none
Windows Update 100% usage of 1 CPU core

    General discussion

  • After applying the April 2018 cumulative update (also confirmed this still exists in the May 2018 cumulative update as well) ALL of our Windows Server 2012 (NOT R2) systems have the svchost.exe process consuming 100% of 1 CPU core.  If the Windows Update service is stopped, CPU usage drops back down to normal range.  I have run through a lot of the older suggestions, validating the WMI repository, clearing out Downloads and DataStore in SoftwareDistribution, etc. without any change in behavior.

    Is there anyone else seeing this behavior?

    One thing to note - it wasn't noticeable at first, in fact it didn't seem to start right after installation of the updates, it started over this past weekend (May 12/13, 2018).  Perhaps this isn't so much an issue with the patches as it is some change made to Windows Update back end systems over the weekend...?  I have no clue but it is very annoying.

    Monday, May 14, 2018 11:37 PM

All replies

  • Hello, same situation here, and we are getting quite desperate. Also started this weekend.

    We are seeing this on 2008 and 2012 servers.

    Nothing that we tried worked, even upgrading one of our 2012 servers to R2.

    All of our machines are hosted on ESXI.

    Tuesday, May 15, 2018 6:16 AM
  • Below link will helps you to fix the High cpu issue.

    https://answers.microsoft.com/en-us/windows/forum/windows_7-performance/abnormally-high-cpu-usage-from-svchostexe-solved/eb38d25d-6bb2-47cd-80f2-5389c62337be

    additionally try below steps as well

    go to cmd

    net stop wuauserv
    net stop bits
    net stop cryptsvc

    delete  softwareDistribution folder under :C:\Windows\SoftwareDistribution

    again  go to cmd

    net start wuauserv
    net start bits
    net start cryptsvc

    Please mark as answered if above info helped.

    Tuesday, May 15, 2018 6:36 AM
  • Are you running System Center Endpoint Protection (SCEP) on your machines? In our case the Windows Update cpu usage also started this weekend and seems to be caused by SCEP not being able to update it's definitions.

    You can temporarily fix this by disabeling the Windows Update Service, downloading the latest definitions (https://www.microsoft.com/en-us/wdsi/definitions) applying them them. Then start the Windows Update service again. You will see the CPU usage becoming normal again, but only for a while because new definitions will most likely cause the high CPU usage again.

    Tuesday, May 15, 2018 6:59 AM
  • Thank you very much Simon, your solution worked on all the affected machines.
    Tuesday, May 15, 2018 8:09 AM
  • Are you running System Center Endpoint Protection (SCEP) on your machines? In our case the Windows Update cpu usage also started this weekend and seems to be caused by SCEP not being able to update it's definitions.

    You can temporarily fix this by disabeling the Windows Update Service, downloading the latest definitions (https://www.microsoft.com/en-us/wdsi/definitions) applying them them. Then start the Windows Update service again. You will see the CPU usage becoming normal again, but only for a while because new definitions will most likely cause the high CPU usage again.

    That worked for me.  thank you
    Tuesday, May 15, 2018 9:55 AM
  • Simon,

    We are able to stop Windows Update Service and the problem stops - what is the longer term solution? What changed with SCEP getting updates?

    Tuesday, May 15, 2018 8:14 PM
  • Simon,

    We are able to stop Windows Update Service and the problem stops - what is the longer term solution? What changed with SCEP getting updates?


    This morning our W2008 servers had 100% cpu... If anyone knows the solution please do say... many thanks for your help so far
    • Edited by Shera Singh Wednesday, May 16, 2018 7:55 AM
    Wednesday, May 16, 2018 7:55 AM
  • Simon,

    We are able to stop Windows Update Service and the problem stops - what is the longer term solution? What changed with SCEP getting updates?

    I'm not sure. I'm not with Microsoft and we're still working on figuring out how to fix this for our servers.
    Wednesday, May 16, 2018 9:56 AM
  • same here!
    Wednesday, May 16, 2018 10:54 AM
  • A user named BrandonM on another thread said that manually updating SCEP helped; but the issue seems to have returned for some users over there too. I get the feeling that it might have reccured for the users who simply restarted the Windows Update Service but I am not sure.  His steps:

    • Download and install from latest full definition package. You can download from here: https://www.microsoft.com/en-us/wdsi/definitions

    OR

    • From command line (Program Files\Microsoft Security Client), run MpCmdRun.exe -SignatureUpdate


    Wednesday, May 16, 2018 12:21 PM
  • A user named BrandonM on another thread said that manually updating SCEP helped; but the issue seems to have returned for some users over there too. I get the feeling that it might have reccured for the users who simply restarted the Windows Update Service but I am not sure.  His steps:

    • Download and install from latest full definition package. You can download from here: https://www.microsoft.com/en-us/wdsi/definitions

    OR

    • From command line (Program Files\Microsoft Security Client), run MpCmdRun.exe -SignatureUpdate


    Can you post link here to what post you are referring too?
    Wednesday, May 16, 2018 12:58 PM
  • He is referring to this post:

    https://social.technet.microsoft.com/Forums/windowsserver/en-US/60fc1226-86ef-4eec-adca-ef65fccecc8c/windows-update-client-wuauserv-high-cpu-utilization?forum=winserver8gen

    However, it is just a short term fix, when new AV definitions are posted and a detection cycle is triggered the WU service issues return.

    Wednesday, May 16, 2018 1:06 PM
  • I can confirm. I've updated definitions a few hours ago and CPU was ok. Then an hour ago it was back to 100%.

    I downloaded the new definitions (file size was different, so I'm sure), installed, and CPU went to normal.


    • Edited by Trapulo Wednesday, May 16, 2018 1:32 PM
    Wednesday, May 16, 2018 1:31 PM
  • We're also seeing this. So far on 2008 32bit and 64bit and 2012  (I think 2008R2 and 2012R2 are fine) all running SCEP.

    I had tried all the above fixes before finding this thread, and they only resolve the CPU issue until SCEP attempts its next automatic update and the problem returns. SCEP doesn't successfully update without manually installing a stand alone def file with the WU service stopped.

    As the Windows Update service only uses 1 CPU, adding a 2nd CPU is a temporary fix as it will top out at 50%, but is not a solution by a long shot. Also, as SCEP and Updates are not working anyway, disabling the Windows Update service will buy you some time, but is obviously less than ideal.

    No permanent fix in this on the linked thread either.







    Wednesday, May 16, 2018 2:29 PM
  • We're having the same issues... Started happening over the weekend of 5/12/18. Server 2012 and SCEP. Can confirm that the definition update was only a temporary fix. Please keep us posted when a good solution is found... thanks!

    /S

    Wednesday, May 16, 2018 2:48 PM
  • For Now, we have tried (on a 2008 [non R2]) disabling non-Windows updates and SCEP is able to update without spinning up a core.

    In Windows Update choose CHANGE SETTINGS then uncheck "Give me recommended updates the same way I receive important updates"

    We've confirmed that the issue goes away if you uninstall SCEP and returns if you reinstall. I hope a better solution is on the way. I am anxious to see what others have tried.

    Wednesday, May 16, 2018 5:41 PM
  • This issue was caused by a large no of definition updates that were still unexpired on the Microsoft Update servers and evaluating the supersedence between them is what caused the high CPU issue for 10s of minutes. This has been fixed now by expiring the older superseded Definition Updates, as you can see here: https://www.catalog.update.microsoft.com/Search.aspx?q=KB2461484

    Hope this helps,

    Andrei


    We could change the world, if God would give us the source code.

    Thursday, May 17, 2018 8:32 AM