none
DcomLaunch service uses high cpu for 5 minutes after boot in Win 10 1703 Creator's RRS feed

  • Question

  • Hi, I'm watching the DcomLaunch service (svchost -k DcomLaunch) use 25% cpu (normal priority) on a quad core for 5 minutes after every boot.  

    Process monitor says it's reading this area of the registry, but I can't find it:

    \REGISTRY\A\{57a90272-d43e-4cd9-9af7-7a9ea1871e41}\WorkItems\

    • Edited by JS2010 Friday, September 29, 2017 10:50 PM
    Friday, September 29, 2017 10:49 PM

All replies

  • To diagnose a performance problem you should use the Windows performance toolkit, the instructions for which can be found in this wiki
    Saturday, September 30, 2017 3:11 PM
  • It's probably something to do with a lot of new profiles being created and deleted every day.  Other app related things in the registry seem to remain, whether it's firewall rules or registry entries for app installs under hkey_local_machine\software\classes\local settings\, etc...



    • Edited by JS2010 Saturday, September 30, 2017 8:37 PM
    Saturday, September 30, 2017 8:36 PM
  • Process monitor says it's reading this area of the registry, but I can't find it:

    \REGISTRY\A\{57a90272-d43e-4cd9-9af7-7a9ea1871e41}\WorkItems\

    Hi,

    Please check the process monitor entry to confirm if reading that registry is successfully or name not found.

    Anyway, I don't think this is issue. 25% usage at the 5 minutes after boot is reasonable.

    You can perform a Clean Boot to see if any difference.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, October 2, 2017 3:21 AM
    Moderator
  • I disagree that this is reasonable.  An svchost is using as much cpu as it can.  The only reason it's not 100% is because windows limits a process to 25% cpu on a 4 cpu machine.  And it's not low priority cpu.  Logins get slowed down to several minutes until it's done.  I think "\REGISTRY\A\" is some kind of extra application registry hive.  https://superuser.com/questions/689788/what-does-the-path-registry-a-in-sysinternals-procmon-log-mean


    • Edited by JS2010 Monday, October 2, 2017 5:54 PM
    Monday, October 2, 2017 5:35 PM
  • this is simply wrong: "windows limits a process to 25% cpu on a 4 cpu machine".
    Each process can run multiple thread, every one of which can utilize a CPU to 100%.

    why don't you create a trace file, then we can see what is running.
    Monday, October 2, 2017 6:52 PM
  • Ok, windows limits a thread to 25% cpu on a 4 cpu machine". 

    I've seen DcomLaunch service doing almost 500,000 registry events in process monitor.  I have a clue though.  There's about 3000 .pckgdep files under 

    C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy

    named after sid's from deleted profiles, like:

    S-1-5-21-3475936260-1383956527-3330305502-3966.pckgdep
    S-1-5-21-3475936260-1383956527-3330305502-3967.pckgdep
    S-1-5-21-3475936260-1383956527-3330305502-3968.pckgdep

    There's currently only 90 profiles on the system.


    • Edited by JS2010 Monday, October 2, 2017 8:03 PM
    Monday, October 2, 2017 8:01 PM
  • "Ok, windows limits a thread to 25% cpu on a 4 cpu machine".
    What does this sentence mean? 
    There is a non-Windows OS where a thread can utilitze a CPU to more then 100%?
    Monday, October 2, 2017 8:39 PM
  • Ok, if in CPU Stress I only use one thread, and put the Activity to Maximum, then I look in Task Manager, Details tab, cpustress.exe seems to stay at 25 in the CPU column.  If I look in process explorer, all 4 cores are active.  This is typically what I see when a service is out of control.


    • Edited by JS2010 Monday, October 2, 2017 8:54 PM
    Monday, October 2, 2017 8:52 PM
  • @JS2010 so this is the same machine as in your other post?
    new firewall rules created for each user
    Monday, October 2, 2017 8:54 PM
  • I admin many machines, but it's a similar problem to that one.  That firewall problem has actually been improved on since older versions of windows 10, although it hasn't completely gone away.  I have another post about AppXSVC (https://social.technet.microsoft.com/Forums/windows/en-US/20d3e113-3c53-4fb2-a78f-db5c4e26aeb7/win10-1703-random-slow-login-appxsvc?forum=win10itprohardware) with a similar problem.

    It seems like there's no clean way to remove a profile.  Things get left over either in the registry or the file system named after an SID, and it's always been windows (metro?) app related.  Then later a windows service spends a lot of cpu processing it.




    • Edited by JS2010 Monday, October 2, 2017 9:31 PM
    Monday, October 2, 2017 8:57 PM
  • This problem is very challenging.  I deleted all the extra .pckgdep files, but it didn't do any good.  All of these ActivationStore.dat files under c:\programdata\microsoft\windows\apprepository\packages are registry hives that I can load, but I'm not sure if they're the ones that the dcom service is processing.

    Tuesday, October 3, 2017 8:59 PM