Why is my computer so slow (Windows 11): what is using my CPU, memory, disk and internet

Acutis · plain-English machine help · Episode 7 of the Acutis Go tutorial series · updated October 2026

This page is the text version of the video. Every command below was run on a real Windows 11 machine on 5 October 2026 (20 logical cores, 31.7 GB of memory, an NVMe drive) and every line of output is shown exactly as it printed. The machine was made slow on purpose, three times: a PowerShell script spinning a thread on every core, a 6 GB junk file written to the disk, and 12 GB of memory held and released. The only edit is the computer name.

Commands used in this video

In on-screen order. All of these need PowerShell, not Command Prompt. Replace <pid> with the Id number from the output above it.

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, Id, @{n='CPU(s)';e={[math]::Round($_.CPU,1)}}, @{n='MemMB';e={[math]::Round($_.WorkingSet64/1MB)}}

(Get-Counter '\Process(*)\% Processor Time').CounterSamples | Sort-Object CookedValue -Descending | Select-Object -First 8 InstanceName, @{n='CPU %';e={[math]::Round($_.CookedValue/[Environment]::ProcessorCount,1)}}

Stop-Process -Id <pid> -Force

Get-Counter '\Processor(_Total)\% Processor Time','\Memory\Available MBytes','\PhysicalDisk(_Total)\% Disk Time','\PhysicalDisk(_Total)\Disk Bytes/sec' -SampleInterval 1 -MaxSamples 6

(Get-Counter '\Process(*)\IO Data Bytes/sec').CounterSamples | Sort-Object CookedValue -Descending | Select-Object -First 6 InstanceName, @{n='MB/s';e={[math]::Round($_.CookedValue/1MB,1)}}

perfmon /res

Get-NetTCPConnection -State Established | Group-Object OwningProcess | Sort-Object Count -Descending | Select-Object -First 8 @{n='Process';e={(Get-Process -Id $_.Name).ProcessName}}, @{n='PID';e={$_.Name}}, Count

What it actually printed

Colour key, the same as the video: green is the healthy line, amber is the line that names the problem, or the line people misread.

Read the CPU(s) column and notice what is missing: this is a lifetime score, and the program eating the machine right now is not on it yet.

> Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, Id, CPU(s), MemMB
Name                     Id CPU(s) MemMB
----                     -- ------ -----
System                    4 3553.9    22
Taskmgr                3804 2842.1   205
dwm                    1688 2834.5   199
logioptionsplus_agent 10656 2627.4   183
MsMpEng                6960 2527.9   270
  ^ seconds since each program started, not what is happening now

Read the top row: this is right now, and one name has the whole machine.

> (Get-Counter '\Process(*)\% Processor Time').CounterSamples | Sort-Object CookedValue -Descending | Select-Object -First 8 ...
Process               CPU %
-------               -----
powershell             91.9
powershell              4.9
taskmgr                 0.7
svchost                 0.1
system                  0.1

Read the three samples after the kill: one line, four seconds, and the processor is back to a few percent.

> Stop-Process -Id 15160 -Force
> Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 3
5.7 %
12.8 %
4.2 %

Read Available, not what any one program holds: 12 GB held by a test program dropped it to 11,442 MB, and the moment the program let go it was back above 23,000.

> Get-Counter '\Processor(_Total)\% Processor Time','\Memory\Available MBytes','\PhysicalDisk(_Total)\% Disk Time' -SampleInterval 1 -MaxSamples 4
09:01:35  CPU   2.2 %   Available 11,442 MB   Disk    0.9 %
09:01:36  CPU   4.4 %   Available 20,388 MB   Disk    0.0 %
09:01:37  CPU   2.5 %   Available 23,792 MB   Disk    0.0 %
09:01:38  CPU   0.9 %   Available 23,794 MB   Disk    0.0 %
Total RAM GB: 31.7
Free RAM GB: 23.2

Read the Disk column against the CPU column: the disk is pinned at 96 to 103 percent while the processor idles at 2 to 7. This is the slow computer that Task Manager's CPU column says is fine.

> Get-Counter ... '\PhysicalDisk(_Total)\% Disk Time','\PhysicalDisk(_Total)\Disk Bytes/sec' -SampleInterval 1 -MaxSamples 6
09:00:54  CPU   5.5 %   Available 23,539 MB   Disk   96.5 %   Disk   203.3 MB/s
09:00:55  CPU   2.2 %   Available 23,541 MB   Disk   92.3 %   Disk   212.8 MB/s
09:00:56  CPU   5.8 %   Available 23,538 MB   Disk  103.1 %   Disk   305.2 MB/s
09:00:57  CPU   4.7 %   Available 23,536 MB   Disk   66.6 %   Disk   505.3 MB/s
09:00:58  CPU   0.8 %   Available 23,539 MB   Disk   68.1 %   Disk   533.1 MB/s
09:00:59  CPU   7.7 %   Available 23,521 MB   Disk   69.4 %   Disk   490.1 MB/s

Read the name next to the MB/s: the process writing the file. On a real machine it is usually the search indexer, a Defender scan or an update.

> (Get-Counter '\Process(*)\IO Data Bytes/sec').CounterSamples | Sort-Object CookedValue -Descending | Select-Object -First 6 ...
Process             MB/s
-------             ----
powershell         504.8
searchindexer          0
svchost                0
chrome                 0

Read the Count column: every program holding a connection to the internet, and how many. Task Manager shows speed; this shows who.

> Get-NetTCPConnection -State Established | Group-Object OwningProcess | Sort-Object Count -Descending | Select-Object -First 8 ...
Process                 PID   Count
-------                 ---   -----
chrome                  10344     2
LMS                     7260      2
Megaphone               11020     2
StartMenuExperienceHost 10804     2
sshd                    6952      1
svchost                 6936      1
LockApp                 17024     1
acutis-go               7244      1
  one name with 40 here is your answer

Three results that look like problems and are not

Get-Process shows System and Task Manager at the top of the CPU list. Are they the problem?

No. That column is CPU seconds since the program started, a lifetime score, and anything that has been running for days sits on top of it. The program eating the machine right now may not appear at all; in the video the hog was invisible on this list while the whole machine sat at 100%. For right now, use Get-Counter on the process counters and divide by the core count.

Chrome is holding 4 GB of memory. Is that why my computer is slow?

Almost never. What one program holds is not the number that matters. Watch Available on Task Manager's Performance, Memory page. On the machine in the video, 19 GB in use still left 12.7 GB available and nothing slowed down. Available near zero is when Windows starts swapping to disk, and that is the slow that feels like molasses.

Task Manager shows 100% disk but the CPU is nearly idle. Is the drive failing?

Usually not. A pinned disk with an idle processor is the signature of the search indexer, an antivirus scan, or an update unpacking, and the CPU column says nothing is wrong. Open Resource Monitor (perfmon /res), Disk tab, and read which process is writing which file. Let it finish, or stop it by name. A drive that is actually failing shows the same picture with far lower MB/s and errors in Event Viewer.

The checklist

1. Ctrl + Shift + Esc, Processes, read the four percentages at the top of the columns.
2. Click the highest column. The name floats up.
3. Get-Counter is right now, Get-Process is the lifetime total. Know which one you are reading.
4. Stop-Process -Id <pid> -Force when it is a program you do not need.
5. Memory: watch Available, not what one program holds.
6. Disk pinned with the CPU idle: indexing, a scan, an update. Name it in Resource Monitor.
7. Get-NetTCPConnection grouped by process: who is on the internet.
8. Write down your healthy numbers once, so you know what wrong looks like.

Chapters

• Why is my computer so slow
• A slow computer has four suspects
• Task Manager: the free look
• Making it sick on purpose
• Task Manager: CPU 100%, one name on top
• Get-Process versus Get-Counter, and Stop-Process
• Task Manager: Performance, Memory
• Disk pinned, processor idle
• Task Manager: the Network column, and who is on the internet
• The checklist
• Doing this on six hundred machines

The four suspects

Everything a computer does is one of four jobs. The processor thinks. Memory holds what is open right now. The disk holds everything else, and has to hand it over when a program asks. The network is the door to the internet. When the machine feels slow, one of the four is usually pinned near 100% and the other three are bored. Task Manager shows all four as columns with one percentage at the top of each, and that top number is the whole machine. Click the column that is highest and the biggest user floats to the top of the list. Most of the time the diagnosis ends there, and the fix is to close or stop that one program.

Why Task Manager is sometimes not enough

Task Manager shows the processor two ways and neither is labelled. The Processes page shows right now. The Get-Process command, and the Details page sorted by CPU time, show a lifetime total, which is why System and the desktop manager always lead it. If you only remember one thing from this page: Get-Counter is now, Get-Process is history.

The disk fools people in the other direction. Writing 6 GB of junk pinned the drive at 96 to 103 percent and 200 to 500 MB/s while the processor sat at 2 to 7 percent. The machine feels dead, and the CPU column, the one everyone looks at, says nothing is wrong. Resource Monitor's Disk tab names the file and the process.

The network column only shows speed. The thing that makes a machine slow in the background, a program quietly uploading with forty connections open, shows as a few kilobits a second. Get-NetTCPConnection grouped by the owning process is the only built-in way to see who is holding the door open.