Excessive CPU usage from Health Service


  • Hello,

    We are experiencing high CPU on a server since we deployed the SCOM agent. I’ve been trying to trouble shoot the issue. I found that there was a service called conhost.exe which was starting up a cscript.exe process when it kicked off. I used process explorer and figured out from the below pastes that it looks like SCOM us the one causing the problems.


    "C:\Windows\system32\cscript.exe" /nologo "Microsoft.Windows.Server.NetwokAdapter.BandwidthUsed.ModuleType.vbs" AKLZDC002 true 

    C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 21\184\ 

    MonitoringHost.exe(3964) ( scom ) 

    "C:\Windows\system32\cscript.exe" /nologo "SCOMpercentageCPUTimeCounter.vbs" false 3 

    C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 21\698\ 

    MonitoringHost.exe(3964) ( scom ) 

    "C:\Windows\system32\cscript.exe" /nologo "DiscoverHealthServiceProperties.vbs" 0 {7411606E-CFAA-7624-CFB8-782AADEC672D} {D7C3546A-8C88-33EC-3376-3FA362FF171D} "CORRECTIONS" True 

    C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 22\1921\ 

    MonitoringHost.exe(4412) ( scom )

    Can you let me know what actions I should take to further investigate/resolve this issue.


    miércoles, 25 de junio de 2014 23:54


Todas las respuestas

  • The KB is 968967 :

    “The CPU usage of an application or a service that uses MSXML 6.0 to handle XML requests reaches 100% in Windows Server 2008, Windows Vista, Windows XP Service Pack 3, or other systems that have MSXML 6.0 installed”

    For this issue, you can refer below link

    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer" Mai Ali | My blog: Technical | Twitter: Mai Ali

    jueves, 26 de junio de 2014 0:25
  • Our RMS for some reason spiked about 2 weeks ago and HealthService.exe consumes 100% of the CPU.  I installed this hotfix and it did absolutely nothing.  the only fix is to stop the health service which is not an option for us.  I have installed a list of hotfix reccomended by Kevin Holman and a vast array of other fixes and nothing is working.  This is really frustrating

    Warm Fuzzies!

    martes, 2 de junio de 2015 18:16
  • Had the same problem start for me yesterday (12/07/2018)

    I assume its a superceeded update, for me 2012 R2 with update KB4338419

    "Security and Quality Rollup updates for .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1, and Server 2012 R2"

    Uninstall and system is running normal.

    Will keep an eye on this.

    jueves, 12 de julio de 2018 23:58
  • We have exactly the same issue, same OS and started since the same patch installed.
    viernes, 13 de julio de 2018 8:18
  • We are seeing the same issue on a 2012R2 server that had KB4338419 installed last night.

    This server specifically runs Azure AD Connect and the process that is using high CPU is Microsoft.Identity.Health.AadSync.MonitoringAgent.Startup.

    Uninstalling KB4338419 did not resolve the high CPU usage for me.

    viernes, 13 de julio de 2018 15:09
  • Same issues here, on a fully patched Server 2012R2 as well as Server 2016.

    .net Framework 4.7.2 does not resolve the issue either.

    So, no solution so far for me.



    Lothar Lindinger

    domingo, 15 de julio de 2018 18:32
  • I've nothing helpful to add - only that I'm seeing very similar.

    For us I have a process "Microsoft.Online.Reporting.MonitoringAgent.Startup" that is sucking over 95% of CPU.

    This server was fine until patched yesterday.


    Andy Hartwell

    lunes, 16 de julio de 2018 10:10
  •  We had the same issue on our server running windows 2012 R2 and removed update KB4338419 and this resolved the issue with the high CPU usage 
    lunes, 16 de julio de 2018 10:43
  • Same issue here.  I don't appear to have KB4338419 installed.   Maybe there is an update to the Azure tool itself?


    lunes, 16 de julio de 2018 12:41
  • Same issue for me too. I'm running the current version of Azure Sync. I did have the patch installed, which seems to have triggered the behavior, but removing hasn't helped.
    lunes, 16 de julio de 2018 15:19
  • I'm having the same issue too. 

    I've narrowed it down to either KB4338814 or KB4074590. Those are the only two updates that were installed 7/11 (when my issue started). 

    Problem I'm having now is that I cannot remove them because my add/remove programs update history is blank. Tried from command line, but it doesn't find the update. 

    Have you had any luck?

    lunes, 16 de julio de 2018 15:45
  • KB4338814 is the only one my boxes installed yesterday, both show the behavior - a 3rd, which is due for patching next weekend, is running normally.
    lunes, 16 de julio de 2018 16:07
  • I run Get-ADSyncAutoUpgrade and get that it is in "suspended" state. In my case, I don't want AAD Connect to upgrade automatically. By setting it to "Disabled" fixed my problem.
    lunes, 16 de julio de 2018 16:31
  • Brand new AADConnect (staging) box on 2016, patched yesterday 15JUL2018, both it and the slightly older (Active) sibling showing same behavior. only KB4338814 showing for this month. 'backup' staging server was not patched, does not show any issue.

    Microsoft.Identity.Health.Aadsync.MonitoringAgent.Startup.exe is consuming all available CPU, reboot doesn't clear behavior, can only work on the system after stopping the service and then find a stack of terminated processes mscorsvw.exe are continuing to chew most but not all CPU.



    After also stopping the Insights service, the mscorsvw.exe procs no longer chewing CPU.C:\Program Files\Microsoft Azure AD Connect Health Sync Agent\Monitor\Microsoft.Online.Reporting.MonitoringAgent.Launcher.exe"

    Azure AD Connect Health blade  shows Health service data is not up to date for both servers.

    have disabled both services and rebooted, moved to remove Security Update for Microsoft Windows (KB4338814 / Cumulative Update for Windows Server 2016 for x64 based Systems). Then after an eternity of waiting for uninstall, enabled (auto/delayed start) of both services and rebooted.

    Health services are both now running without CPU spike, waiting to see if azure connect health updates. only one .startup.exe proc is now running, had been 5 previously.

    Hoping Miguel's suggestion works so I can put the patch back on here, checking now...

    On two separate boxes, setting to Enabled or Disabled did not resolve the issue, once the services started fully running. Removing KB4338814 did resolve the CPU issue, adding it back brought the issue back. Still working to see if it resolves the Azure Connect Health failure to report, takes a while to manhandle the update.

    lunes, 16 de julio de 2018 16:35
  • After 30 minutes, CPU usage is back up again to 98%
    lunes, 16 de julio de 2018 16:40
  • Same thing here, since Windows 2012 RS patch on july 12th, the cpu is maintaining a 96% load.

    Uninstalled update KB4338814 and the problem is still present. This is causing major headaches

    lunes, 16 de julio de 2018 17:11
  • I'm also seeing this on a Win2012 R2 x64 server running Azure AD-Sync.  I think the AD sync is in play here as my identically patched server does not have this issue (and doesn't have Azure AD Sync on it).

    I applied these windows updates Friday and this is the result.  KB4338815, KB890830, KB4340558

    lunes, 16 de julio de 2018 17:12
  • I have same error, 

    I disabled the service , but it automatically launches again. 

    I will try your solution, and see what happens. 

    lunes, 16 de julio de 2018 17:13
  • Hi all,

    Since this seems like very common issue, has anyone opened a case with Microsoft regarding this? I would love to know what solution they have for this.


    Sam (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" wherever applicable. Thanks!) Blog:AnalyticOps Insights Twitter:Sameer Mhaisekar

    lunes, 16 de julio de 2018 17:37
  • From Reddit.

    I've tried this, but not sure if it's helping yet.

    lunes, 16 de julio de 2018 17:38
  • We are running into the exact same issue. But our issue seems to have started around installation of a patch on June 9th which was KB4054566.

    lunes, 16 de julio de 2018 19:14
  • Hi all, 

    I found this thread , there is someone directly from MS Azure team is giving some solution. 

    Is definitely related with a patch, and depends on which server either 2012 or 2016. I'm trying now removing KB4338419 and see if it resolve the issue for us.

    lunes, 16 de julio de 2018 19:16
  • Confirmed, Security Update for Microsoft Windows (KB4338814 / Cumulative Update for Windows Server 2016 for x64 based Systems) removal fixes the issue on 2016. Guess we'll need to wait on an update from MS before reinstalling that.
    lunes, 16 de julio de 2018 20:14
  • Have the same issue after Windows updates installed on the 12th July 2018 on Server 2012 R2 running Azure AD connect. Azure AD Connect is up to date. I ran a change config on Microsoft Azure AD Connect Health agent for sync from programs and features. It asked to authenticate with Azure again and since then the CPU seems to be at normal operating levels. I am hoping this is a workaround, for now, let's see if it lasts!
    miércoles, 18 de julio de 2018 14:55
  • Spoke too soon, CPU back at 100% :( 
    miércoles, 18 de julio de 2018 14:59
  • I'm having the issue too. I tried installing the new patch released Monday but no luck.  KB4345418. So I have stopped the service and disabled it.  Does this break Azure AD Synchronization?  Or is it just a monitoring service to check health?
    miércoles, 18 de julio de 2018 16:35
  • We are seeing the exact same issue since applying July Server 2016 CU for x64 on our AADConnect servers. Hope there is a fix soon.
    • Editado Xe Elite miércoles, 18 de julio de 2018 16:43
    miércoles, 18 de julio de 2018 16:42
  • Just the monitoring service. You'll get no email alerts from "Azure AD Connect Health Notification <>" if those are configured. I also disabled the Insight service since it was also wreaking CPU havoc. If you have an O365 tenant you'll still get the identity synchronization error reports email sent to your registered address so you'll not be missing problems, but none of the Health analytics.
    miércoles, 18 de julio de 2018 20:15
  • uninstalling KB4338814 on our Server 2016 DC worked!
    miércoles, 18 de julio de 2018 22:58
  • We didn't install KB4338814, we used the later July CU - July 16, 2018—KB4345418 and the problem still exists.

    jueves, 19 de julio de 2018 8:13