We recently refreshed roughly 1,200 HP laptops, deployed to employees through Autopilot. The devices are hybrid-joined and managed through a co-managed Configuration Manager and Intune setup. Most legacy policies have moved to Intune, while PKI auto-enrollment and a few IE mode settings remain in Group Policy. Application deployment is largely unchanged from the previous hardware generation.
Users are reporting a strange, intermittent delay when typing in Word, Excel, Teams, and Edge. Keystrokes may take several seconds to appear, although the issue sometimes clears after a few minutes or a reboot. For some users it happens repeatedly, while for others it never returns. A standard Command Prompt running at the same time continues to respond normally.
The behavior has been reproduced by several technicians and occurs on multiple laptop models. It affects built-in keyboards as well as Bluetooth, USB, and wireless-dongle keyboards, so a simple keyboard hardware problem seems unlikely. Standard troubleshooting has already included BIOS and driver updates, changing Office hardware-acceleration settings, disabling connected experiences, and investigating security products that perform process injection or monitoring, including DLP, privilege-management, and Defender components.
We are now trying to learn how to capture useful performance data with WPR and analyze it in WPA, but most available material only covers the interface rather than diagnosing real-world transient input and application stalls. One possible lead appeared when a technician saw AI.exe using significant CPU in Task Manager; ending it immediately stopped the lag. Disabling Office connected experiences prevented AI.exe from launching, but the problem later returned for at least one user, so that may be part of the chain rather than the root cause.
Has anyone seen this type of intermittent typing lag in Windows 11 25H2, particularly in Microsoft 365 applications? Assuming the usual troubleshooting has already been completed, what diagnostic approach would you use to identify the responsible process, security hook, service, or performance bottleneck?
4 Answers
The fact that Command Prompt remains responsive while Office, Teams, and Edge stall points more toward application integration than general system input lag. Copilot and the Microsoft 365 AI components are worth testing carefully. During one occurrence, AI.exe was consuming substantial CPU; ending it stopped the typing delay immediately. A settings-catalog policy that disabled Office connected experiences also prevented AI.exe from starting, so compare affected machines with and without that policy and verify that it actually applied before drawing conclusions.
First confirm the scope with direct observation. Check whether it occurs across laptop models, built-in and external keyboards, and docked versus undocked systems. In this case it has appeared on multiple models and with several keyboard connection types, and technicians have witnessed it themselves, which makes a basic keyboard fault much less likely. I would still record the exact hardware, dock, connection type, and active security tools for every occurrence so you can compare affected and unaffected devices.
It has happened on two laptop models and with built-in, USB, Bluetooth, and wireless-dongle keyboards. We do not have enough docked systems to rule docks in or out, but the broad pattern makes a keyboard-specific issue unlikely.
For a transient problem, start with lightweight capture that can be collected while the user is affected. Task Manager can quickly identify CPU, memory, disk, or unusual process activity, and Event Viewer may show application hangs or security-product events around the same timestamp. Record the active process tree and timestamps before killing anything. If the issue is reproducible enough, use WPR with a general performance profile plus CPU sampling, disk/file I/O, and possibly input or UI-related providers, then stop the trace immediately after the lag occurs and analyze the timeline in WPA. The useful question is not just which process used CPU, but whether a process, injected module, file scan, or RPC wait is blocking the affected applications while the console remains responsive.
Security and management agents remain strong suspects because they can affect only selected applications and may behave inconsistently depending on document content or policy state. Run controlled A/B tests on a small number of machines: temporarily remove or exclude one monitoring component at a time, including DLP, privilege management, Defender scanning, and Office AI integration. Compare process module lists and security events between an affected and unaffected device. Since the base software load is mostly unchanged, the new Windows build, new hardware drivers, and newly migrated Intune policies should also be compared against the previous image rather than treated as unrelated.
Disabling connected experiences helped prevent AI.exe from launching, but the issue later returned for at least one user. That makes it a credible contributor or trigger, though probably not the complete explanation.