CPU Usage + Windows Update

[Gongalong]

Hi folks,

 

One of our DCs has a couple of odd issues, potentially related. Running Server 2012 R2.

 

Since the start of the week the CPU usage has been sat at 100% for the Service Host process (this shows 15 services listed underneath). It's a VM, so last night I shut it down, added 3 more CPUs (total of 4) and bumped the RAM from 2048 to 4096MB. Now a single core is still sat at 100% but the server is at least usable.

 

One of the services listed is Windows Update. If I go to Windows Update it says "Some settings are managed by your system administrator". It has shown this for several months but I haven't been too worried as it is receiving and installing updates. There is no Windows Update group policy applied to the server though, so I don't know why it is showing this message. If I go to GPEDIT.MSC and look at the Windows Update section, nothing is configured.

 

Any ideas on what to troubleshoot?

 

Thanks

[HPlum78]

Do a gpresult /r in an elevated PS/ command prompt, then take a look at the applied group policy objects part. Edited February 14, 2019 by HPlum78

[Gongalong]

Thanks. That solves the Windows Update mystery. I was under the impression I had to add "Authenticated Users" to GPOs that target groups of computers, due to some recent security issue with GPOs. What that has done is applied the GPO when I've logged in, GPOs that are only intended for WSUS on some client machines.

 

I suspect it's not connected, but it does allow me to run Windows Update manually and check all is OK, which I'm doing now...

[HPlum78]

So from the task manager you can see what services are using the SVCHOST service from there can you not see the name of the actual service/ program that is spawning the svchost process? maybe if you need more detail you could download a copy of process explorer https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

[Gongalong]

Unfortunately it has grouped together loads of services: Windows Update, Windows Management Instrumentation, Themes, System Events Broker, Shell Hardware Detection, Remote Desktop Configuration, System Event Notification Service, System Events Broker, Task Scheduler, User Profile Service, Background Intelligent Transfer Service, Certificate Propagation.

 

Will give Processor Explorer a try, thanks!

[Gongalong]

Process Explorer shows that it's svchost.exe, unsurprisingly I guess! Not sure if it gives any detail on specific services?

[Gongalong]

Resource Monitor can do it https://serverfault.com/questions/27718/how-do-i-track-cpu-utilization-for-window-services

 

It's Windows Update, ironically. WUAUSERV

[HPlum78]

tasklist /svc /fi "imagename eq svchost.exe from a command prompt will get you a list as well.