High CPU usage troubleshooting guidance

Article
12/26/2023

This article helps you identify the cause of sustained high CPU usage. Keep in mind that you can expect CPU usage to increase as a process or an application serves requests. However, if you consistently see CPU usage remain at a high level (80 percent or greater) for prolonged periods, the performance of your system or application will suffer. For that reason, it's important to understand the cause of sustained high CPU usage to be able to correct the problem, if possible.

Troubleshooting tools

Task Manager

Use Task Manager to view CPU consumption to help identify the process or application that's causing high CPU usage:

Select Start, enter task, and then select Task Manager in the search results.
The Task Manager window defaults to the Processes tab. If you see a single list of process names in the Name column, you can expand any instances of grouped processes.
Select the CPU column header to sort the list by CPU usage. Make sure that the arrow that appears on the header points down to sort the data from highest to lowest CPU consumption.

If the process can be stopped, or a related service can be disabled, stop the process or the service. Then, check whether this mitigates the problem.

Resource Monitor

Use the Resource Monitor to view CPU consumption:

Select Start, enter resmon, and then select Resource Monitor from the search results.
In the Resource Monitor window, select the CPU tab.

Note

You might have to maximize the window to see all the data.
Select the Average CPU column header to sort the list by overall CPU usage. Make sure that the arrow that appears on the header points down to sort the data from highest to lowest CPU consumption.

If any of the processes show a higher-than-expected rate of consumption for your environment, consider these top processes first when you try to determine the cause of the problem.

Process Explorer

The Process Explorer tool gives you a complete overview on which processes are currently running on your computer, including details about who invoked the processes, and how much of the total system resources they're consuming.

If you want to verify an operating system-related process (for example, System), follow these steps:

Run Process Explorer as an administrator.
Right-click the process, select Properties, and then select the Threads tab.
Select the thread that consumes high CPU, and then select Stack to view the functions that are being run.

Note

To get a better stack information result, configure symbols in the Process Explorer. To do this, follow these steps:

Install Debugging Tools for Windows.
Run Process Explorer as an administrator.
Select the Options menu, and then select Configure Symbols.
Change the Dbghelp.dll path to C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll, and then select OK.

Common troubleshooting scenarios

This section introduces the scenarios of different processes that use high CPU usage.

Uniquely named singular Microsoft process

Collect a performance monitor log. Use a 1-second to 5-second snapshot interval.
Collect a Windows Performance Recorder (WPR) log while high CPU usage is occurring.

Note

Don't let this log run for a long time because the file grows very quickly. You should have to run the log only for a few minutes (three to five) to capture the high CPU usage.
Run the ProcDump tool two times during reported high CPU usage. Space apart the runs by several minutes.

Svchost process

If a svchost process consumes high CPU usage, and the svchost process contains more than one service, you need to break each service out to run in its own svchost process to determine which service is causing the high CPU usage. To do so, follow these steps:

Open an elevated Command Prompt window.
Break out each service into its own svchost process if it's a shared svchost process. To do this, run the following command:
```
sc config <service name> type= own
```
Note

In this command, replace <service name> with the actual service name.
Restart the service
At the command prompt, run tasklist /svc to verify that the service is running in its own svchost process.

Important

After the problem is resolved, you must return to step 2 and revert what you did.

To do this, replace sc config <service name> type= own with sc config <service name> type= share in the command. Then, restart the service.
After you break each service out into its own svchost process, you now have to identify which service was driving up CPU usage or consuming high CPU usage.
Collect a performance monitor log. Use a 1-second to 5-second snapshot interval.
Record the PID of the offending Svchost process.
Collect a WPR log while the problem is occurring.
Run ProcDump two times during reported high CPU usage. Space apart the runs by several minutes.

Multiple process instances that have the same name

Several instances of a process could share the same name. For example, this problem could occur with the explorer.exe processes on a Remote Desktop Protocol (RDP) server.

To troubleshoot this problem, follow these steps:

Collect a performance monitor log. Use a 1-second to 5-second snapshot interval.
Collect a WPR log while the problem is occurring.
Run ProcDump two times during reported high CPU usage. Space apart the runs by several minutes.
Record the PID of the offending process by running the following command:

tasklist /v /fo csv >Running_Process.txt

Third-party application process

If a third-process is identified as the cause of the problem, you must contact the application vendor to understand why the respective process is causing high CPU usage on the computer.

Data collection

Before the problem occurs

You can use Debug Diagnostic 2.0 version to further troubleshoot this problem. To use the tool, follow these steps.

Install the Debug Diagnostic Tool v2 Update 2.

Important

Uninstall all other versions of Debug Diagnostic tool before you install the 2.0 version.
Select Start, enter performance monitor, and then right-click Performance Monitor to run it as an administrator.
Use Performance Monitor to collect the performance counter log and start the logging.

When the problem occurs

Open the DebugDiag 2 Collection.
Select the Processes tab, right-click the worker process that corresponds to the appropriate application pool, and then select Create Full Userdump.
Repeat step 2 three times while the CPU usage is high.
Stop the Performance Monitor logging.
Compress the data by using DebugDiag. To do this, Select Tools > Create Increment Cabinet File.

We recommend that you keep the information that you've gathered handy in case you have to contact Microsoft Support.