none
svchost.exe -k NetworkServiceNetworkRestricted uses all cpu after laptop comes out of sleep

    Question

  • windows 7, x64

    Everytime I wake up my laptop, this POS hogs my cpu for 30 minutes.

    Thanks to MS for obscuring everything via svchost, it's now much easier to troubleshoot.

    Can someone explain, what this super annoying task is doing?  Is there a way to get rid of it?

    I can't wait to see how win 8 makes this better?

    Hey MS... Less IS more

    Friday, April 06, 2012 12:44 PM

Answers

  • Hi,


    Svchost.exe -k NetworkServiceNetworkRestricted points to IPsec Policy Agent Service. You can stop it via NET STOP command or UI in Service.


    Internet Protocol security (IPsec) supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection.  This service enforces IPsec policies created through the IP Security Policies snap-in or the command-line tool "netsh ipsec". 


    Please let us know if you use Norton Internet security and VPN.


    Meanwhile, you can try the following:

    1. Check whether the Startup type of IPsec Policy Agent Service is Manual.

    2. If IPsec Policy Agent Service is running, temporary stop it and see how it works.

    3. Test the issue in Clean Boot Mode and see how it works.


    In addition, you can create Dump file of svchost.exe -k NetworkServiceNetworkRestricted via Process Explorer and monitor the process via Process Monitor.


    Hope this helps.


    Jeremy Wu

    TechNet Community Support

    Wednesday, April 11, 2012 9:50 AM
    Moderator

All replies

  • In sysinternals process explorer, you can hover the mouse over svchost and see what services are inside, and if you doubleclick on it, the threads tab should list the cpu usage of all its services.  In this case it's IPSec.


    • Proposed as answer by JS2010 Friday, April 06, 2012 4:49 PM
    • Edited by JS2010 Friday, April 06, 2012 4:49 PM
    Friday, April 06, 2012 4:49 PM
  • Yup, I know all that.  Thanks.

    Do you know how to get the system to stop running it?

    Or why it needs so much cpu for so long?

    Thanks

    Friday, April 06, 2012 5:09 PM
  • I don't really know.  Maybe you can look at the threads and stacks inside procexp (enable symbols, you'd have to install windbg).

    Monday, April 09, 2012 3:02 PM
  • Hi,


    Svchost.exe -k NetworkServiceNetworkRestricted points to IPsec Policy Agent Service. You can stop it via NET STOP command or UI in Service.


    Internet Protocol security (IPsec) supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection.  This service enforces IPsec policies created through the IP Security Policies snap-in or the command-line tool "netsh ipsec". 


    Please let us know if you use Norton Internet security and VPN.


    Meanwhile, you can try the following:

    1. Check whether the Startup type of IPsec Policy Agent Service is Manual.

    2. If IPsec Policy Agent Service is running, temporary stop it and see how it works.

    3. Test the issue in Clean Boot Mode and see how it works.


    In addition, you can create Dump file of svchost.exe -k NetworkServiceNetworkRestricted via Process Explorer and monitor the process via Process Monitor.


    Hope this helps.


    Jeremy Wu

    TechNet Community Support

    Wednesday, April 11, 2012 9:50 AM
    Moderator