a stopwatch number and a spare that was faster. It is about the machine that works, slowly. The machine that does not work, or that is slow because something in it is failing, belongs to the hardware ladder in The Diagnostic Order. The last block on the card is the one that sends it there.

It starts with why the cause is almost always one of six. Then come the six in turn: start-up items, the full disk, too little memory and the browser that eats it, the security agent doing its scan, and age. Next is the five-minute check in the order the six are cheapest to rule out, followed by when it is hardware. A short war story and the slow-computer card to copy finish the article.

Why the Cause Is Almost Always One of Six

A machine that was quick and is now slow, with no fault showing, is slow for one of a short list of reasons. The list is short because there are only a few things a computer can run out of. It can run out of time at start-up, because too many programs want to start at once. It can run out of disk space, which the operating system needs as working room. It can run out of memory, which makes it use the disk as memory, which is slow. It can be busy doing something for somebody else, which is what a security scan is. And it can simply be old, which is not a shortage of anything except years. The browser gets its own entry because it is the commonest way a machine runs out of memory, and because the fix is a conversation rather than a setting.

The order matters more than the list, and the order is cheapest first, as it is on the hardware ladder. Looking at free disk space takes ten seconds and costs nothing; adding memory takes an hour and a purchase order. A desk that checks in the expensive order replaces memory in machines that needed a disk clear-up. I have done it, more than once, with a straight face and a budget code. The six, in the order the card checks them, with what each one feels like to the person at the keyboard, are in the table below.

Start-Up Items: The Queue at the Door

Every program that is set to start with the machine starts with the machine, all at once. They queue for the same disk and the same processor like a crowd at a single door. The operating system starts its own services first, then the security agent, then the management agent. Then every updater that an installer ever added to the list without asking. Then the chat tool, the cloud sync tool, the printer utility, the three things the previous user installed and the one thing the current user installed last week. On a machine with a spinning disk this queue can take ten minutes to clear. The desktop is visible after two of them, which is why users describe it as "it shows the desktop but nothing works".

The tell is in the stopwatch and the disk light. Start-up measured from the power button to a program opening is long. The same machine, once it has settled for five minutes, is fine. The disk light stays on solidly for minutes after sign-in. The operating system's own list of start-up programs shows what is in the queue and usually how much each item costs. Windows has carried this in one form or another for as long as I have used it. Read it with the user, because they know which of the entries they use and the desk does not.

The fix is to stop starting the things that do not need to start. Updaters can run when the program runs. The cloud sync tool for a service the user stopped using can go. The chat tool can start when they open it. The security and management agents stay, always, and the desk does not argue about those. Time the start-up again after the trim and write both numbers in the note. A start-up that goes from eleven minutes to three has told the user something they can see. A start-up that goes from eleven to ten has told the desk to keep looking.

Start-up lists grow back, because installers add to them and updates re-enable them. That is one reason the same slow-start ticket returns a year later and why the trim goes in the note with its date. (Installers have never once asked whether their updater needs to be in the queue. They consider it self-evident.)

The Full Disk

The operating system needs free disk space to work, not only to store things. It uses the disk as overflow memory, as scratch space for updates, and as a place to write temporary files. When there is almost none left, everything that touches the disk slows down together. A machine with a full disk is slow at saving, slow at opening, slow at starting, and will sometimes say so in a message the user has learned to dismiss. It is the single most common cause on the list in my experience, and the cheapest to check: the free space is visible in the file browser in ten seconds.

Where the space went is usually one of five places. The downloads folder, which nobody empties. The recycle bin, which people think of as deleted. Old user profiles on a machine that has had several owners, each carrying its own copies of everything. The caches that the browser, the mail client and the cloud sync tool keep, which grow until something stops them. And the large files that should have been on the file service. The video of the product demonstration, the photo library, the backup of the old laptop that was copied over "just for now" three years ago. Look at those five before anything cleverer, because together they are nearly always the answer.

Clear with the user, not for them. The downloads folder contains things they wanted, the recycle bin contains things they will want again the day after it is emptied, and the large files belong to somebody. Spend ten minutes beside them, moving the demonstration video to the file service and emptying what they agree can go. That is faster than any amount of explaining afterwards why the tender from last spring is gone. Then time the task again.

How much free space is enough is an honest edge. I keep at least a tenth of the disk free on any machine I am responsible for, and more on small disks. That is a habit rather than a rule. A desk should pick its own margin, write it on the card and apply it everywhere. A machine that drifts below the margin is a ticket waiting to be raised. A monthly sweep of free space across the fleet catches it before the user does. That is the subject of the disk space sweep in the proactive remediation series.

Too Little Memory, and the Browser That Eats It

Memory is the fast working space a machine keeps its running programs in. When it is full, the operating system moves the least recently used parts out to the disk and brings them back when they are needed. This is called swapping. It is slow in exactly the way users describe: fine with two things open, a crawl with ten, and a pause every time they switch windows. The tell is in the operating system's task monitor, the built-in view of what is running and what it is using. Memory is shown as full or nearly full, and the disk is busy at the same time, because the swapping is the disk activity.

Check it with the user's usual set of programs open, not on a clean desktop. A machine timed at nine in the morning with nothing running has plenty of memory. At eleven the same machine has the mail client, the estimating software, the spreadsheet, the chat tool and the browser open. That is the machine the user complained about. Open the task monitor at that point and sort by memory. The answer is usually at the top of the list, and it is usually the browser.

The browser with ninety tabs is a memory problem with a human cause. The tabs are the user's to-do list, their reading pile and their memory of what they were doing on Tuesday. Closing them feels like losing all three. Each tab is, to the machine, a program; ninety of them with a handful of extensions on top can take most of the memory on a modest machine by themselves. The tell is simple: close the browser and the machine is fine; open it and the machine is not. The fix is not a setting. It is a conversation, held kindly, about bookmarks and about the browser's own option to bring back the old tabs only when asked. And about the extensions that were installed to do one thing once. Nobody keeps ninety tabs open because they want a slow computer. They keep them because closing one feels like forgetting.

Adding memory is the right fix when the machine takes more and the user's work genuinely needs it. The estimator with the large spreadsheets, the designer, the person who runs three applications that each want a lot. It is the wrong fix for the browser habit, because the habit will fill whatever is added. It is the wrong fix for an old machine that is being replaced in six months. Time the task before and after, as always. Memory that does not change the number was memory the machine did not need. The next machine with the same symptom should get the check, not the upgrade.

The Security Agent Doing Its Scan

A security agent that scans the whole disk at a scheduled time is doing exactly what it should. For the duration of the scan the machine is working for the agent rather than for the user. The ticket that results has a time of day in it, if anyone asked: slow from nine to half past, or slow for twenty minutes after sign-in, and fine afterwards. The tell is the task monitor at that time, with the agent at the top and the disk busy, and the agent's own schedule, which matches the complaint to the minute. It is the cause that the question "when" was invented to catch.

The fix belongs to whoever owns the security tool, which on a small desk may be you on a different day of the week. The fix is a schedule, not a switch. Scans can usually be moved to lunchtime, to the end of the day, or to a time when the machine is on and the user is not at it. Some tools can be told to go gently while the user is active; the agent's owner knows which. Never disable the agent, never add exclusions to make a machine feel faster, and never let a user talk you into either. A fast machine with no protection is a different ticket, and a much worse one. Ask, with the numbers: "the scan on the estimating office machines runs at nine and the office starts at nine; could it run at half past twelve?" An owner who sees the stopwatch figures beside the schedule will usually agree in a sentence.

The same logic covers the other scheduled things a machine does. The backup client, the update that installs at sign-in, the management agent's inventory run, the sync tool's first pass of the morning. Each has an owner and a schedule, and each is innocent most of the day. A machine that is slow at a set time is not slow; it is busy, and the question is whether it needs to be busy then.

Age

An old machine is slow at everything, consistently, and matches its twin. The sorting test in the second article of this series applies. If it is as fast as it was and as fast as its kind, it is not broken, it is old. The two things that age most visibly are the disk and the memory. A machine with a spinning disk starts, opens and saves at a fraction of the speed of one with a solid-state drive. A machine with the memory that was generous when it was bought may be short now that every program wants more. Neither is a fault. Both are reasons the machine is on the refresh list, or should be.

The decision about an old machine is whether it is worth an upgrade, and the honest arithmetic is in hours. A solid-state drive and a memory upgrade on a machine with a spinning disk can take start-up from ten minutes to one and every task with it. That costs an hour or two of a technician's time plus the parts. If the machine has two or three years of useful life left, that is a good trade. If it is being replaced in the next round anyway, it is an hour spent on a machine that will be in the recycling pile by spring. Swap, repair or retire is a hardware decision and the hardware series has it, in Swap, Repair or Retire. The slowness desk's contribution is the number that shows the machine is old and not broken, and the count of how many machines like it there are.

That count is where age stops being one ticket and becomes a case. One old machine is an expectation. Twelve of the same model, all slow, all raising tickets, is a refresh case with the evidence attached. The tickets are the evidence; Tracking Slowness Tickets as a Signal is about turning the twelve into a page a budget holder can read. Write the model and the age in every slow-computer note, because the case will be built from them later and nobody will remember which machines they were.

The Five-Minute Check in Order

The check is the six suspects in the order they are cheapest to rule out. It takes about five minutes at the desk once the stopwatch number and the spare's number are in the ticket. First, the time of day and the since-when from the intake. A slow-at-nine ticket goes to the scan step first, a slow-since-the-update ticket goes to the start-up list first, and everything else goes in order. Second, free disk space, from the file browser, ten seconds. Third, the task monitor with the user's usual programs open: memory, disk activity, and what is at the top. Fourth, the browser: tabs, extensions, and whether closing it changes the number. Fifth, the start-up list, read with the user. Sixth, the scan and backup schedules against the time of day. Seventh, the model and age against its twin.

Each step either finds something or clears a suspect, and each finding is a change to be made one at a time with a timing after it. A desk finds a full disk, a long start-up list and ninety tabs on the same machine, which is common. It clears the disk first and times, trims the list and times, and has the tab conversation last. There are three numbers in the note that show which change did what.

Write each step into the ticket as it is cleared, not afterwards, in an internal note the user does not see, and keep the plain-words version for the reply. The note is the handoff if the ticket goes to the hardware ladder, and it is the record that stops the ladder being climbed from the bottom again by the next technician. Where the same model keeps turning up with the same finding, link the tickets together under one parent so that the pattern is visible in one place. In QuerySolv linking tickets is an ordinary part of working one, and the event history on each shows the check being done. That is what makes the replacement case later a filter rather than a search through people's memories. Most tools can link tickets one way or another; the habit is what matters.

When It Is Hardware

The check ends with a machine that is still slow after the six, or with a sign along the way that the slowness is a fault rather than a shortage. Either sends the ticket to the hardware ladder. Three signs are worth knowing. The first is the disk that is failing. The machine pauses for seconds at a time with the disk light on and nothing in the task monitor to explain it. It takes far longer than its twin to do anything that touches the disk. Its operating system may have begun logging disk errors, or warning about the drive's health in its own words. A failing disk gets backed up today and replaced, and the slowness ticket has become an urgent hardware ticket in the middle of a sentence.

The second is heat. A laptop whose fan runs constantly and whose processor slows itself down to stay cool has blocked vents, a failed fan or a bed-and-blanket working position. It gets slow in the afternoon in a way that no setting explains. The tell is the fan, the heat under the hand and the task monitor showing the processor busy with nothing much. The third is the power and battery path. A laptop running on a failing battery or a charger that is not the right one will slow itself to match the power it has. The tell is that it is fast on the right charger and slow without it. All three are rungs on the ladder, and the hardware series climbs them in the right sequence.

Hand the ticket over with the check in it. The hardware technician, who may be you after lunch, starts from six cleared suspects, three timings and the model number, and does not re-clear the disk space. And when the same model keeps arriving with the same hardware fault, that is a lemon model. The article Device and Model Hotspots is where the pattern becomes a decision about the whole batch rather than one more repair.

A Short War Story: The Nine O'Clock Crawl at Larkfield Academy

At Larkfield Academy, a secondary school with a desk of one and a half, a technician called Priya took a run of tickets from the staff room over a single term. All said the shared machines were unusable first thing. All were closed, by her predecessor and then by her, with a restart and the words "fine now". After the ninth ticket the deputy head asked for new machines. Priya ordered memory for all twelve staff-room machines instead, on the grounds that it was cheaper, and spent a day fitting it. The following Monday the machines were as slow at nine as they had ever been. The slowness had a time of day that nobody had written down. The security agent's full scan was scheduled for nine on every machine in the school, and the sign-in script ran at the same time. The staff room's twelve machines all did both at once in the only ten minutes of the day when twelve teachers wanted them. The scan moved to half past twelve, when the staff room is empty. The nine o'clock start-up went from nine minutes to under two on the stopwatch, with the new memory making no measurable difference to anything. The cost was a day of Priya's time, memory for twelve machines that did not need it, and a term of teachers who had learned to arrive early. "When" would have been a one-line answer, and nobody had asked it.

The Slow-Computer Card

The card below is the five-minute check as a single page, filled in at the desk and pasted into the ticket as an internal note. The header carries the numbers from the intake. The steps are in the order they are cheapest; each has a finding line and a timing line. A step that found something is followed by a change and a measurement before the next step is started. The last block is the handoff to the hardware ladder, filled in only when the check ends there. Keep it beside the intake questions in the knowledge base, and keep the top half short enough that a user with a stopwatch could do the first step themselves.

THE SLOW-COMPUTER CARD — SIX SUSPECTS, CHEAPEST FIRST
Ticket: ________   Device: ______________   Model / age: ______________   User: ______________
Task timed: ______________   This machine: ____ s   Spare at same desk: ____ s   Time of day: ______
Since when: ______________   What changed then: ______________

STEP 0. THE CLUES FROM INTAKE
   Slow at a set time of day ............ go to step 5 first
   Slow since an install or update ...... go to step 4 first
   Otherwise ............................ in order

STEP 1. FREE DISK SPACE (ten seconds)
   Free: ____ of ____   Below the desk's margin: yes / no
   Cleared with the user: downloads [ ]  recycle bin [ ]  old profiles [ ]  caches [ ]  large files moved [ ]
   Timing after: ____ s

STEP 2. MEMORY AND DISK ACTIVITY (task monitor, user's usual programs open)
   Memory: full / nearly full / fine     Disk: busy / idle     Top of the list: ______________
   Machine takes more memory: yes / no   Work needs it: yes / no   Timing after any change: ____ s

STEP 3. THE BROWSER
   Tabs: ____   Extensions: ____   With the browser closed the machine is: fine / still slow
   Conversation held: bookmarks [ ]  old tabs not restored [ ]  extensions trimmed [ ]   Timing after: ____ s

STEP 4. START-UP LIST (read with the user)
   Entries: ____   Stopped: ______________________________   Kept: security agent, management agent
   Start-up before: ____ s   after: ____ s

STEP 5. THE SCAN AND THE SCHEDULES
   Security scan time: ______   Backup: ______   Updates: ______   Inventory: ______
   Matches the complaint: yes / no    Asked the owner to move it to: ______   Agent left enabled: [ ]

STEP 6. AGE AND THE TWIN
   Same model, same age, same number: yes / no    Spinning disk / solid state
   Expectation, refresh list [ ]     Upgrade worth it, years of life left: ____ [ ]

HANDOFF TO THE HARDWARE LADDER (only if the check ends here)
   Sign: pauses with disk light on [ ]  disk errors or health warning [ ]  heat or fan [ ]  power or battery [ ]
   Backed up before anything else: [ ]   Ticket linked to the parent for this model: ________

Ben's card on Halima's machine stopped at step one. It found a disk with a sliver of space left and a downloads folder holding every tender drawing she had ever received. The card went on to step four for completeness, which found eleven updaters in the queue. Start-up went from eleven minutes to two and a half after the clear-up, and to just under two after the trim. Halima timed both herself. She did not get a new machine. She got twenty minutes of her morning back, which she said was better, and the desk got a note that will save the next technician the walk.

Frequently Asked Questions