There is sometimes a situation when Windows suddenly goes crazy: is slow, unresponsive, some things don't work, it crashes. I wonder how do you approach diagnosing those issues.

I'm merely a programmer, not really knowing Windows too deply. There is probably more people like me... I strongly believe that experienced Windows administrators have a bunch of useful tricks that can make diagnosing easier.

Please post your techniques, the more advanced/tricky/unstandard, the better.


Let me start with the list:


  • Install most current updates/service packs.
  • Verify drivers, look for conflicts, upgrade to newer ones.
  • Use Process Explorer to see a bit more details about what's being run
  • Use Process Monitor(combined filemon and regmon) to see details about particular process
  • Check the services - (services.msc from command prompt).
  • Problems with graphics/sound (especially with older apps) - verify DirectX (run dxdiag from console), try disabling hardware acceleration.
  • See what's being run on windows boot time - Windows start points
  • Scan for viruses (anyways, you should have it updated and running all the time).
  • Run some anti-malware tool
  • Look at windows event log (eventvwr from console)
  • Make sure there is at least ~250mb free space on Windows drive.
  • Check virtual memory settings.


  • See network settings (from console: ncpa.cpl and ipconfig /all)
  • Inspect firewall configuration. If you have turned Windows firewall off, check if it isn't started up.
  • Look if hosts file is not modified %WINDIR%\System32\drivers\etc\hosts


You should know most (if not all) of it already, but hopefully this helps somebody.

  • Be careful with the order of Apply Updates and Check Firewall - I've been bitten when a service pack re-enabled it. – dmo May 1 '09 at 23:38

Start -> Run -> msconfig -> startup tab

Uncheck everything. Restart and try to duplicate the problem (some apps/services will not function). If the problem is resolved, go back into msconfig and re-check half the startup items. Restart & duplicate the problem. Narrow the services down by 1/2 each time.


If you are in the a wondrous situation where you have an image of a workstation you can just nuke it, if it was a software problem its fixed, if its a hardware problem you now know.

  • On my test machines, "Apply Snapshot" is a god-send. – dmo May 1 '09 at 23:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.