Automatic Update causes SVCHOST.exe high CPU
Symptom
SVCHOST high CPU. If stopping the Automatic Update service, the high CPU issue disappears.
You can use the following method to verify whether it is AU caused SVCHOST high CPU.
1. Run the command to find the PID of SVCHOST which is running on Automatic Update service.
Tasklist –m wuaueng.dll
2. Run the command to enforce client to Automatic Update. In certain circumstances, high CPU issue may recur after running the command.
Wuauclt /detectnow
3. Find the PID of SVCHOST which is running on Automatic Update service, monitor and verify if it causes high CPU for long time. High CPU for short time is normal and is not a problem.
Solution
If Automatic Update causes SVCHOST.exe high CPU, please refer to the following KB articles:
https://support.microsoft.com/kb/916089/en
https://support.microsoft.com//kb/927891/en
You can try the following methods to resolve the issue.
1. Install update KB927891
https://support.microsoft.com//kb/927891/en
2. If client still encounters persistent 100%CPU issue after installing update KB927891, please download and install the latest WSUS 3.0 client:
32-bit versions
https://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe
64-bit version
https://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x64.exe
https://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-ia64.exe
The 2 updates (KB927891and WUA3.0 )to resolve AU related SVCHOST high CPU issue are available on WSUS now.
KB927891 is available on WindowsUpdate /WSUS. It is listed as Critical Updates in WSUS. Please refer to:
KB936301 is listed in WSUS as Critical Updates. It is to install on WSUS 2.0 SP1 server to upgrade Selfupdate tree to “WSUS 3.0” but keep the server as WSUS 2.0, so that client can get WUA3.0 by visiting WSUS selfupdate tree. Please refer to:
https://blogs.technet.com/wsus/archive/2007/05/22/updates-for-wsus-available-today.aspx
Based on our monitoring and customers’ feedback, the above two steps are able to alleviate the Issue.
For the latest update about the issue, please refer to the following web site.
https://blogs.technet.com/wsus/archive/2007/04/28/update-on.aspx
If you have any question about the issue, please contact GCR PSS Security Support Group (shsecs@microsoft.com) to get further technical support.
[v1]Is this supposed to be here?
Comments
Anonymous
January 01, 2003
We've had this problem quite often with our 2003 servers. And we usually just bootet them, and the problem would solve it self. Tried to just disable and then stop the Automatic Updates service, and the CPU dropped instantly. Thanks!Anonymous
January 01, 2003
Anon...thanks for posting that message. I had tried everything listed here so far and none of the suggestions worked until the one you listed. Now just have to wait for the 100 crit updates to installAnonymous
January 01, 2003
I've written an article that has a potentially comprehensive fix to this issue.http://solotechpros.com/2014/01/08/windows-xp-svchost-exe-wuauclt-exe-cpu-100-fix/Anonymous
January 01, 2003
The comment has been removedAnonymous
January 01, 2003
The comment has been removedAnonymous
January 01, 2003
This worked for me: ren "C:WINDOWSSoftwareDistributionDataStoreDataStore.edb" DataStore.edb.bakAnonymous
January 01, 2003
Just reinstalled sp3 from disk and ended up with this bug. Was working great for years untill drive crash. Then reinstalled from my sp3 disk. No excuse for this I have the lastet sp3 on disk it used to work MS has done something to break itAnonymous
January 01, 2003
Installing IE8 after a fresh install of server 2003 R2SP2 fixed my issue. After waiting hours for svchost taking 100% cpu, a 5 minute install fixes the issue. Letting another server sit all night finally worked too but who can wait all that time, time is money! Elohir might have a solution too because the patch referenced is included in the IE8 install (make sure you select download updates). Either way i am glad i found this thread to solve MS updates from wasting so much of my time. Would be great if MS would just release SP3 or a patch roll-up to apply after a fresh install.Anonymous
January 01, 2003
The comment has been removedAnonymous
January 01, 2003
Thank you Tcv! Your solution worked a charm.Anonymous
January 01, 2003
As Elohir posted above:
To fix the 100 % CPU usage of svchost.exe when using Microsoft Windows Update install the Cumulative Security Update for Internet Explorer 6, 7 , 8 9, 10 and 11 (MS KB 2898785) referenced in Microsoft Security Bulletin MS13-097 -http://technet.microsoft.com/en-us/security/bulletin/ms13-097 .
(after you installed the patches mentioned in the original blog posting, of course)Anonymous
May 30, 2007
Tried both patches with no success. The only way I was able to get Windows Update to work was to reset my display driver to absolute minimum (640x480 - 16 colors). The updates ran fine. I haven't had a chance yet to reset the resolution to something real to see if it still works. Maybe something changed in your scrolling green bar?Anonymous
September 13, 2007
I have found that either sometimes a computer has to stay on overnight before it will complete the scanning process. This is possibly due to either certain older (non dual-core) systems can't cope with the massive CPU load that is generated by svchost.exe or the WSUS service can't cope with more than a few client requests at once. Either way it takes on average 2 days to get a Windows XP system updated from a basic SP2 install... quite annoying since the users here expect a turnaround time of a few hours!Anonymous
April 22, 2008
Tried them all still the same issue. This seems to be caused by updating from WSUS 3.0 to WSUS 3.0 SP1. I have got some machines working killing all the update services processes and Deleting %windir%SoftwareDistribution, %windir%System32SoftwareDistribution, %windir%System32CatRoot and %windir%System32CatRoot2 Ran the WindowsUpdateAgent30-x86.exe After the installation ran "wuauclt /detectnow" Let me know if there is a better solution for this....Anonymous
May 14, 2008
I ran the KB927891and WUA3.0 but the problem remained, although better thanit was. Tom's solution clearing out %windir%SoftwareDistribution fixed the issue. However, the cause is not clear. In this case an update to the Genuine Windows Validation tool had occurred about 3 days before the issue started. On the 3rd day a Windows update was flagged to be installed on shutdown, which it was. On next boot the problem started. My client's other PC had the same Genuine Windows Validation tool update applied about a week later, and it too developed the problem 3 days later (ie a week after the first PC).Anonymous
May 14, 2008
The comment has been removedAnonymous
May 23, 2008
I also used Tom's solution to correct this annoying problem. I am running Windows XP Professional with SP2 and all current updates as of 5/23/08. Thanks for the info Tom. Now to fix the rest of the PCs having this problem. One thing I noticed is that it's only happening to my Intel based systems. AMD doesn't seem to be affected though I don't know if that has anything to do with it.Anonymous
April 26, 2013
Thank you for you superior work! You really put your heart into this and IT! I am running all soultions now! Best RegardsAnonymous
September 19, 2013
This was happening for me with Auto and Manual updates for "Windows XP Mode" (virtual windows xp on windows 7. I tried everything I could find documented on fixing the issue to no avail. Upgrading IE 6 to IE 8 seems to have done the trick, now manual updates is actually working! Haven't thoroughly tested, but so far it seems promising :)Anonymous
October 05, 2013
start--run--services.msc--automatic updates--properties--general--startup type.disabled--service status--stop--log on--profile1--disabled--okAnonymous
October 17, 2013
Jeff, you are awesome with that suggestion with WinXP in virtual mode. I have two machines that I have not updated in awhile and that was my holdup also with windows update just continuously running and never offering any updates! Downloaded ie8 from website after stopping automatic update service and once rebooted windows update now updating and installing updates, thanks!Anonymous
November 16, 2013
Just turn-off the Windows Automatic Update --- Anyway Microsoft announced that their support foe WinXP will stop on April 2014 --- by the way , even now 15-November-2013 their downloading for WinXP is not workingAnonymous
November 16, 2013
The comment has been removedAnonymous
November 26, 2013
The contact shsecs@microsoft.com has been expired. This issue looks like something new with Windows Update. The WU team is looking into it. Suppose the fix will be in place soon.Anonymous
November 28, 2013
I have been a customer of Microsoft since the first version of Windows came out 28 years ago. I had planned to buy a new PC during this Black Friday weekend and move from Windows XP SP3 to Windows 8 but have changed my mind about doing anything until I see if the Windows Update team will fix this svchost.exe 99% CPU problem, which appeared in my Dell Dimension 3000 after automatic updates in October. (Since support for XP SP3 will end on April 8, 2014 my gut feeling is that Microsoft has done something nefarious to get a lot of people to do what I was about to do.)Anonymous
November 30, 2013
I get the same issue with svchost running at 99% when I reloaded XP after slicking the disk. No other software on the disk except WinXP SP2, from the original install disk. Tried running SP3 from a CD, still have problem. Updated to IE 8, still have issues. Svchost runs at 99% of the CPU time. Cannot start or run the Firewall (or even start the service for it). I think others have this issue but it may not be obvious. Have to turn off autoupdates or else svchost will eat up all of the cpu time, all of the time. Cannot run many Windows functions like IE because it will start a service host that will eat up all of the cpu time. Cannot run updater manually because once again, all cpu time is being eaten up. No viruses no malware. Have just reloaded directly from the original XP SP2 install disk. SP3 did nothing to fix it. Updating from IE6 to 8 changed nothing. Loaded and ran both Security Essentials and malicious software removal tool and nothing both times. So the issue may not be an updater issue since mine is turned off. Svchost at 99% fires up whenever I run IE8 or IE6 too. Also whatever it is, it prohibits me from being able to bring up the firewall or restarting the firewall service manually also. Like I said, that is not an obvious symptom, others may have that issue too but not know it. Whenever I run almost any program or function, it always fires up svchost and pegs it at 99%.Anonymous
December 03, 2013
We have numerous 2003 servers which are having this problem. SVCHOST.EXE uses up 100% of CPU and causes all critical applications to fail. We've tried everything mentioned in this article - no success.Anonymous
December 09, 2013
we experience the same problem with 2003 servers. 100 % CPU with 1 CPU servers.Anonymous
December 10, 2013
I saw this recently in an XP VM I use . I chased it down to the "Automatic Updates" service. Disabling the "Automatic Updates" service cured it. (Also disables Windows Update from doing Auto updates, but I can live with that for now.)Anonymous
December 10, 2013
The comment has been removedAnonymous
December 11, 2013
svchost.exe 99%CPU started happening on three of my WinXPSP3 machines (two different offices) last nite. (Win 7 PC has no problem.) I disabled Automatic Update service using services.msc, and that fixed it. MS or somebody must have sent some remote commands to all the XP Windows Update Agents recently. I can't think of any other way to explain how all my XP machines in geographically different locations would start doing this simultaneously.Anonymous
December 11, 2013
svchost.exe 99%CPU started happening on 2 of my XP machines. Win 7 is fine. Turning off Auto updates fixed this soooo turning off auto $buy$ Win 8/9/10 will also fix future problems for me.Anonymous
December 11, 2013
I've seen it reported that if you apply the cumulative update for the version of IE on your workstation or server, this problem goes away, at least for a month. I've done this on a x86 2003 server successfully tonight. Go to this link for the full security bulletin: technet.microsoft.com/.../ms13-097 In that link, under Affected Operating Systems, look for your Operating System and your version of IE. The IE version is a link that will take you to the download page. Download and apply, then restart your Automatic Updates service and scan. I did not have to reboot my server after I applied the cumulative update but, of course, I had to reboot after applying the rest of the updates. Hope this helps.Anonymous
December 12, 2013
Thank you, tcv -- your cited solution worked for me. I tried a number of other suggestions until finding yours; as soon as I applied the Cumulative Update for Internet Explorer and then rebooted the system wuauclt.exe is no longer hogging the CPU. Process Explorer shows 2 instances of wuauclt.exe currently active, but they are behaving themselves now!Anonymous
December 12, 2013
The comment has been removedAnonymous
December 13, 2013
Really thanks Tcv, it worked for me too. Manually downloading IE update and installing it resolved this annoying issueAnonymous
December 13, 2013
Anxious to try the update tcv mentions as I have been dealing with this issue for the better part of a week to no avail. Here is the problem...the machine I most need to repair will not run the update! I downloaded the update for XP SP3 IE8, but I get the following errors when trying to run it: "The system cannot find the file specified." Then, "Installation did not complete." HELP!Anonymous
December 16, 2013
Pingback from Microsoft to fix Windows XP SVCHOST redlining issue as soon as possibleAnonymous
December 16, 2013
Pingback from Microsoft to fix Windows XP SVCHOST redlining issue as soon as possible | ShareMyKnowledgeAnonymous
December 16, 2013
Pingback from Microsoft to fix Windows XP SVCHOST redlining issue as soon as possible | ShareMyKnowledgeAnonymous
December 16, 2013
Pingback from Microsoft to fix Windows XP SVCHOST redlining issue as soon as possible | ShareMyKnowledgeAnonymous
December 16, 2013
I had this problem after reformatting and doing a fresh install of XP SP3, found that if I first installed the "Micorosoft Update", Windows update began working as expected with no other fixes.Anonymous
December 16, 2013
I had this problem after reformatting and doing a fresh install of XP SP3, found that if I first installed the "Micorosoft Update", Windows update began working as expected with no other fixes.Anonymous
December 17, 2013
Thank you Tcv, it works !Anonymous
December 19, 2013
If you are stil having this problem (or it is happening again) at the end of December, 2013, the latest patch to address this issue can be found here: http://technet.microsoft.com/en-us/security/bulletin/ms13-097Anonymous
January 18, 2014
tcv - Thanks, your idea about installing the cumulative update for IE worked! I rebooted the server after installing and then Windows Update worked fine and SVCHOST no longer used 100% of the CPU."I've seen it reported that if you apply the cumulative update for the version of IE on your workstation or server, this problem goes away, at least for a month. I've done this on a x86 2003 server successfully tonight.Go to this link for the full security bulletin:http://technet.microsoft.com/en-us/security/bulletin/ms13-097In that link, under Affected Operating Systems, look for your Operating System and your version of IE. The IE version is a link that will take you to the download page."Anonymous
April 17, 2014
I faced the same problem and I got solution from: http://www.microsoftsupportchat.com/blog/post/Windows-update-taking-99%-memory/Anonymous
March 14, 2015
The comment has been removedAnonymous
May 11, 2015
Our client is using Server 2003 R2 Standard edition SP2.
Issue is svchost.exe - Generic host process for win32 services is using 95% of CPU.
I extract svchost.exe and found wuaueng.dll is using morethan 90% CPU and we are unable to fix it(attached for ref).
Requested you kindly provide me solution asap. Your quick response will be appreciated.Anonymous
August 11, 2015
Are there any updates on this issue? I have the same exact issue with Windows 2008 R2 Standard. Killing the Windows Update service is a workaround, but I would like the root cause eliminated.Anonymous
August 11, 2015
I'm seeing the same issue on systems with a single CPU. This condition started after we installed updates from Feb, March, and April during our quarterly MS updates.Anonymous
August 12, 2015
Also getting the same thing. Server 2008 R2 Standard. Tried updating the update agent and clearing the SoftwareDistribution folder but it doesn't help. At the moment the only choice I've got is to keep the service disabled.Anonymous
August 13, 2015
The KB links in this article are all dead. Does anyone still have copies of them or know if they apply to Server 2008 R2?Anonymous
August 13, 2015
I went to the Resource Monitor -->CPY-->Services and could see that wuauserv (Windows Update) was the culprit using all of my CPU power. I right clicked on it Stop Service. The fan immediately stopped running and the CPU usage went down to 18-23%.Anonymous
August 14, 2015
This seems to have fixed it for me.
https://support.microsoft.com/en-us/kb/3075851Anonymous
August 17, 2015
https://support.microsoft.com/en-us/kb/927891/en link is not workingAnonymous
September 08, 2015
https://support.microsoft.com/en-us/kb/927891
Just take off the /en from the link