-what is the exact location of impacted PCs (building/floor)
-what are the IPs of PCs impacted - at least 2 IPs
-what is the MAC address of user/s ?
-is user connected to cable or wireless ?
-to what ports are they connected to lan (RJ45 cable port number on user's desk)
-when did the issue start ?
-any other network services are slow? (internet/intranet/LN/shared drives/other)