High CPU usage when network connection status is changed (network cable is plugged-in or removed-out from the LAN port)

Question

Dear All,

I have a problem when the network cable is plugged-in or removed-out from the LAN port. The problem is that when the network cable is plugged-in or removed-out from the LAN port, the windows defender firewall service causes my 4 core CPU to be loaded 25%+ for about 1 minute or more (single core load). I have tried to reset all network configuration, firewall rules and any other solution with no luck. The problem occurs even when the firewall is disabled (no control of in/out traffic). I have been trying to pinpoint the cause of the problem and I have concluded these temporary workarounds :

1. Disabling the "Windows Defender Firewall Service (mpssvc)" >>> the downside is that no firewall is active.

or

2. Disabling the "Windows Connection Manager Service (Wcmsvc)" >>> the downside is that the windows data usage tracking will not work and WLAN AutoConfig Service (WlanSvc) which is required for wireless functionality will not work as both of them depend on the Windows Connection Manager Service (Wcmsvc).

or

3. Disabling the "Network Connection Broker Service (NcbService)" >>> the downside is that windows store will not work.

N.B.

- Trying to stop either "Windows Defender Firewall Service (mpssvc)" or "Windows Connection Manager Service (Wcmsvc)" during the CPU load will not work, while trying to stop the "Network Connection Broker Service (NcbService)" during the CPU load can be done and the CPU load is gone.

• Doing in-place upgrade did not solve the problem, while resetting the windows completely resolves it.
• Installing the latest windows update did not help.
• Windows 10 Version is the Latest one (22H2)

Any help is appreciated.

***moved from Windows / Windows 10 / Performance and system failures***

Answer 1

Hello,

Thanks for reaching out here in the Microsoft Answers Community.

The "Network Connection Broker Service" is used to discover other Windows computers in the same network.

Does the computer serving a network share to other computers? Also, do you have network locations set up as network drives?

We look forward to your response.

Best Regards,

Sheng G. - MSFT | Microsoft Community Support Specialist

Answer 2

Date: 01 January 2025

The reply has been updated

Dear Sheng G.,

Many thanks for your response.

The computer is a part of small office network with local file sharing enabled (SMB). It was an image deployed to all PCs in the network so the problem exists in all of them.

I do not have network locations set up as network drives and the image was not applied to the computer serving a network share to other computers (the problem does not exists on it).

N.B.

During troubleshooting, I have tested removing all of the third party installed applications to ensure that the problem is not related to them.

Also, I have started the computer in "Safe Mode with Networking" to ensure that there is no third party driver or service is causing the problem (in the beginning I suspected the "Windows Connection Manager Service (Wcmsvc)" but after further investigation I have reached to the "Network Connection Broker Service (NcbService)" which when stopped the CPU load is gone).

I have proceeded with disabling the "Network Connection Broker Service (NcbService)" and the problem is gone. Microsoft Store App is working and also File Sharing is working too.

Regarding The "Network Connection Broker Service" : the service description states that "Brokers connections that allow Windows Store Apps to receive notifications from the internet."

I have tested disabling the "Network Connection Broker Service" and as a result the "Microsoft Store" app could not connect to the internet even if I have disabled the firewall (I use Malwarebytes Windows Firewall Control as a GUI app for dealing with the Windows Firewall)

Looking forward for your response.

Again, many thanks Sheng G. for your reply.

Best Regards