Sunday, September 14, 2014

Windows 8 High CPU usage, windows firewall


I have 15 computers all with the same problem. They all have an idle cpu usage of around 80%. This is straight after a login and persists for around 30 minutes before the problem temporarily resolves itself (until next restart.)


svchost.exe (LocalServiceNoNetwork) is using the CPU, and in resource manager MpsSVC is the service using the cpu. This service is related to the windows firewall.


Running windows in diagnostic start up cpu usage is normal. Disabling all non microsoft services still results in high CPU usage.


I've tried to repair using SFC. It says files are repaired, but issue persists on restart.
Only one file appears in the logs as failed to repair, and shows up 4 times is:


2016-11-29 14:33:13, Info                  CSI    00000730 [SR] Cannot repair member file [l:36{18}]"Amd64\CNBJ2530.DPB" of prncacla.inf, Version = 6.2.9200.16430, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch

Have also tried using DISM with an up to date source with the same result.


I've also tried turning on the windows firewall logging, unfortunately the MMC snap-in crashes on these machines as well. The event log for windows firewall doesn't have anything that stands out.


Update


Thanks to magicandre1981 I have been able to identify the cause. After letting the firewalls calm down and finish enumerating their rules, I can access the windows firewall. There are an awful lot of browser choice rules that have been added. I can only assume its the sheer quantity of these, and new ones being created which is causing the slow down.


Answer



Analyzing the ETL with WPA shows the CPU usage comes from enumerating the firewall rules (FirewallAPI.dll!FwEnumRules) which results in a lot of MrmCoreR.dll calls like MrmCoreR.dll!Microsoft::Resources::Runtime::CResourceReferenceHandlerInternal::GetM3ResourceString to load some string resources.


1 Thing you can do is to remove all self defined rules and start creating your own later again.


Also Windows 8 (6.2.9200) is out of support! Update to 8.1 (6.3.9600) to get new updates. Maybe this is an issue which is fixed in 8.1.


No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...