High cpu usage with firewall enabled

[Sheridan]

Odd one this - even for 10! On a set of 1607 (latest build) machines we've noticed initial logins taking a long time (>=5 mins) and it seems to be because the firewall service is clocking a steady 45-50% of the cpu. Now these are oldish PCs but worked fine on W7 and work fine when the firewall service is disabled.

 

It seems to settle down after about 10 minutes - until the pc is rebooted and the usage racks up again.

 

I can leave the firewall service disabled but its not ideal.

 

The task manager shows the guilty process as Service Host: Local Service (No Network) which shows the four services, Windows Firewall, Diagnostic Policy Service, Coremessaging and Base Filtering Engine.

 

Out of those you can only really stop the firewall and it doesn drop the cpu right down to 3-6% usage on idle, bring the logins back down to the sub minute level which is acceptable for this age of machine.

 

I've tried several different network card drivers and it seems to be the same result. Odd.

[Passat1983ICTech]

try this out

 

Hello there,

 

 

I am having the same issue. The problem started about a week ago and when I disable Windows Firewall, everything works fine.

 

 

I don;t understand how doing what is suggested by Precious Leb will help anything except stop a whole bunch of processes and services on my computer. I have already identified that Windows Firewall is the culprit.

 

 

There must be a better solution than just turning off the Windows Firewall service. I do run EST Smart Security, so I am not completely vulnerable, but things used to work before and something has changed on this computer. Everything else runs fine on the computer and I have not installed any new product on it recently.

 

 

Thanks.

 

and this one

 

Hi,

 

 

Let's try a different approach, we recommend that you run System File Checker and Deployment Image & Servicing Management tools to check the system for any corruptions. Follow the steps below:

 

1.Press Windows + X, and then select Command Prompt (Admin).

2.Type SFC /Scannow on the prompt, and then press Enter. This scan will repair system files.

3.Type DISM /Online /Cleanup-Image /RestoreHealth, and then press Enter. This will fix any corruptions that it finds.

[ZeroHour]

@Sheridan What AV do you use?

 

Passat ESET does hook into Windows Firewall and control it so its possible its causing the issue. I have ESET on this rig right now but I have disabled the firewall features so I could control Windows Firewall myself. I know things like IDS and network scanning can cause major issues on large networks if not turned off.

[Sheridan]

We use Sophos, and like you disable its firewall settings to use the Windows firewall with GPO settings. We Sophos on the same hardware with no issues (although W7 admittedly) and various other W10 PCs running Sophos with no issue.

 

Doing SFC probably won't make much difference, these PCs have recently been reimaged to try and resolve the problem, so they are basically a new install of W10.

 

Oddly, on this set of PCs, Windows update doesn't work as it fails to download. If we enabled the firewall the PCs is unusably slow but the updates start to download!

 

I might remove Sophos temporarily and see if it has any effect.

[ZeroHour]

We use Sophos, and like you disable its firewall settings to use the Windows firewall with GPO settings. We Sophos on the same hardware with no issues (although W7 admittedly) and various other W10 PCs running Sophos with no issue.

 

Doing SFC probably won't make much difference, these PCs have recently been reimaged to try and resolve the problem, so they are basically a new install of W10.

 

Oddly, on this set of PCs, Windows update doesn't work as it fails to download. If we enabled the firewall the PCs is unusably slow but the updates start to download!

 

I might remove Sophos temporarily and see if it has any effect.

 

Yeah worth a go, a lot of AV now just hooks into Windows Firewall so they dont have to put another kernel driver in the system, which is good, but it means you cant manage windows firewall normally.

[Sheridan]

Hmm disabling Sophos seems to have no effect. If you login with the Firewall service disabled, and then enable it the CPU usage shoots up and the firewall service cannot then be stopped, it takes a reboot to get the PC working again.

 

I wonder if its a combination of W10 and the hardware.

[ZeroHour]

It may also be worth uninstalling Sophos to see if its still hooking in while disabled. Can you try disabling your GPO settings in case something is funky in there as well.

I wouldnt expect it to be hardware related but it depends on the NIC's you have. I know Intel did have a driver issue in the past with their e1000 driver where it would consume lots of ram but I dont think it caused issues with the firewall, it just leaked memory.

[Sheridan]

These are odd Marvell Yukon NICs - with the latest driver being 2012 as Windows 8.1. They seem to work fine, just not when the firewall is enabled!

[ZeroHour]

These are odd Marvell Yukon NICs - with the latest driver being 2012 as Windows 8.1. They seem to work fine, just not when the firewall is enabled!

 

Hmm yeah its possible then with an ancient driver. If you have a PCI nic or wireless nic it may be worth disabling the onboard and trying it with another. I would just remove sophos first just in case.

[Sheridan]

Full removal of Sophos made no difference, as soon as the firewall was enabled the cpu rose to 40-48% and stays around there. if I wait at least 10 minutes it settles down to more normal levels.

 

Bizarrely, one of the PCs in this group actually has a different NIC to the others, but shows the same problem. Thats thrown me as it doesn't point to it being driver based!

[localzuk]

Have you had a look to see if the devices are generating, or being bombarded with lots of network traffic?

[Sheridan]

I'd have to install Wireshark or similar on one of them to see whats going on with traffic - just looking at the windows details doesn't show much traffic across the NIC

[ZeroHour]

Login then disconnect the nic and see if it drops. You could also put it on a switch on its own off network after logging in to see if it drops then.

[Sheridan]

Its actually runs at high cpu even with the NIC disabled, or with the cable out. It must be a bug in W10 somewhere, we have used the same image elsewhere though and not seen this problem

[ZeroHour]

Its actually runs at high cpu even with the NIC disabled, or with the cable out. It must be a bug in W10 somewhere, we have used the same image elsewhere though and not seen this problem

Wow that is very curious, has it got all the CU updates installed?

[Sheridan]

Yup - this 1607 image is fully patched up!

 

It looks like the firewall service isn't starting properly - at least not for around 10-15 minutes. You can see in the services.msc that the IP Sec service is stuck at 'starting' until the cpu usage drops, which implies the firewall services is hanging for some reason. We've tried disabling all other services but the problem appears as soon as the firewall service is re-enabled!

[Sheridan]

Definitely something wrong with the firewall service - once you started it via the services.msc you can't stop it, short of restarting the PC, you eventually get a message saying it didn't repond in time.