Performance issues

Applies To: Forefront Client Security

This topic contains the following sections:

Unexpected CPU usage

Svchost.exe uses 100 percent of CPU time for indefinite periods of time

Svchost.exe uses 100 percent of CPU time for short periods of time

Unexpected CPU usage

After installing a distribution server (with the prerequisites of SQL Server and WSUS), you might notice that SQL Server is using substantial amounts of processor time when no actions are being performed.

Background

Installing a distribution server causes WSUS to synchronize with the Microsoft Update servers. WSUS stores this update information in the SQL Server database.

Solution

WSUS should be allowed to complete synchronization before you install Client Security.

Svchost.exe uses 100 percent of CPU time for indefinite periods of time

The Svchost.exe process containing the wuauserv instance might be indefinitely using 100 percent of the CPU time on a computer running the Client Security agent.

To determine if you are experiencing this issue

  1. In Task Manager, click the Processes tab, and on the View menu, click Select Columns.

  2. Select the PID (Process Identifier) check box and click OK.

  3. On the Processes tab, find the PID for the Svchost.exe instance that is using 100 percent of your CPU bandwidth.

  4. Open a Command Prompt window. (Click Start, click Run, type cmd, and press ENTER.)

  5. Type tasklist /svc and press ENTER.

  6. Find the PID for the Svchost.exe consuming processor time and determine if wuauserv is in the Services column for that instance. If the Svchost.exe instance containing wuauserv is consuming 100 percent processor time, you are experiencing this issue.

Background

This issue can occur when there are a large number of updates on the WSUS server that are applicable but superseded. Check the WSUS server to determine whether it meets one of the following criteria:

  • In WSUS 3.0, on the Advanced tab, under Options and then under Automatic Approvals, both the Automatically approve latest revision of updates check box and Decline updates when they are expired check box are selected.

  • In WSUS 2.0, on the Automatic ApprovalOptions page, under Revisions to Updates, the Automatically approve latest revision of the update option is selected.

If the WSUS server meets one of the criteria, see Svchost.exe uses 100 percent of CPU time for short periods of time later in this topic.

Solution

To work around this issue, on the WSUS server, explicitly decline all updates that have been superseded. When an update that has been superseded has been selected, you will see the following message in the bottom pane:

"The selected update has expired and cannot be approved for installation or detection. It is recommended you decline this update."

For more information about managing WSUS, see Distributing definition and engine updates in the Forefront Client Security Administration Guide (https://go.microsoft.com/fwlink/?LinkId=86602).

Svchost.exe uses 100 percent of CPU time for short periods of time

The Svchost.exe process containing the wuauserv instance might briefly use 100 percent of your CPU time on a computer running the Client Security agent. To determine if wuauserv is consuming the processor time, see the preceding procedure.

Background

This issue can manifest itself as high processor use by wuauserv, as well as computer slowdowns and stoppages of the Workstation or Server services. This issue is unrelated to WSUS.

Solution

There is a hotfix available to resolve this issue. For details, see Knowledge Base article 927891 (https://go.microsoft.com/fwlink/?LinkId=86552).