I noticed that my laptop's CPU starts getting used (maybe 15% usage?) and the CPU fan turns on, generally in the evening when my laptop has been idle for 5 minutes or so. The process using the CPU was System which doesn't tell me a lot so I decided to leave Process Explorer running and monitoring threads for System. It started using CPU again and this is what I found:

Process Explorer system

The thread eating the CPU after a few minutes of idle had the start address ntoskrnl.exe!RtlAvlRemoveNode+0x7ba0. So it seems pretty core to the system. Does anyone know what might be causing this and/or how I could further diagnose it? I don't like my CPU fan spinning up like this and I would like to stop the system doing this.

I even disabled all scheduled tasks that are triggered on idle (finding them with PowerShell Get-ScheduledTask | Where-Object { $_.State -ne "Disabled" } | Select-Object TaskName, TaskPath, Triggers | Where-Object { $_.Triggers -match "MSFT_TaskIdleTrigger" }) and it still happens.

  • Does this happen when booting in Safe mode? If it doesn't, you might use Autoruns to disable startup task in bunches until you find the problem one. – harrymc Oct 22 '18 at 8:34
  • It's the NT kernel using the CPU; I doubt it's any startup task. – Jez Oct 22 '18 at 10:36
  • Try booting in Safe mode for the test. System can be many things. – harrymc Oct 22 '18 at 10:44
  • 2
    I dont think you caught all 'idle tasks" with that query. For example the infamous "RunFullMemoryDiagnostic" doesn't show. You can use the Windows Performance Toolkit to trace what it's doing. See superuser.com/questions/527401/… for great examples by magicandre1981 – HoD Oct 22 '18 at 11:03
  • Although this doesn't address the underlying issue, if the CPU Fan spinning up is an issue, have you considered getting a fanless PC? – Stese Oct 25 '18 at 9:33

The thread's start address mentions RtlAvlRemoveNode. This is a function called through the ntoskrnl.exe. Rtl stands for Run-Time Library so (most likely and without get further into it) it gets called through a native application (which would be, for example, the autochk program). If you want to know more about the background there's a lot of information on this site. However it's only the start address, it's not necessary this function that causes the CPU time usage. Press the "stack" button to see the full call stack or use 3rd party tools like ProcessThreadsView.

You have two basic options:

  • The trail and error approach: You disable applications for example through the Task Scheduler / Safe mode etc. hoping to disable the right application. (Applications could be the screensaver, defrag, search index, etc. most likely but not necessarly something that is triggered by the PC being idle)

  • The analytical approach: You run further analysis to pinpoint the problem for example by further analysing the thread in question or using "Windows Performance Toolkit" to further identify the application that causes the CPU usage

Since the analytical approach has quite a lot of overhead - knowledge wise - I would suggest the trail and error approach. Although it's just educated guessing it's most likely you are not the only one having the problem, so trying out most common solutions should be a good approach.

If you don't get anywhere by trail and error you will have to switch to a more analytical approach. As HoD suggested in his comment, Windows Performance Toolkit is a good next step here. Once you have more information or run into specific trouble you can further specify you're question so we'll be able to help you.

There is also the chance this behaviour is caused by something like malware, bugs, problematic updates etc. please take that into account, especially if you use the trail and error method.


The subsystems being called that I can identify in your calls stack are :

  • MMCSS - mmcss.sys
  • DirectX 12 - dxgmms2.sys

One can see other low-level utility function calls, but we don't know who their callers are, so they do not add much information. The high-level subsystems clearly indicated here are MMCSS and DirectX 12:

  • Multimedia Class Scheduler service (MMCSS) : Enables multimedia applications prioritized access to CPU resources.
  • DirectX 12 : Windows software that works directly with your video and audio hardware.

It is therefore clear that what is taking your CPU is an application that has a graphical component. This GUI component might or might not be responsible for the CPU charge, but the important conclusion here is that the application in question does have a GUI.

A graphical application is never started by the Task Scheduler, so this is not the direction to go. You need to find a graphical application that is triggered by an idle condition.

The most obvious candidate is a screen-saver. I would suggest to turn it off as a test :

  • Right-click the desktop and choose Personalize > Lock screen > Screen saver settings, set (None) as the Screen saver and click OK.
  • You could instead in Control Panel > Power Option > Change plan settings, set "Turn off the display" to at least have a blank screen.

If that does not help, you will need to find another installed graphical application that does something different on idle.

  • Thanks, how do you come to the conclusion that "RtlSetOwnerSecurityDescriptor" uses a lot of CPU time? Maybe I overlooked s.th. but I can not see any indications for that?! – Albin Oct 24 '18 at 19:39
  • @Albin: As I said, I didn't, the poster did. I suggest we clean up our above comments before a moderator gets annoyed. – harrymc Oct 24 '18 at 20:18
  • Let us continue this discussion in chat. – Albin Oct 24 '18 at 20:23
  • It's not a call stack; it's a dozen separate threads. The only one using significant CPU is the top one, in RtlAvlRemoveNode. The mmcss thread doesn't seem to be responsible for much CPU at all. – dave Oct 24 '18 at 23:08
  • The fact that the start address is RtlAvlRemoveNode + something does not necessarily mean we're executing in RtlAvlRemoveNode. That might just be the closest symbol available to ProcessExplorer. We could guess if we knew something but alas the screen image was too small. Is a wider image possible, capturing all of the +0x.... part? (An RTL AVL routine seems an unlikely thread-start) – dave Oct 25 '18 at 0:02

It's just the Windows 10 maintenance tasks that start up after the system has been idle for a while.

  • 2
    Erm, which tasks? How can I tell? How can I stop them from running? – Jez Oct 10 '18 at 19:53
  • See the Security and Maintence section on the old Control Panel (you have to search for it with Cortana). It will start up things like disk defrag, update cleanup etc. You would have to search through the Task Scheduler to disable what you don't want. docs.microsoft.com/en-gb/windows/desktop/TaskSchd/… – David Marshall Oct 10 '18 at 20:59
  • I disabled them and the problem still happens. – Jez Oct 19 '18 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.