svchost.exe 99% cpu

We are running a distributed WSUS 3.0 environment where we have a single
master a about 20 subordinate WSUS server globally serving approximately 3000
clients. We are running SP3 for XP clients and SP2 for all Server 2003 R2
clients. We are seeing about 1-2% of these clients are having the issue where
svchost.exe is taking 99% of the CPU after updates are approved for
installation. There is no common denominator between the machines (except
maybe Office 2003), as I write this, a Server 2003 R2 machine is at 99% while
it is trying to install the updates. Usually we see it once the updates have
been approved and the client is attempting to sync with the WSUS server.
Usually, the only thing we can do is delete the contents of the
SoftwareDistribution folder and manually pull the updates from Windows
Update. We have gone through all the old 'fixes' with no success (927891, WUA
3.0).

Any assistance is in determining the root cause of this is grealy
appreciated.

Started having the same problem beginning Friday night. Using Security
Server (Windows Server 2008 Standard) of EBS; which uses WSUS 3.0.

wuaueng.dll pegs CPU Core, but it appears it is trying to run. Windows
Update will never response.

To prevent high CPU load, disable Windows Update Service.


"smoore0414" <> wrote in message
news:FB1A6739-49D2-4DE0-943C-...
> We are running a distributed WSUS 3.0 environment where we have a single
> master a about 20 subordinate WSUS server globally serving approximately
> 3000
> clients. We are running SP3 for XP clients and SP2 for all Server 2003 R2
> clients. We are seeing about 1-2% of these clients are having the issue
> where
> svchost.exe is taking 99% of the CPU after updates are approved for
> installation. There is no common denominator between the machines (except
> maybe Office 2003), as I write this, a Server 2003 R2 machine is at 99%
> while
> it is trying to install the updates. Usually we see it once the updates
> have
> been approved and the client is attempting to sync with the WSUS server.
> Usually, the only thing we can do is delete the contents of the
> SoftwareDistribution folder and manually pull the updates from Windows
> Update. We have gone through all the old 'fixes' with no success (927891,
> WUA
> 3.0).
>
> Any assistance is in determining the root cause of this is grealy
> appreciated.

[[ Right pew, wrong church. Forwarded to WSUS newsgroup
(microsoft.public.windows.server.update_services) via crosspost as a
convenience to OP.

On the web:
http://www.microsoft.com/communities...pdate_services

In your newsreader:
news://msnews.microsoft.com/microsof...pdate_services
]]

smoore0414 wrote:
> We are running a distributed WSUS 3.0 environment where we have a single
> master a about 20 subordinate WSUS server globally serving approximately
> 3000 clients. We are running SP3 for XP clients and SP2 for all Server
> 2003
> R2 clients. We are seeing about 1-2% of these clients are having the issue
> where svchost.exe is taking 99% of the CPU after updates are approved for
> installation. There is no common denominator between the machines (except
> maybe Office 2003), as I write this, a Server 2003 R2 machine is at 99%
> while it is trying to install the updates. Usually we see it once the
> updates have been approved and the client is attempting to sync with the
> WSUS server. Usually, the only thing we can do is delete the contents of
> the
> SoftwareDistribution folder and manually pull the updates from Windows
> Update. We have gone through all the old 'fixes' with no success (927891,
> WUA
> 3.0).
>
> Any assistance is in determining the root cause of this is grealy
> appreciated.

> smoore0414 wrote:

>> We are seeing about 1-2% of these clients are having the issue
>> where svchost.exe is taking 99% of the CPU after updates are approved for
>> installation. There is no common denominator between the machines (except
>> maybe Office 2003),

And this could be the significant common factor. There was an issue with
Office 2003 some time back. (Actually the issue was with the MSI.DLL, but it
manifested most often in relation to Office updates.) Are all of these
client machines fully updated for all Office 2003 applications?

>> as I write this, a Server 2003 R2 machine is at 99%
>> while it is trying to install the updates.

Does this server machine have any Office components installed? If so, are
they fully updated?

Also, is there a possibility that any of these machines are still running
one of the interim builds of the Windows Installer v3.1?

Here's a KB article that starts at the beginning of this issue, and contains
additional links that may also be relevant:

http://support.microsoft.com/default.aspx/kb/916089


--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

Lawrence,

Yes, they are all updated with latest Office 2003 patches, including SP3.

Oddly enough, the server does have Office 2003 installed as well (not sure
why i did that).

All these machines have had 927891 and WUA client 3.0 installed for quote
some time.

I can't see how they would/could be running an interim build of windows
installer 3.1.

"Lawrence Garvin [MVP]" wrote:

> > smoore0414 wrote:
>
> >> We are seeing about 1-2% of these clients are having the issue
> >> where svchost.exe is taking 99% of the CPU after updates are approved for
> >> installation. There is no common denominator between the machines (except
> >> maybe Office 2003),
>
> And this could be the significant common factor. There was an issue with
> Office 2003 some time back. (Actually the issue was with the MSI.DLL, but it
> manifested most often in relation to Office updates.) Are all of these
> client machines fully updated for all Office 2003 applications?
>
> >> as I write this, a Server 2003 R2 machine is at 99%
> >> while it is trying to install the updates.
>
> Does this server machine have any Office components installed? If so, are
> they fully updated?
>
> Also, is there a possibility that any of these machines are still running
> one of the interim builds of the Windows Installer v3.1?
>
> Here's a KB article that starts at the beginning of this issue, and contains
> additional links that may also be relevant:
>
> http://support.microsoft.com/default.aspx/kb/916089
>
>
> --
> Lawrence Garvin, M.S., MCITP:EA, MCDBA
> Principal/CTO, Onsite Technology Solutions, Houston, Texas
> Microsoft MVP - Software Distribution (2005-2009)
>
> MS WSUS Website: http://www.microsoft.com/wsus
> My Websites: http://www.onsitechsolutions.com;
> http://wsusinfo.onsitechsolutions.com
> My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin
>
>

Lawrence,

Yes, they are all updated with latest Office 2003 patches, including SP3.

Oddly enough, the server does have Office 2003 installed as well (not sure
why i did that).

All these machines have had 927891 and WUA client 3.0 installed for quote
some time.

I can't see how they would/could be running an interim build of windows
installer 3.1.

-Scott

"Lawrence Garvin [MVP]" wrote:

> > smoore0414 wrote:
>
> >> We are seeing about 1-2% of these clients are having the issue
> >> where svchost.exe is taking 99% of the CPU after updates are approved for
> >> installation. There is no common denominator between the machines (except
> >> maybe Office 2003),
>
> And this could be the significant common factor. There was an issue with
> Office 2003 some time back. (Actually the issue was with the MSI.DLL, but it
> manifested most often in relation to Office updates.) Are all of these
> client machines fully updated for all Office 2003 applications?
>
> >> as I write this, a Server 2003 R2 machine is at 99%
> >> while it is trying to install the updates.
>
> Does this server machine have any Office components installed? If so, are
> they fully updated?
>
> Also, is there a possibility that any of these machines are still running
> one of the interim builds of the Windows Installer v3.1?
>
> Here's a KB article that starts at the beginning of this issue, and contains
> additional links that may also be relevant:
>
> http://support.microsoft.com/default.aspx/kb/916089
>
>
> --
> Lawrence Garvin, M.S., MCITP:EA, MCDBA
> Principal/CTO, Onsite Technology Solutions, Houston, Texas
> Microsoft MVP - Software Distribution (2005-2009)
>
> MS WSUS Website: http://www.microsoft.com/wsus
> My Websites: http://www.onsitechsolutions.com;
> http://wsusinfo.onsitechsolutions.com
> My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin
>
>

(Sorry for the double post)

I was looking at the Server 2003 machine that had the problem, it has 927891
installed installed since 6/2007 and the version of msi.dll is 3.1.4000.4042

-Scott

"Lawrence Garvin [MVP]" wrote:

> > smoore0414 wrote:
>
> >> We are seeing about 1-2% of these clients are having the issue
> >> where svchost.exe is taking 99% of the CPU after updates are approved for
> >> installation. There is no common denominator between the machines (except
> >> maybe Office 2003),
>
> And this could be the significant common factor. There was an issue with
> Office 2003 some time back. (Actually the issue was with the MSI.DLL, but it
> manifested most often in relation to Office updates.) Are all of these
> client machines fully updated for all Office 2003 applications?
>
> >> as I write this, a Server 2003 R2 machine is at 99%
> >> while it is trying to install the updates.
>
> Does this server machine have any Office components installed? If so, are
> they fully updated?
>
> Also, is there a possibility that any of these machines are still running
> one of the interim builds of the Windows Installer v3.1?
>
> Here's a KB article that starts at the beginning of this issue, and contains
> additional links that may also be relevant:
>
> http://support.microsoft.com/default.aspx/kb/916089
>
>
> --
> Lawrence Garvin, M.S., MCITP:EA, MCDBA
> Principal/CTO, Onsite Technology Solutions, Houston, Texas
> Microsoft MVP - Software Distribution (2005-2009)
>
> MS WSUS Website: http://www.microsoft.com/wsus
> My Websites: http://www.onsitechsolutions.com;
> http://wsusinfo.onsitechsolutions.com
> My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin
>
>

This problem began on Friday Night, wuaueng.dll pegs CPU Core (Patch Tuesday
updates my guess). Only resolution disable windows update service.

Thinking about it having Microsoft update automatically??? Most likely
better not getting this fixed.


"PA Bear [MS MVP]" <> wrote in message
news:...
> [[ Right pew, wrong church. Forwarded to WSUS newsgroup
> (microsoft.public.windows.server.update_services) via crosspost as a
> convenience to OP.
>
> On the web:
> http://www.microsoft.com/communities...pdate_services
>
> In your newsreader:
> news://msnews.microsoft.com/microsof...pdate_services
> ]]
>
> smoore0414 wrote:
>> We are running a distributed WSUS 3.0 environment where we have a single
>> master a about 20 subordinate WSUS server globally serving approximately
>> 3000 clients. We are running SP3 for XP clients and SP2 for all Server
>> 2003
>> R2 clients. We are seeing about 1-2% of these clients are having the
>> issue
>> where svchost.exe is taking 99% of the CPU after updates are approved for
>> installation. There is no common denominator between the machines (except
>> maybe Office 2003), as I write this, a Server 2003 R2 machine is at 99%
>> while it is trying to install the updates. Usually we see it once the
>> updates have been approved and the client is attempting to sync with the
>> WSUS server. Usually, the only thing we can do is delete the contents of
>> the
>> SoftwareDistribution folder and manually pull the updates from Windows
>> Update. We have gone through all the old 'fixes' with no success (927891,
>> WUA
>> 3.0).
>>
>> Any assistance is in determining the root cause of this is grealy
>> appreciated.
>

MULTISY in the original post stated he was having this on the security server
of EBS.

I've just installed EBS and am having the same problem on the security
server. svchost.exe runs at full cpu usage, permanantly, until I turn the
windows update service off.

I've tried a number of things to fix it, including reboots, cleaning out
SoftwareDistribution folder and running it manually, but the problem keeps
coming backl

"James" <> wrote in message
news:020E23D6-E393-4968-8945-...
> MULTISY in the original post stated he was having this on the security
> server
> of EBS.

>
> I've just installed EBS and am having the same problem on the security
> server. svchost.exe runs at full cpu usage, permanantly, until I turn the
> windows update service off.


Apparently there is an issue, just posted, that caused this on Exchange 2007
servers with automatic anti-spam updates enabled. This would include SBS2008
and EBS2008 installations with Forefront for Exchange installed.

It is, apparently a server-side issue at Microsoft.

Here's the link to the SBS blog post, and the relevant text included:

http://blogs.technet.com/sbs/archive...e-the-cpu.aspx
================================================== =========
You may notice an issue where the Windows Update (WUAUSERV) service
will be spiking one of the logical CPUs on servers running Exchange 2007
with automatic anti-spam updates turned on. This will include any SBS 2008
installation where Forefront for Exchange was installed as part of the
setup.
Please note that the service displayed will by SVCHOST, since WUASERV
runs inside SVCHOST.EXE.

This issue has now been resolved on the Windows Update backend, and
should clear itself automatically after your WSUS server’s next sync. If
you
are still experiencing the issue you can start a manual WSUS sync by:

Open the Windows SBS Console
Click the Security tab
Click the Updates sub-tab
Click the Synchronize now task
Click Ok to start synchronization
Restart the Windows Update service once synchronization finishes (optional)
================================================== =========

--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin