A Windows server or application is simply too slow
Task Manager shows nothing obviously wrong, yet the workload it hosts is missing its numbers.
System performance experts
Get a Windows performance answer below the symptom line.
Kritical investigates Windows performance using the operating system's own observable behaviour: workload, scheduling, memory, I/O, services and the dependencies around them, captured with the same Event Tracing for Windows and Windows Performance Analyzer toolset Microsoft's own engineers use, for a clear, evidence-based explanation instead of a guess.
On this page
Choose where to start.
Jump to the part that matches the problem or decision in front of you.
Use the arrows or scroll to see every card.
Who asks for a Windows internals investigation.
This work usually starts with one of three situations.
High CPU or memory that nobody can explain
A counter is red, but nobody can say whether it is a cause, a symptom, or a red herring.
An incident report that does not survive scrutiny
A previous investigation blamed a component without evidence, and the problem has come back.
Ask the operating system a precise question.
High utilisation is not automatically a fault, and low utilisation does not prove that work is flowing. We start with the delayed operation and examine the resources, queues, waits and dependencies capable of explaining it. The capture plan is proportionate to the environment and change controls, particularly where tracing overhead or sensitive payload data must be considered.
- CPU and scheduling Distinguish useful execution, contention, saturation and work waiting elsewhere.
- Memory and lifecycle Examine pressure, allocation behaviour, paging, leaks and the effect on the service.
- Processes and services Relate process, thread and service activity to the user-visible transaction.
- I/O and dependencies Follow file, storage, network, identity and name-resolution paths beyond the host.
What the toolkit is.
This is not a proprietary black box. It is a disciplined, vendor-neutral use of the tools built for exactly this job.
ETW and Windows Performance Analyzer
Full-system traces of CPU, disk, network, registry and application events, correlated on one timeline.
Sysinternals
Process Explorer, Process Monitor and their relatives, to see exactly what a process, handle or file is doing.
Performance counters and event logs
The baseline evidence, read in context rather than in isolation.
Application and platform logs
Correlated against the same timeline so a Windows finding can be checked against what the application itself recorded.
Correlate counters, traces and operational context.
We line up timing, workload and recent changes with the available Windows, application and configuration data. An ETW trace read in Windows Performance Analyzer can show a thread waiting on a lock, a disk queue building, or a process paging when it should not be — but only when it is read against the transaction that mattered to the business. Where the picture is incomplete, we say what needs to be captured next instead of guessing at a cause.
Fix the constrained path and prove the result.
Recommendations separate immediate risk reduction from durable correction. Changes may involve configuration, code, workload, platform design or another supplier. Before implementation, we define rollback and a comparable verification run. If the evidence points outside Windows, the investigation follows the dependency instead of forcing a Windows-only answer.
How the work is priced.
A first Windows performance investigation is scoped and quoted once we know the affected system, the transaction and the access available. Straightforward engagements are fixed-price; open-ended or intermittent problems are priced in stages with a decision point after each capture.
Get a scoped quote
Send the affected server or application and what “slow” looks like in practice.
What happens after you get in touch.
The first call establishes the affected system, the transaction and what evidence can realistically be captured, and ends with a scoped, priced plan rather than a guess. Subject to the agreed scope and available evidence, an initial investigation can move from capture through a dependency-aware finding to an agreed fix with a defined rollback.
Pair Windows evidence with the security responsibility around it.
Windows internals evidence explains workload behaviour, but the operating path may include identity, policy and endpoint controls. Establish ownership before deciding whether the next investigation is performance or security.
Pair Windows evidence with the security responsibility around it.
Questions before you enquire
Can you analyse a production system?
Potentially, once access, data handling, capture overhead, approvals and recovery constraints are agreed. We do not start tracing a production system before that discussion happens.
Do you provide emergency incident response?
Urgent assistance depends on availability and an agreed incident role. Ongoing on-call coverage is a separate service decision.
Will the investigation require code changes?
Not necessarily. The evidence may point to code, configuration, workload or infrastructure. Any implementation work is scoped and approved separately.
Our monitoring tool already shows green across the board.
A healthy-looking dashboard and a slow transaction are not mutually exclusive. We check whether the available telemetry measures utilisation, queueing and waiting, then compare it with what the workload experienced.
How long does a first Windows investigation take?
We confirm the capture window, analysis scope and expected timing after reviewing access, workload availability and any required observation period.
Related services
Performance
Kritical investigates difficult performance problems: the slow application, the intermittent stall, or the storage array that looks fine on the dashboard while the business waits.
Windows & Microsoft
Kritical works on Windows infrastructure and the services business applications depend on, including Active Directory, hybrid identity and platform migration.
Critical applications
Kritical helps application owners investigate slow, unstable or capacity-constrained services by connecting the user experience with application, data and infrastructure evidence — so the fix targets the actual constraint, not the easiest metric to change.
Enterprise storage
Kritical helps organisations assess enterprise storage performance, architecture and change across hosts, fabrics, virtualisation, arrays, data protection and the applications that depend on them — so a migration or upgrade improves the thing that matters to the business.
Networks
When connectivity, segmentation or platform integration is limiting the business, Kritical assesses and changes the network around application requirements, so your team can resolve the constraint and operate it with confidence afterwards.
Let’s define the next step.
Tell us what you want to achieve, what you have today and when it matters.