TR Forums

Hi guys,

Currently, I'm using Windows 10 Pro and sometimes, I noticed that the svchost.exe process in Task Manager was used a lot of CPU resource. Normally, my CPU is only at around 3% to 5%. However, sometimes when I look at Task Manager, this process was used up to 40% of my CPU.

The issue isn't permanent problem, it occurs randomly.

Is there any solution that I can use to resolve it?

svchost.exe is the Service Host executable, meaning that it could be running any one of a number of Windows Services. You need to do more digging to find out which one(s) is/are running. 

NTMBK wrote:

svchost.exe is the Service Host executable, meaning that it could be running any one of a number of Windows Services. You need to do more digging to find out which one(s) is/are running. 

How to find out?

Start "Resource Monitor" (type it in the start menu), and in the CPU tab you have a Services pane.

BTW: In the Task Manager you can expand each svchost to see which services run under it. This works in the Processes tab, but not Details.
In Win8 at least it doesn't show per-service stats, but it's still partially informative.

Is it a multi-user box? FWIW, I'm seeing similar when there are multiple simultaneous logins, not an issue in Windows before Windows 10 but certainly is now.

Also affects lsass.exe, and Acronis's schedul2.exe

meerkt wrote:

Start "Resource Monitor" (type it in the start menu), and in the CPU tab you have a Services pane.

BTW: In the Task Manager you can expand each svchost to see which services run under it. This works in the Processes tab, but not Details.
In Win8 at least it doesn't show per-service stats, but it's still partially informative.

With that, a bit more specific, it came from svchost.exe (netsvcs)

NTMBK wrote:

svchost.exe is the Service Host executable, meaning that it could be running any one of a number of Windows Services. You need to do more digging to find out which one(s) is/are running. 

Just a heads up that this will change with the coming Creator's Update. svchost.exe running multiple things was a leftover from earlier versions of Windows where it made sense to combine services in an effort to save resources. They are splitting them back out into individual processes.

It'll also make it easier to restart specific services. Some services can't be restarted without a reboot, and splitting them out will allow services that are currently lumped in with those services to be restarted without a reboot. It could reduce reboots required for some updates, but that hasn't been specifically mentioned as a goal of doing this.

EDIT: Wrong "sense."

curtisb wrote:

NTMBK wrote:

svchost.exe is the Service Host executable, meaning that it could be running any one of a number of Windows Services. You need to do more digging to find out which one(s) is/are running. 

Just a heads up that this will change with the coming Creator's Update. svchost.exe running multiple things was a leftover from earlier versions of Windows where it made since to combine services in an effort to save resources. They are splitting them back out into individual processes.

It'll also make it easier to restart specific services. Some services can't be restarted without a reboot, and splitting them out will allow services that are currently lumped in with those services to be restarted without a reboot. It could reduce reboots required for some updates, but that hasn't been specifically mentioned as a goal of doing this.

I hadn't seen that mentioned anywhere, thanks for the info!

The feature will require you to have sufficient RAM.

Low RAM systems will still bundle services under svchost.exe.

Right, but the cutoff is pretty low...either 2GB or 4GB (pretty sure it's the former). It's really low by our standards around here, but still worth mentioning for those doing research, I suppose.

Things will still run under svchost.exe, but there will be a separate process for each service on systems that meet the memory requirement.

Found the cause. Followed two sources I found in Google:

https://www.youtube.com/watch?v=lSlYI5_nChc

https://usefulpcguide.com/18385/svchost ... -high-cpu/

It seems one or more Windows updates caused this issue. I haven't installed any updates, maybe the computer do it itself. I've tried to uninstall all updates that installed lately and the svchost.exe doesn't eat my CPU anymore.

meerkt wrote:

Start "Resource Monitor" (type it in the start menu), and in the CPU tab you have a Services pane.

BTW: In the Task Manager you can expand each svchost to see which services run under it. This works in the Processes tab, but not Details.
In Win8 at least it doesn't show per-service stats, but it's still partially informative.

I still prefer Process Explorer for this, even if Resource Monitor is a more modern version of the same code.

From my experience Windows update itself is usually the cause on svchost maxing out a CPU thread on Win 10 boxes. Sometimes it's because it is updating Windows 10 in the background without notification, and other times it's just broken due to a bad update or someone modifying windows update settings/permissions.

Oddly enough yesterday I realized my small spare Win 10 home system had this same problem occurring, the Windows update program wasn't responsive and didn't seem to be working even after multiple restarts. Finally gave up and disabled windows update on it entirely and that fixed the maxed CPU thread issue.

curtisb wrote:

Just a heads up that this will change with the coming Creator's Update.  svchost.exe running multiple things was a leftover from earlier versions of Windows where it made sense to combine services in an effort to save resources.  They are splitting them back out into individual processes.

Was there an ETA on that update? I wish they would just release it already. I'll figure out how to update the Win 10 home machine with it later.

UberGerbil wrote:

meerkt wrote:

Start "Resource Monitor" (type it in the start menu), and in the CPU tab you have a Services pane.

BTW: In the Task Manager you can expand each svchost to see which services run under it. This works in the Processes tab, but not Details.
In Win8 at least it doesn't show per-service stats, but it's still partially informative.

I still prefer Process Explorer for this, even if Resource Monitor is a more modern version of the same code.

Wow, Process Explorer is a really really good and useful application. I didn't know about it before.

Kougar wrote:

curtisb wrote:

Just a heads up that this will change with the coming Creator's Update.  svchost.exe running multiple things was a leftover from earlier versions of Windows where it made sense to combine services in an effort to save resources.  They are splitting them back out into individual processes.

Was there an ETA on that update? I wish they would just release it already. I'll figure out how to update the Win 10 home machine with it later.

The current Insider Previews have been this way for the last few releases. They're mostly stable but there are some finicky things here and there so I wouldn't recommend running it on anything important right now. I think the final Creators Update release is supposed to be in the spring considering Redstone 3 is (currently) planned for later this year.

Yes, but I absolutely refuse to run insider builds. I don't want to spend the time or hassle having to deal with infrequently used machines rebooting themselves and having to restart running programs or fix corrupted programs that resulted from the reboots (which I've already had to do on regular builds). I also don't want to deal with unforseen bugs, like that recent issue of a Microsoft update breaking DHCP functionality, god only knows how they managed to pull that one off.   Spring was the general timeframe I saw when googling-at-a-glance as well.

I'm running Insider Preview builds on both my main gamer (system in my signature) and on my Lumia 950 XL phone. Aside from some expected quirks with a few built-in Store apps (which are also being updated frequently), I haven't had a single issue with programs, drivers, or settings being corrupted after an update. They're releasing updates sometimes as frequently as once a week right now.

Keep in mind that there are also three levels on the Insider Preview Program. There's the Fast Ring (which I'm running) which gets the latest builds; Slow Ring which gets builds with a little more vetting; and then the Release Preview ring which gets the more stable preview builds.

So I'm having a similar issue with Windows 10 Automatic updates that is driving me absolutely insane at this point.

Some quick background:

Computers - 1.) Windows 10 Pro Desktop, 2.) Windows 10 Home Laptop
Internet - Frontier DSL (1.2Mbps, max - yeah I live out in the country)

A few weeks ago I noticed that the laptop seemed to have a shinier front end on Windows 10 - some poking showed it had downloaded and installed the Anniversary Edition at some point. Wondering why the desktop hadn't done this yet I started poking around and, digging through the  C:\Windows\SoftwareDistribution\ReportingEvents.txt I came to find that it had tried and failed to install about 11x in the past month or so.

I quickly discovered that EVERYTIME it fails - it starts the 3.3GB download over again from scratch. Everytime. This is an issue bogging down my limited download speed which pretty much kills every other device in the house whenever it's happening for 8 hours at a time. So far I've tried several of the error code "fixes" including clearing out the download folder, both normally and in safe mode and downloading it over again. None have worked.

Last night I tried to use the laptop to make a bootable USB with the windows 10 tool (why did they get rid of the windows 7 version of this that just worked), figuring I'll just resintall the new version over the top on the desktop - so the laptop spent all night downloading the 3.3GB and the tool failed (without explanation) and deleted the whole download. Tonight I will be downloading just the ISO file (so I have it) and use that, so I'm not that worried about that (well, not too much yet).

Here is what I am worried about. i have done the following things, in Windows 10 Pro on the desktop to try and get windows to STOP automatically running svchost.exe and soaking up all my download bandwidth:

Disabling BITS in Services (something you have to do EVERY restart since it seems to reset itself everytime)
Connecting with the WIFI and telling it the connection is metered
Changing the setting in Local Group Policy Editor - Comp Config\Admin Templates\Windows Components\Windows Update\Enabling and Setting updates to manual

In spite of all 3 of those things being active. At the same time. I have force closed svchost.exe in the Task Manager Resource Monitor now... twelve times.. while typing this because it keeps automatically restarting and consuming all my bandwidth.

As an aside - after setting the wifi connection as metered on the laptop in the anniversary edition it also just starts running svchost.exe in the background at full speed with reckless abandon.

There has to be some way to end this madness. Help me Gerbil-wan-nobis. You're my only hope.

There is... but you won't like it. 

Step 1) Set your Default Gateway in network properties to a nonexistent, but local, address.
Step 2) Set up a linux server / vm and install the Squid web proxy service.
Step 3) Configure your favorite browser to point to the Squid server.

Alternatively, you could bring a laptop or phone to a McDonald's WiFi and download a Anniversary Edition Win10 image from there?

I found the other post "Dear Microsoft: Bite Me" and also disabling the Windows Update Service (in addition to all the other things) seems to have been the magic bullet.

Though like BITS I think I'm going to have to do that every time I restart the machine.

The issue has mainly been that the 1607 build is huge and keeps failing so it's basically just running constantly. Hopefully getting the ISO burned to a disc with the other computer and installed will solve that problem. I didn't really notice the updates causing bandwidth issues before the last few weeks when it started the do loop of suck.

Ecliptic wrote:

I found the other post "Dear Microsoft: Bite Me" and also disabling the Windows Update Service (in addition to all the other things) seems to have been the magic bullet.

As I said in my first post it's amazing how often the Windows update is the cause. Glad you found the culprit. I've not disabled BITS and only disable the Win update service and that seems to work fine when I the Group Policy trick isn't an option. 

The stupidity with the Anniversary update re-downloading the ISO is a known issue, I've raged about that one before. The Microsoft USB install creator tool will do the same thing if it fails during the USB imaging attempt for any reason, so it can quickly chew through bandwidth as well. Simple laziness in programming on MS's part, if it can't image the flash drive then obviously it should redownload the ISO on every next attempt. The infamous generic "Something happened" error message also would result in full redownloads of the WIn 10 ISO.   

That's why I generally choose to have the Media Creation Tool create an ISO instead of creating the flash drive itself. You can open the ISO with 7-zip (or right click and select Mount) and extract it onto a FAT32 formatted flash drive.

If you want something even more infuriating, you can't extract a Windows Server 2012 R2 with Update or Server 2016 ISO directly to a flash drive. The install.wim is larger than 4GB (FAT32 file size limit) so you have to extract it to a local drive (or network share) that's NTFS formatted and then split the install.wim into two files...one that's 4GB and the other that's whatever is left.

curtisb wrote:

That's why I generally choose to have the Media Creation Tool create an ISO instead of creating the flash drive itself.  You can open the ISO with 7-zip (or right click and select Mount) and extract it onto a FAT32 formatted flash drive.

That by itself won't make it bootable alas. These days I use Rufus, though the Windows USB tool will still download the most recent official build of the ISO making it a good way to snag an updated ISO for Win 10. Beats having to slipstream in every "service pack". Regarding the file / drive size issue, I just use NTFS formatting for flash drives over 4GB. 

It absolutely will be bootable for UEFI systems. It doesn't work on Windows 7 because the UEFI boot files are in the wrong place in the ISO (you can manually move them to the right place), but it definitely works for both Windows 8.1 and 10. It's the only way I create my bootable flash drives.