1

I have 15 computers all with the same problem. They all have an idle cpu usage of around 80%. This is straight after a login and persists for around 30 minutes before the problem temporarily resolves itself (until next restart.)

svchost.exe (LocalServiceNoNetwork) is using the CPU, and in resource manager MpsSVC is the service using the cpu. This service is related to the windows firewall.

Running windows in diagnostic start up cpu usage is normal. Disabling all non microsoft services still results in high CPU usage.

I've tried to repair using SFC. It says files are repaired, but issue persists on restart. Only one file appears in the logs as failed to repair, and shows up 4 times is:

2016-11-29 14:33:13, Info                  CSI    00000730 [SR] Cannot repair member file [l:36{18}]"Amd64\CNBJ2530.DPB" of prncacla.inf, Version = 6.2.9200.16430, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch

Have also tried using DISM with an up to date source with the same result.

I've also tried turning on the windows firewall logging, unfortunately the MMC snap-in crashes on these machines as well. The event log for windows firewall doesn't have anything that stands out.

Update

Thanks to magicandre1981 I have been able to identify the cause. After letting the firewalls calm down and finish enumerating their rules, I can access the windows firewall. There are an awful lot of browser choice rules that have been added. I can only assume its the sheer quantity of these, and new ones being created which is causing the slow down.

8
  • If it is a network problem, e.g. they are receiving lots of connects, you could try starting them up disconnected. Also try using Wireshark to see what's going on at the time.
    – Jool
    Nov 29, 2016 at 13:59
  • Should have mentioned, wiresharked them, didn't see anything untoward. I also disabled the network adapter to rule out me not understanding what I was seeing, still high usage.
    – Lister
    Nov 29, 2016 at 14:13
  • One additional thing I have noticed is that TIWorker.exe and system is doing alot with WinSxS in terms of disk activity. Not sure if that would be linked or if it is a coincidence.
    – Lister
    Nov 29, 2016 at 14:29
  • Do you know if your Windows Updates are working correctly? I'm also wondering about Windows 10 compatibility tests. Pure speculation.
    – Jool
    Nov 29, 2016 at 14:38
  • WU diagnostic came back good, ran a manual check on the updates, non available and it didn't come up with one of the error variations it can come up with. I have just realized the SxS is probably the sfc check that was running while I was checking perfmon.
    – Lister
    Nov 29, 2016 at 15:02

3 Answers 3

1

Analyzing the ETL with WPA shows the CPU usage comes from enumerating the firewall rules (FirewallAPI.dll!FwEnumRules) which results in a lot of MrmCoreR.dll calls like MrmCoreR.dll!Microsoft::Resources::Runtime::CResourceReferenceHandlerInternal::GetM3ResourceString to load some string resources.

1 Thing you can do is to remove all self defined rules and start creating your own later again.

Also Windows 8 (6.2.9200) is out of support! Update to 8.1 (6.3.9600) to get new updates. Maybe this is an issue which is fixed in 8.1.

5
  • Thanks for the info, the firewall is actually turned off (Not the service obviously) I'll have a look tommorow and rsop one of the machines and see if a GPO is having a wierd affect. I would love to upgrade these machines to 8.1 (The plan is actually 10) but there are various non technical reasons why we cant at the moment!
    – Lister
    Nov 30, 2016 at 19:36
  • in the meantime, install the 2012 update rollups to have a better protection against security issue. Dec 1, 2016 at 5:13
  • I have found its "Browser Choice" inbound and outbound rules being created, any idea what would cause it? Just having a google myself!
    – Lister
    Dec 1, 2016 at 12:35
  • sorry I have no idea why this "Browser Choice" is causing the issues. Dec 1, 2016 at 16:08
  • No worries, playing around with it tommorow. Youve helped us get things back on track, the machines are actually usable after the rules are removed!
    – Lister
    Dec 1, 2016 at 16:38
0

Do you have a multi-user lab? Metro apps add a lot of extra firewall rules for each user. See if these commands in PowerShell return a lot of results. The more rules there are, the more CPU is used when a new user logs in:

get-netfirewallrule -all
get-netfirewallrule -all -policystore configurableservicestore

The second command will probably return a lot more results. You can delete any rule owned by an sid that no longer has a profile. Windows doesn't clean them up when profiles are deleted. The second set of rules won't appear in the Windows Firewall Control Panel.

1
  • Thanks for the advice, this is not a lab but an environment with about 2000 users! We managed to fix the issue after the accepted answer pointed us to the correct area causing the issue.
    – Lister
    Feb 3, 2017 at 20:02
0

This is for Windows 8/(10 - 1904) LocalServiceNoNetworkFirewall 100% CPU usage Just install Tinywall and disable Windows Defender Firewall as is use 100% CPU and its su ck

To Disable the Windows Defender Firewall Service, modify the Start
REG_DWORD value, from 2 to 4 at the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc

Also when you had problem with login black screen you have to restart OS and try pressing Ctrl+Alt+Del then go to task manager and run explorer.exe after that run regedit and disable windows defender firewall and install tinywall ( RDP can be blocked by default )

enter image description here

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.