Our organization recently refreshed about 1,200 HP laptops, deployed to employees through Autopilot. The devices are hybrid-joined, co-managed with Configuration Manager and Intune, and run Windows 11 25H2 Enterprise. Most legacy Group Policy settings have been moved to Intune, with a few exceptions for PKI auto-enrollment and legacy browser compatibility. Application deployments are largely unchanged from the previous hardware generation.
We are seeing a strange, intermittent performance problem affecting a number of users. The most common symptom is severe typing or UI rendering lag in Word, Excel, Teams, Edge, and other Microsoft applications. Users type, but the characters may not appear for several seconds. The problem can disappear after a reboot, resolve itself after a few minutes, or recur unpredictably. A Command Prompt window open at the same time usually responds normally.
The issue has been reproduced by several technicians and occurs with both laptop keyboards and external Bluetooth, USB, and wireless keyboards. It has appeared on more than one laptop model, so a simple keyboard or hardware problem seems unlikely. We have already investigated common causes such as Office hardware acceleration, connected experiences, BIOS and driver updates, and security products that perform process injection, including DLP, endpoint privilege management, and Defender components.
The affected devices use CyberArk EPM for application control, along with the usual Microsoft 365 applications and security tooling. We are also trying to learn how to capture and analyze the problem with WPR and WPA, but most available guidance stops at basic interface introductions rather than explaining how to investigate a transient, application-specific input delay.
Has anyone seen similar behavior on Windows 11 25H2? Assuming the usual help-desk and standard troubleshooting steps have already been completed, what would be the best way to isolate the cause and capture useful performance data?
4 Answers
For performance tracing, the key is to have a lightweight capture ready before the next incident. Start a WPR recording with CPU usage, process activity, disk I/O, and possibly the input or UI responsiveness profiles enabled, then stop it as soon as the lag occurs. Record the exact application, timestamp, active user session, and any process that changed in Task Manager. In WPA, begin by checking CPU Usage by Process and Thread, disk activity, context switches, and waits during the affected interval; then correlate those timestamps with the Office, Teams, security, and Copilot-related processes. A trace taken during the delay is much more useful than a general trace collected after the system recovers.
First, I would confirm whether the behavior happens on both laptop models and with different input devices, including a direct USB connection rather than a dock or wireless receiver. In this case, technicians have seen it on multiple models and with built-in, Bluetooth, RF, and USB keyboards, which makes a basic keyboard or laptop hardware fault less likely. It is still worth recording whether docked and undocked systems behave differently, since USB hubs and wireless interference can create similar symptoms.
One promising lead is the Microsoft 365 Copilot integration. During one occurrence, AI.exe was near the top of the CPU list, and terminating it immediately stopped the typing lag. AI.exe and aimgr.exe are used by the Copilot and connected-experiences components in Microsoft 365 applications, so they are worth monitoring during an incident. A test Intune configuration that disabled Office connected experiences prevented AI.exe from launching, which suggests that component may be involved, although it may be only one part of the failure chain.
Disabling connected experiences appeared to stop AI.exe from launching on a test device, and it helped one affected user temporarily. However, the same user reported the lag again later, so the policy may not have been fully applied or Copilot may be only a contributing factor. We are continuing to test this across more devices.
A useful first step is to catch the problem while it is happening and compare Task Manager, Resource Monitor, and Event Viewer rather than starting with a full trace. Look for a process that suddenly consumes CPU, generates disk activity, or causes delays in the affected applications. The fact that Command Prompt remains responsive while Office, Teams, and Edge lag points toward an application integration, security filter, or shared Microsoft component rather than general system input latency.
We have seen it on both laptop models and with several types of keyboards. I still need better data on docked versus undocked systems, but the issue appears broad enough that I doubt the keyboard itself is the root cause.