Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Svchost.exe uses excessive CPU resources on a Windows Server 2012 domain controller

Svchost.exe uses excessive CPU resources on a Windows Server 2012 domain controller

View products that this article applies to.

Symptoms

Consider the following scenario:
  • The WinRMRemoteWMIUsers__ group is missing from Active Directory Domain Services (AD DS).
  • The domain has trust relationships with other domains.
  • The domain controller does not have the NeverPing parameter, or this parameter is disabled.
  • The domain controller receives two or more WinRM requests in a short period (for example, within 1 second).
In this scenario, a Svchost.exe process that's running the Windows Remote Management (WinRM) service consumes 100 percent of CPU resources on the domain controller. This causes the system to run very slowly or to freeze.

↑ Back to the top

Cause

The issue occurs when a WinRM 3.0-enabled computer is promoted to the status of domain controller of a domain that was created in an earlier version of Windows. Possible scenarios include the following:
  • WinRM 3.0 is installed on a Windows Server 2008 R2 domain controller as part of the Windows Management Framework 3.0.
  • A Windows Server 2012 or Windows Server 2012 R2 computer is promoted to a status of domain controller of a Windows 2008 R2 domain.

↑ Back to the top

Resolution

To resolve this issue, create a domain local group that's name "WinRMRemoteWMIUsers__" under any container in AD DS.

Additionally, you can mitigate this issue by eliminating any of the conditions that are described in the "Symptoms" section.

↑ Back to the top

Keywords: kbexpertiseadvanced, kbsurveynew, kbtshoot, kb

↑ Back to the top

Article Info
Article ID : 3118385
Revision : 2
Created on : 9/11/2017
Published on : 9/11/2017
Exists online : False
Views : 1893