Some users have begun complaining of performance issues on their computers running Windows 7. The problem manifests itself as follows: daily at one and the same time (each user at their own time) the computer begins to slow down. The Task Manager shows that the process svchost.exe uses up to 1.2-2 GB of memory and up to 100% CPU of one core. As a result, it is impossible to use the computer during 30-60 minutes: it is slow and frozen up.
Problems have appeared on Windows 7 SP1 x86 and x64 clients receiving updates from the local SCCM server. Run Task Manager on a client and filter the running processes by the memory use in the Processes tab. You can see that the current process svchost.exe is using 11% CPU and 1.2 GB of memory. In fact, svchost.exe is a container process, in which other programs and system service threads are running. Using Task Manager, you won’t be able to understand, which thread (service) causes high load of the system.
More detailed information about a process and its threads can be obtained using Process Explorer by Mark Russinovich.
Run procexp.exe and find the problem process svchost.exe in the list.
Open its properties and go to the Threads tab. Here we can clearly see that the thread of wuauserv (Windows Update) consumes the most part of the CPU resources and memory in svchost.exe. The wuauserv service scans the system and the update server for the necessity to install updates. Due to some code problems, the service begins to “flow” and consumes all available memory up to 1.5-2 GB (maximum size available to the process) and is actively using the page file. The system gets slow.
What’s interesting is that the problem more often appears on the clients having 2 GB of RAM. If a PC is having 4 GB of memory or higher, wuauserv can also “flow” but doesn’t exceed 2 GB, and the problem is not so obvious to the users.
If you stop wuauserv in services.msc console, the load is sharply reduced. And svchost.exe starts to use only 80-100 MB of memory.
First of all, we have tried to reset the settings of Windows Update agent following the instructions given in the article “How to Reset Configuration of Windows Update Agent“. The problem has been solved and has not appeared for some days, but later it has occurred again. It seems that the size of the local cache and the update database reaches some limit, and wuauserv begins to “flow” again.
We have tried a lot of other methods, but only the installation of the following patches for Windows Update agent really helped:
- https://support.microsoft.com/en-us/kb/3050265 (The update of Windows Update agent from June, 2015)
- https://support.microsoft.com/en-us/kb/3065987 (The update of Windows Update agent from July, 2015)
- https://support.microsoft.com/en-us/kb/3102810 (The patch for Windows 7/ 2008 R2, which allows to solve the problem of high CPU and memory load during the installation of updates using WSUS, fromf November, 2015).
After the updates have been installed, the memory usage by wuauserv process has reduced to 200 MB, and the scanning process has taken less time.