Svchost.exe uses excessive CPU resources on a single-core Windows Server 2012 domain controller
Consider the following scenario:
- You have a domain controller that has only one logical processor.
- The WinRMRemoteWMIUsers__ group is missing from Active Directory Domain Services (AD DS).
- The domain has trust relationships with other domains.
- The domain controller does not have the NeverPing parameter, or this parameter is disabled.
- The domain controller receives two or more WinRM requests in a short period (for example, within 1 second).
The issue occurs when a WinRM 3.0-enabled computer is promoted to the status of domain controller of a domain that was created in an earlier version of Windows. Possible scenarios include the following:
- WinRM 3.0 is installed on a Windows Server 2008 R2 domain controller as part of the Windows Management Framework 3.0.
- A Windows Server 2012 or Windows Server 2012 R2 computer is promoted to a status of domain controller of a Windows 2008 R2 domain.
To resolve this issue, create a domain local group that's name "WinRMRemoteWMIUsers__" under any container in AD DS.
Additionally, you can mitigate this issue by eliminating any of the conditions that are described in the "Symptoms" section.
WinRM, High CPU, WinRMRemoteWMIUsers__
Article ID: 3118385 - Last Review: 11/24/2015 02:20:00 - Revision: 2.0
Windows Server 2012 Datacenter, Windows Server 2012 Standard, Windows Server 2012 R2 Standard, Windows Server 2012 R2 Datacenter, Windows Server 2008 R2 Datacenter, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 Standard
- kbexpertiseadvanced kbsurveynew kbtshoot KB3118385