none
WpnUserService occupies all available memory

    Question

  • Hi,

    "Windows Push Notifications User Service" is quickly using more and more memory until none left. At which point many other programs start crashing or behave weirdly (probably due to insufficient resource errors).

    The service is:

    "Пользовательская служба push-уведомлений Windows"

    c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService

    HKLM\System\CurrentControlSet\Services\WpnUserService

    (A _267fa384 prefix is added to its name and registry key.)

    During "memory eating contest" this service occupies 100% CPU with one of its thread. The call stack indicate it doing something in RPC and SQLite (see below).

    I can kill the service. I can disable it in registry. However, it will come back after restart.

    Any idea how to disable this service or find what is causing the problem?

    Call stack samples (of same single thread in the service):

    ntoskrnl.exe!KiSwapContext+0x76
    ntoskrnl.exe!KiSwapThread+0x190
    ntoskrnl.exe!KiCommitThreadWait+0x10e
    ntoskrnl.exe!KeWaitForSingleObject+0x1c9
    ntoskrnl.exe!KiSchedulerApc+0x243
    ntoskrnl.exe!KiDeliverApc+0x240
    ntoskrnl.exe!KiApcInterrupt+0x39f
    winsqlite3.dll!sqlite3_column_value+0x3844f
    winsqlite3.dll!sqlite3_column_value+0x616ab
    winsqlite3.dll!sqlite3_step+0x15d
    wpncore.dll!Statement::dal_step+0x8b
    wpncore.dll!SqliteDatabase::BuildHandler+0x122
    wpncore.dll!SqliteDatabase::GetAllHandlers+0xe9
    wpncore.dll!DatabaseTQMAdaptor::EnumerateAll+0x75
    wpncore.dll!SettingsEndpointImpl::PopulateCapableAppsInPackage+0xcd
    wpncore.dll!SettingsEndpointFacade::PopulateCapableAppsInPackage+0x48
    RPCRT4.dll!Invoke+0x73
    RPCRT4.dll!Ndr64StubWorker+0xbb0
    RPCRT4.dll!NdrStubCall3+0xc9
    combase.dll!CStdStubBuffer_Invoke+0x62
    RPCRT4.dll!CStdStubBuffer_Invoke+0x3b
    combase.dll!ObjectMethodExceptionHandlingAction<<lambda_76d9e92c799d246a4afbe64a2bf5673d> >+0x53
    combase.dll!DefaultStubInvoke+0x2d2
    combase.dll!ServerCall::ContextInvoke+0x492
    combase.dll!AppInvoke+0x2ff
    combase.dll!ComInvokeWithLockAndIPID+0x55b
    combase.dll!ThreadInvoke+0xefa
    RPCRT4.dll!DispatchToStubInCNoAvrf+0x24
    RPCRT4.dll!RPC_INTERFACE::DispatchToStubWorker+0x1be
    RPCRT4.dll!RPC_INTERFACE::DispatchToStubWithObject+0x154
    RPCRT4.dll!LRPC_SCALL::DispatchRequest+0x183
    RPCRT4.dll!LRPC_SCALL::HandleRequest+0x996
    RPCRT4.dll!LRPC_ADDRESS::HandleRequest+0x34e
    RPCRT4.dll!LRPC_ADDRESS::ProcessIO+0x8a3
    RPCRT4.dll!LrpcIoComplete+0xd8
    ntdll.dll!TppAlpcpExecuteCallback+0x22e
    ntdll.dll!TppWorkerThread+0x886
    KERNEL32.DLL!BaseThreadInitThunk+0x14
    ntdll.dll!RtlUserThreadStart+0x21

    ntoskrnl.exe!KiSwapContext+0x76
    ntoskrnl.exe!KiSwapThread+0x190
    ntoskrnl.exe!KiCommitThreadWait+0x10e
    ntoskrnl.exe!KeWaitForSingleObject+0x1c9
    ntoskrnl.exe!KiSchedulerApc+0x243
    ntoskrnl.exe!KiDeliverApc+0x240
    ntoskrnl.exe!KiApcInterrupt+0x39f
    winsqlite3.dll!memmove+0x142
    winsqlite3.dll!sqlite3_column_value+0x5fb05
    winsqlite3.dll!sqlite3_step+0x15d
    wpncore.dll!Statement::dal_step+0x8b
    wpncore.dll!SqliteDatabase::BuildHandler+0x122
    wpncore.dll!SqliteDatabase::GetAllHandlers+0xe9
    wpncore.dll!DatabaseTQMAdaptor::EnumerateAll+0x75
    wpncore.dll!SettingsEndpointImpl::PopulateCapableAppsInPackage+0xcd
    wpncore.dll!SettingsEndpointFacade::PopulateCapableAppsInPackage+0x48
    RPCRT4.dll!Invoke+0x73
    RPCRT4.dll!Ndr64StubWorker+0xbb0
    RPCRT4.dll!NdrStubCall3+0xc9
    combase.dll!CStdStubBuffer_Invoke+0x62
    RPCRT4.dll!CStdStubBuffer_Invoke+0x3b
    combase.dll!ObjectMethodExceptionHandlingAction<<lambda_76d9e92c799d246a4afbe64a2bf5673d> >+0x53
    combase.dll!DefaultStubInvoke+0x2d2
    combase.dll!ServerCall::ContextInvoke+0x492
    combase.dll!AppInvoke+0x2ff
    combase.dll!ComInvokeWithLockAndIPID+0x55b
    combase.dll!ThreadInvoke+0xefa
    RPCRT4.dll!DispatchToStubInCNoAvrf+0x24
    RPCRT4.dll!RPC_INTERFACE::DispatchToStubWorker+0x1be
    RPCRT4.dll!RPC_INTERFACE::DispatchToStubWithObject+0x154
    RPCRT4.dll!LRPC_SCALL::DispatchRequest+0x183
    RPCRT4.dll!LRPC_SCALL::HandleRequest+0x996
    RPCRT4.dll!LRPC_ADDRESS::HandleRequest+0x34e
    RPCRT4.dll!LRPC_ADDRESS::ProcessIO+0x8a3
    RPCRT4.dll!LrpcIoComplete+0xd8
    ntdll.dll!TppAlpcpExecuteCallback+0x22e
    ntdll.dll!TppWorkerThread+0x886
    KERNEL32.DLL!BaseThreadInitThunk+0x14
    ntdll.dll!RtlUserThreadStart+0x21

    ntoskrnl.exe!KiSwapContext+0x76
    ntoskrnl.exe!KiSwapThread+0x190
    ntoskrnl.exe!KiCommitThreadWait+0x10e
    ntoskrnl.exe!KeWaitForSingleObject+0x1c9
    ntoskrnl.exe!KiSchedulerApc+0x243
    ntoskrnl.exe!KiDeliverApc+0x240
    ntoskrnl.exe!KiApcInterrupt+0x39f
    winsqlite3.dll!sqlite3_column_value+0x230e0
    winsqlite3.dll!sqlite3_column_value+0x47bc
    winsqlite3.dll!sqlite3_column_value+0x3703
    winsqlite3.dll!sqlite3_column_value+0x3795c
    winsqlite3.dll!sqlite3_column_value+0x617ab
    winsqlite3.dll!sqlite3_step+0x15d
    wpncore.dll!Statement::dal_step+0x8b
    wpncore.dll!SqliteDatabase::BuildHandler+0x122
    wpncore.dll!SqliteDatabase::GetAllHandlers+0xe9
    wpncore.dll!DatabaseTQMAdaptor::EnumerateAll+0x75
    wpncore.dll!SettingsEndpointImpl::PopulateCapableAppsInPackage+0xcd
    wpncore.dll!SettingsEndpointFacade::PopulateCapableAppsInPackage+0x48
    RPCRT4.dll!Invoke+0x73
    RPCRT4.dll!Ndr64StubWorker+0xbb0
    RPCRT4.dll!NdrStubCall3+0xc9
    combase.dll!CStdStubBuffer_Invoke+0x62
    RPCRT4.dll!CStdStubBuffer_Invoke+0x3b
    combase.dll!ObjectMethodExceptionHandlingAction<<lambda_76d9e92c799d246a4afbe64a2bf5673d> >+0x53
    combase.dll!DefaultStubInvoke+0x2d2
    combase.dll!ServerCall::ContextInvoke+0x492
    combase.dll!AppInvoke+0x2ff
    combase.dll!ComInvokeWithLockAndIPID+0x55b
    combase.dll!ThreadInvoke+0xefa
    RPCRT4.dll!DispatchToStubInCNoAvrf+0x24
    RPCRT4.dll!RPC_INTERFACE::DispatchToStubWorker+0x1be
    RPCRT4.dll!RPC_INTERFACE::DispatchToStubWithObject+0x154
    RPCRT4.dll!LRPC_SCALL::DispatchRequest+0x183
    RPCRT4.dll!LRPC_SCALL::HandleRequest+0x996
    RPCRT4.dll!LRPC_ADDRESS::HandleRequest+0x34e
    RPCRT4.dll!LRPC_ADDRESS::ProcessIO+0x8a3
    RPCRT4.dll!LrpcIoComplete+0xd8
    ntdll.dll!TppAlpcpExecuteCallback+0x22e
    ntdll.dll!TppWorkerThread+0x886
    KERNEL32.DLL!BaseThreadInitThunk+0x14
    ntdll.dll!RtlUserThreadStart+0x21

    ntoskrnl.exe!KiSwapContext+0x76
    ntoskrnl.exe!KiSwapThread+0x190
    ntoskrnl.exe!KiCommitThreadWait+0x10e
    ntoskrnl.exe!KeWaitForSingleObject+0x1c9
    ntoskrnl.exe!KiSchedulerApc+0x243
    ntoskrnl.exe!KiDeliverApc+0x240
    ntoskrnl.exe!KiApcInterrupt+0x39f
    ntoskrnl.exe!MmAccessFault+0x1226
    ntoskrnl.exe!KiPageFault+0x40e
    ntdll.dll!RtlpHpLfhSlotAllocate+0x3c6
    ntdll.dll!RtlpAllocateHeapInternal+0x33e
    ntdll.dll!RtlpHpAllocWithExceptionProtection+0xf4
    ucrtbase.dll!_malloc_base+0x36
    ucrtbase.dll!__crt_state_management::wrapped_invoke<void * __ptr64 (__cdecl*)(unsigned __int64),unsigned __int64,void * __ptr64>+0x2a
    wpncore.dll!operator new+0x1f
    wpncore.dll!std::_List_alloc<std::_List_base_types<std::pair<enum __MIDL___MIDL_itf_wpntypes_0000_0000_0003 const ,std::basic_string<unsigned short,std::char_traits<unsigned short>,std::allocator<unsigned short> > >,std::allocator<std::pair<enum __MIDL___
    wpncore.dll!??$_Buynode@AEBUpiecewise_construct_t@std@@V?$tuple@$$QEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@V?$tuple@$$V@2@@?$_List_buy@U?$pair@$$CBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@H@std@@V?$allocator
    wpncore.dll!NotificationSettings::put_Setting+0x132
    wpncore.dll!SqliteDatabase::BuildHandler+0x31c
    wpncore.dll!SqliteDatabase::GetAllHandlers+0xe9
    wpncore.dll!DatabaseTQMAdaptor::EnumerateAll+0x75
    wpncore.dll!SettingsEndpointImpl::PopulateCapableAppsInPackage+0xcd
    wpncore.dll!SettingsEndpointFacade::PopulateCapableAppsInPackage+0x48
    RPCRT4.dll!Invoke+0x73
    RPCRT4.dll!Ndr64StubWorker+0xbb0
    RPCRT4.dll!NdrStubCall3+0xc9
    combase.dll!CStdStubBuffer_Invoke+0x62
    RPCRT4.dll!CStdStubBuffer_Invoke+0x3b
    combase.dll!ObjectMethodExceptionHandlingAction<<lambda_76d9e92c799d246a4afbe64a2bf5673d> >+0x53
    combase.dll!DefaultStubInvoke+0x2d2
    combase.dll!ServerCall::ContextInvoke+0x492
    combase.dll!AppInvoke+0x2ff
    combase.dll!ComInvokeWithLockAndIPID+0x55b
    combase.dll!ThreadInvoke+0xefa
    RPCRT4.dll!DispatchToStubInCNoAvrf+0x24
    RPCRT4.dll!RPC_INTERFACE::DispatchToStubWorker+0x1be
    RPCRT4.dll!RPC_INTERFACE::DispatchToStubWithObject+0x154
    RPCRT4.dll!LRPC_SCALL::DispatchRequest+0x183
    RPCRT4.dll!LRPC_SCALL::HandleRequest+0x996
    RPCRT4.dll!LRPC_ADDRESS::HandleRequest+0x34e
    RPCRT4.dll!LRPC_ADDRESS::ProcessIO+0x8a3
    RPCRT4.dll!LrpcIoComplete+0xd8
    ntdll.dll!TppAlpcpExecuteCallback+0x22e
    ntdll.dll!TppWorkerThread+0x886
    KERNEL32.DLL!BaseThreadInitThunk+0x14
    ntdll.dll!RtlUserThreadStart+0x21

    • Edited by GunSmoker Saturday, January 13, 2018 5:00 AM Updated with more info
    Friday, January 12, 2018 5:26 AM

Answers

  • I'm not sure if this is a solution, but this just worked for me:

    - Open Windows 10 Start Menu and go to Settings

    - Find Notification options

    - Disable all notifications from all apps

    - Restart

    Once restarted - I tried to enable notifications back one by one to find what app causes that behaviour, but issue has gone, I was not able to reproduce it anymore. I keep notifications enabled for now.

    • Marked as answer by GunSmoker Thursday, February 01, 2018 6:36 PM
    Sunday, January 28, 2018 9:25 PM

All replies

  • The service keeps C:\Users\rando_000\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db file opened, but it is just 1 Mb, it could not possibly occupy 30+ Gb of memory.
    Saturday, January 13, 2018 5:03 AM
  • looks like a recursion in SettingsEndpointFacade::PopulateCapableAppsInPackage.

    disabling the service does not work when you edit
     in the "WpnUserService_267fa384" key. You need to change the Start value in the key 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnUserService



    • Edited by EckiS Saturday, January 13, 2018 2:04 PM
    Saturday, January 13, 2018 2:03 PM
  • I was having the same problem.  I am not sure if it has something to do with the Meltdown/Specter mitigations that I've installed (Windows and firmware), but I also noticed that the same service seems to have a large memory leak on my system.  Disabling the service in the registry did not prevent the service from reloading when I logged back on or restarted.

    I found an explanation on technet as to what the service does here: https://social.technet.microsoft.com/Forums/windows/en-US/c165a54a-4a69-441c-94a7-b5712b54385d/what-is-the-cdpusersvc-for-?forum=win10itprogeneral

    The only way I found to stop this service was to change my windows sign on from sign in to a Microsoft account to sign in locally.  After restarting, the wpnuserservice does not load.

    It is not an ideal solution as I would prefer to log in to my Microsoft account but it seems to work until there is a fix.

    Sunday, January 28, 2018 4:36 PM
  • I'm not sure if this is a solution, but this just worked for me:

    - Open Windows 10 Start Menu and go to Settings

    - Find Notification options

    - Disable all notifications from all apps

    - Restart

    Once restarted - I tried to enable notifications back one by one to find what app causes that behaviour, but issue has gone, I was not able to reproduce it anymore. I keep notifications enabled for now.

    • Marked as answer by GunSmoker Thursday, February 01, 2018 6:36 PM
    Sunday, January 28, 2018 9:25 PM
  • looks like a recursion in SettingsEndpointFacade::PopulateCapableAppsInPackage.

    Does not look like recursion. Look closely - it is not a single large call stack, those are different small call stacks. I simply take few samples.

    I did not tried to disabled service, as issue was solved by disabling notifications in options.

    Sunday, January 28, 2018 9:28 PM
  • The only way I found to stop this service was to change my windows sign on from sign in to a Microsoft account to sign in locally.  After restarting, the wpnuserservice does not load.

    It is not an ideal solution as I would prefer to log in to my Microsoft account but it seems to work until there is a fix.

    Have you tried EckiS suggestion (disabling WpnUserService instead of WpnUserService_RandomNumber)?
    Sunday, January 28, 2018 9:30 PM
  • How about check and disable it with Autoruns from SysInternals ?
    Wednesday, January 31, 2018 9:04 AM
  • Yes. I tried changing the registry setting but it still starts the service.  It is only a matter of time before the memory leak start.

    I also noticed that I would also have problems when I go to the notifications menu.  Windows does not show the list of apps that notifications.  It just shows the spinning clock.  Again, another windows service starts eating up resources until it is killed in task manager.

    I beginning to wonder if I shouldn't try a reinstall of Windows.

    Thursday, February 01, 2018 6:17 PM
  • I also noticed that I would also have problems when I go to the notifications menu.  Windows does not show the list of apps that notifications.  It just shows the spinning clock.  Again, another windows service starts eating up resources until it is killed in task manager.

    I beginning to wonder if I shouldn't try a reinstall of Windows.

    Same problem here!
    Started around the same dates - late Jan I would guess.

    WpnUserService and Windows-PushNotification Service are causing nearly 100% Memory Usage.
    I would guess, it is related to one of the latest MS Windows 10 Updates / patches...
    Saturday, February 10, 2018 1:52 AM