PC at a glance
Collected . Resource usage is a short snapshot, not a trend.
Device
| Computer | NORTHSTAR-LT-024 |
|---|---|
| Windows | Windows 11 Pro · 24H2 |
| Processor | Intel Core i7 |
| Manufacturer / model | Northstar Demo Hardware / Business Laptop 14 |
| BIOS | Demo UEFI 1.12 |
| Agent process architecture | AMD64 |
| Logical processors | 8 |
Start here · 4 recent records
What changed before the problem?
Recorded changes and failures before this request · last 10 days, latest 50. The problem’s actual start time is unknown; this timeline shows possible clues, not proven causes.
● Installs / updates● Device changes● Warnings● Failures
Reported problem
Outlook freezes when opening an attachment
Reported by Alex Morgan · alex.morgan@example.com
Outlook stopped responding while I opened the project schedule attachment. It happened twice this morning after an Office update. Other apps still work.
Diagnostic snapshot
Collected . Resource usage is a short snapshot, not a trend.
Processes needing attention 1 to investigate
Short snapshot: not responding is a possible hang, and high usage can be legitimate. Flags: CPU ≥25% of total capacity; RAM ≥2 GiB or ≥20% of installed RAM (at least 512 MiB); combined I/O ≥50 MiB/s. I/O includes disk, device and network operations.
| Process / PID | Why shown | CPU | RAM | Read / s | Write / s |
|---|---|---|---|---|---|
| OUTLOOKPID 4200 | Window not responding at capture time; possible hang | 0.2% | 798.7 MiB | 4 KiB | 1 KiB |
Running apps
Processes with a titled main window. Background apps appear in the complete process table.
| App / PID | Window | Response | CPU | RAM |
|---|---|---|---|---|
| OUTLOOKPID 4200 | Inbox — Alex Morgan | Not responding | 0.2% | 798.7 MiB |
| msedgePID 5200 | Northstar project dashboard | Responding | 12.4% | 1331.2 MiB |
| TeamsPID 6200 | Northstar team workspace | Responding | 3.1% | 665.6 MiB |
| explorerPID 7200 | File Explorer | Responding | 0.4% | 194.6 MiB |
Example processes CPU · memory · I/O · paths
Issues first: not-responding windows, then high usage; remaining processes sorted by CPU, then RAM. CPU is normalized to total machine capacity. RAM = working set; private = committed private memory. I/O includes file, device and network operations, not just disk. Protected/exited processes may have incomplete values. No command lines or environment variables are collected.
| Process / path | PID | CPU % | RAM | Private | Read / s | Write / s | Threads | Handles | Status |
|---|---|---|---|---|---|---|---|---|---|
| OUTLOOKC:\Program Files\OUTLOOK\OUTLOOK.exe | 4200 | 0.2% | 798.7 MiB | 639 MiB | 4 KiB | 1 KiB | 40 | 920 | sampledWindow not respondingWindow not responding at capture time; possible hang |
| msedgeC:\Program Files\msedge\msedge.exe | 5200 | 12.4% | 1331.2 MiB | 1065 MiB | 4 KiB | 1 KiB | 40 | 920 | sampled |
| TeamsC:\Program Files\Teams\Teams.exe | 6200 | 3.1% | 665.6 MiB | 532.5 MiB | 4 KiB | 1 KiB | 40 | 920 | sampled |
| explorerC:\Program Files\explorer\explorer.exe | 7200 | 0.4% | 194.6 MiB | 155.6 MiB | 4 KiB | 1 KiB | 40 | 920 | sampled |
Disk capacity
| Drive | Available | Total | Used |
|---|---|---|---|
| C:\ | 190.0 GiB | 512.0 GiB | 62.9% |
Network adapters
| Adapter | Status | Addresses | DNS servers | Gateways |
|---|---|---|---|---|
| Wi-FiWireless80211 | Up | 192.0.2.24 | 192.0.2.53 | 192.0.2.1 |
Network checks
| Check | Target | Result | Time | Meaning |
|---|---|---|---|---|
| Gateway ICMP | 192.0.2.1 | passed | 2 ms | Gateway replied in this demo |
| DNS lookup | www.microsoft.com | passed | 18 ms | Demo lookup succeeded |
| Endpoint connectivity | www.microsoft.com:443 | passed | 32 ms | Demo TCP connection succeeded |
A missing ping reply can mean ICMP is blocked.
Recent application errors
Latest eight error events in 24 hours; descriptions limited to 2,000 characters. Status: Available.
| Time | Provider / event | Description |
|---|---|---|
| Application HangEvent 1002 |
Network health
Collected . Short samples describe this moment; they do not establish long-term connection quality.
Packet loss & latency
Ten ICMP probes per target, 500 ms timeout, 150 ms between probes. Targets run in parallel over Windows routing (including any active VPN). Missing ICMP replies can reflect firewall policy or rate limiting. These are endpoint samples, not a route trace.
| Target | Replies | No-reply rate | Min / average / max | RTT variation | Sample time |
|---|---|---|---|---|---|
| Default gateway192.0.2.1 | 4 / 40 local probe errors | 0% | 1 ms / 2 ms / 3 ms | 1 ms | Finished |
RTT variation is the mean absolute difference between consecutive successful replies. Local errors are excluded from the no-reply percentage.
Wi-Fi connection
Available. Signal is Windows-reported quality (%), not dBm. Link rates are negotiated speeds, not measured throughput.
| Adapter / state | Network | Signal | Radio / band / channel | Receive / transmit |
|---|---|---|---|---|
| Wi-Ficonnected | Northstar-Demo02:00:00:00:00:24 | 91% | 802.11ac5 GHz · Channel 36 | 866 / 866 Mbps |
Adapter & tunnel context
| Interface | Type / status | Link speed | Addresses |
|---|---|---|---|
| Wi-FiDemo wireless adapter | Wireless80211 / Up | 866 Mbps | 192.0.2.24 |
IPv4 routes Up to 80 · lowest route metric first
Includes physical and tunnel interfaces. Selection also depends on prefix length and interface metric; route metric alone does not determine the chosen path.
| Destination | Next hop | Interface | Route metric |
|---|---|---|---|
| 0.0.0.0/0 | 192.0.2.1 | Wi-Fi | 25 |
Printers, scanners & peripherals
Collected . Windows-reported state and driver registrations; a healthy device entry does not prove printing or scanning works in an application.
Recent peripheral changes Last 30 days
Installation/reinstallation and last arrival/removal timestamps recorded by Windows. This is not a complete change history; earlier reconnects and undocumented configuration changes may be absent.
| Time | Device | Change | Evidence |
|---|---|---|---|
| USB-C dock | Last arrival | Demo device metadata |
Hardware & device health
Collected . Windows/provider readings; unavailable is not a healthy result. Virtual disks and some RAID/USB/NVMe controllers do not expose full SMART data.
No warning conditions found in the returned health fields. This does not certify hardware health.
Physical storage health
Health is the Windows storage-provider assessment. Wear is reported lifetime used (%), not remaining life. Counters are lifetime/provider values, not errors measured during this request.
| Disk / firmware | Media / bus / capacity | Health / operation | Temperature | Wear / power-on | Uncorrected errors |
|---|---|---|---|---|---|
| Demo NVMe SSDID 0 · DEMO1 | SSD / NVMe512 GiB | HealthyOK · Available | 36 °C | 5% used1400 hours | Read 0Write 0 |
Disk state & partitioning
| Disk | Bus / partition | Health / operation | Offline / read-only |
|---|---|---|---|
| 0 · Demo NVMe SSD | NVMe / GPT | Healthy / Online | False / False |
Security health
Collected . Windows-reported antivirus and firewall state; registration alone does not verify a third-party product is protecting the PC.
Security Center assessment
| Protection | Reported health |
|---|---|
| Antivirus | Good |
| Firewall | Good |
Microsoft Defender
Passive mode can be expected with another antivirus product. An older signature date is flagged only in normal mode; three days is a troubleshooting threshold, not a vendor compliance rule.
| Check | Value |
|---|---|
| Running mode | Normal |
| Service / antivirus / real-time | On / On / On |
| Behavior monitoring / tamper protection | On / On |
| Signature version / age | Demo signatures / 0 days |
| Signatures updated | |
| Engine / product | Demo engine / Demo product |
Effective Windows firewall profiles
Inactive profiles are context; disabling an inactive profile is not automatically flagged. Effective policy is read from ActiveStore.
| Profile | Active network | Enabled | Default inbound / outbound |
|---|---|---|---|
| Domain | Yes | True | Block / Allow |
Windows troubleshooting context
Initial collection started . Subject-specific checks run later during submission; sample/event timestamps identify their observation time.
Pending reboot indicators Needs attention
Indicators can be stale; no reboot or repair is performed.
| Source | State | Evidence |
|---|---|---|
| Windows servicing | Reboot pending | A restart is pending after an update. |
Application crashes & hangs Needs attention
Reported events are evidence, not an inferred root cause.
| Time | Record | Application | Version | Module | Exception code | WER type |
|---|---|---|---|---|---|---|
| Application Hang / 1002 | OUTLOOK.EXE | 16.0.18025.20104 | AppHangB1 |
User, session & join context
Selected state fields only; credentials and tokens excluded.
| Field | Value |
|---|---|
| Signed-in console user | NORTHSTAR\alex.morgan |
| Domain / workgroup | NORTHSTAR |
| Domain joined | True |
| Collecting session | 1 |
| Time zone | Eastern Standard Time |
Microsoft 365 / Outlook installation
Version metadata only; email contents are not collected.
| Field | Value |
|---|---|
| Version | 16.0.18025.20104 |
| Platform | x64 |
| Product | Microsoft 365 Apps |
Microsoft 365 service connectivity
TCP establishment only; not tenant service health.
| Endpoint | Port | Result |
|---|---|---|
| login.microsoftonline.com | 443 | TCP reachable · 32 ms |
| outlook.office365.com | 443 | TCP reachable · 37 ms |
Recent installations Last 30 days · newest first
Software, drivers/devices and Windows updates grouped below. Installer dates may reflect an update or repair. Device dates describe installation on this PC, not driver release dates. Missing dates are not inferred from file timestamps.
Software 1 records
| Installed | Item / version | Publisher | Evidence |
|---|---|---|---|
| Microsoft 365 Apps16.0.18025.20104 | Microsoft Corporation | InstalledDemo installation log |
Drivers & devices 1 records
| Installed | Item / version | Publisher | Evidence |
|---|---|---|---|
| USB-C dock display driver11.2.0 | Northstar Demo Hardware | InstalledDemo device log |