Svchost.exe uses excessive CPU resources on a single-core Windows Server 2012 domain controller

Symptoms
Consider the following scenario:
  • You have a domain controller that has only one logical processor.
  • The WinRMRemoteWMIUsers__ group is missing from Active Directory Domain Services (AD DS).
  • The domain has trust relationships with other domains.
  • The domain controller does not have the NeverPing parameter, or this parameter is disabled.
  • The domain controller receives two or more WinRM requests in a short period (for example, within 1 second).
In this scenario, a Svchost.exe process that's running the Windows Remote Management (WinRM) service consumes 100 percent of CPU resources on the domain controller. This causes the system to run very slowly or to freeze.
Cause
The issue occurs when a WinRM 3.0-enabled computer is promoted to the status of domain controller of a domain that was created in an earlier version of Windows. Possible scenarios include the following:
  • WinRM 3.0 is installed on a Windows Server 2008 R2 domain controller as part of the Windows Management Framework 3.0.
  • A Windows Server 2012 or Windows Server 2012 R2 computer is promoted to a status of domain controller of a Windows 2008 R2 domain.
Resolution
To resolve this issue, create a domain local group that's name "WinRMRemoteWMIUsers__" under any container in AD DS.

Additionally, you can mitigate this issue by eliminating any of the conditions that are described in the "Symptoms" section.
WinRM, High CPU, WinRMRemoteWMIUsers__
Properties

Article ID: 3118385 - Last Review: 11/24/2015 02:20:00 - Revision: 2.0

Windows Server 2012 Datacenter, Windows Server 2012 Standard, Windows Server 2012 R2 Standard, Windows Server 2012 R2 Datacenter, Windows Server 2008 R2 Datacenter, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 Standard

  • kbexpertiseadvanced kbsurveynew kbtshoot KB3118385
Feedback