• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

Windows Firewall CPU

I'm getting 30-40% CPU usage from the Windows Firewall and Service Host: Internet sharing processes. If I disable the Windows Firewall service and then stop it - then re-start it, CPU usage from these processes drops to zero. I believe Windows Firewall is controlled by my NIS 22.11.0.41and, hence, consider this may be a NIS problem. I'm using Windows 10 Pro V1703.

Anyone know of a solution to this?

Thanks...Andrew

Replies

Kudos0

Re: Windows Firewall CPU

Just upgraded to the latest NIS 22.11.2.7 - no change.

Kudos0

Re: Windows Firewall CPU

Sorry, of course I'm using NS 22.11.2.7 not NIS.

Andrew

Kudos0

Re: Windows Firewall CPU

Hello was and welcome to the forums. Windows firewall must be enabled for Windows updates to function properly on Windows 10. Your issue could in fact be from having "fast boot" enabled on your system. Disable it and reboot then recheck for your issue. Here is how to disable it in case you don't know how:

https://community.norton.com/en/forums/windows-881-or-10-and-fast-start-feature-0

Cheers

Retired military (Navy 1980-2002) AO1 (AW) Aviation Warfare Specialist "From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Professional x 64 version 1809 / build 17763.437 / NCSP 22.17.0.183 / Norton Core v.282 on Android 1.93
Kudos0

Re: Windows Firewall CPU

Thanks. Tried that, but the high CPU usage from the Windows Firewall process is still there. In fact the 'Fast Start' option isn't available from Control Panel>Power Options on my PC as per the url. I used the Turn_Off_Fast_Startup.bat option but it didn't have any effect.

Andrew

Kudos0

Re: Windows Firewall CPU

In fact, if I just select 'Stop' in the Windows Firewall Service Host process in Task Manager>Processes, the CPU usage drops to normal. If I look at Windows Firewall in Services (Open Services in the Service Host process), I see that the process is still running. Not sure why.

Kudos0

Re: Windows Firewall CPU

If you have disabled Hibernate function, the Fast Startup is disabled. And you will not see the option in Control panel.

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: Windows Firewall CPU

You  MAY have malware resident on your system, per this MS article on the subject. Additionally, if you have more than one antivirus program running on your system that can cause these issues as well.

https://social.technet.microsoft.com/Forums/windows/en-US/9fbd5b1d-a2a3-48ce-9232-7542a40b937c/service-host-svchostexe-using-99-cpu?forum=w8itproperf

Download Malwarebytes and run a full system scan, lets see if you have a PUP program running in the background. Its FREE and totally compatible with Norton: https://www.malwarebytes.com/

Cheers

Retired military (Navy 1980-2002) AO1 (AW) Aviation Warfare Specialist "From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Professional x 64 version 1809 / build 17763.437 / NCSP 22.17.0.183 / Norton Core v.282 on Android 1.93
Kudos0

Re: Windows Firewall CPU

Thanks. Ran Malwarebytes and quarantined a few pup programs. However, that made no difference to the high CPU usage. The only way to stop the high CPU usage is to Stop the Windows Firewall process in Task Manager. Any other ideas?

Andrew

Kudos0

Re: Windows Firewall CPU

Further investigations: Process Explorer says it's a System Idle process and Ntoskml.exe|KeSynchronizeExecution is the culprit on the 4 threads. Not sure if that gives any further clues? Clearly the Firewall is working hard for some reason. And it doesn't do so on my W10 laptop with NS.

Andrew

Kudos0

Re: Windows Firewall CPU

System Idle Process shows CPU resources not being used.  The higher the percentage, the less work your CPU is doing.

Kudos0

Re: Windows Firewall CPU

Ok, but as the value was ~60%, it means that 40% or more was being used. As I said, the only way I can get usage (in Task Manager) to normal - 5% - 10% - is by stopping the  Windows Firewall process. I cannot find out what is causing this.

Andrew

Kudos0

Re: Windows Firewall CPU

was are you on Windows 7? Windows 10 doesn't allow windows firewall to be disabled. I use a nifty set of tool named SysInternals, specifically process explorer to check for running processes that are using background bandwidth. Its recommended by Microsoft on TechNet and totally free. Here is the link. Just unzip the package to a destination of your choice then click on the process explorer applicable to your OS. 32 bit or 64. It will list all the running processes on the system at that time. You can use this to identify what program or process is the culprit. https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Cheers

Retired military (Navy 1980-2002) AO1 (AW) Aviation Warfare Specialist "From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Professional x 64 version 1809 / build 17763.437 / NCSP 22.17.0.183 / Norton Core v.282 on Android 1.93
Kudos0

Re: Windows Firewall CPU

Thanks. I ran procexp64.exe and, as reported in Task Manager, Windows Firewall is the culprit. However, how do I find out why this process is generating high cpu usage?

Kudos0

Re: Windows Firewall CPU

Hello again. How does your outbound traffic bandwidth look? Try running TCPview from the sysinternals suite and look for any suspicious processes running. Kill those processes you find that are not legit with a right mouse click and selecting process properties. Let us know if you have a question about anything you may find and want an answer before terminating those processes.

Cheers

Retired military (Navy 1980-2002) AO1 (AW) Aviation Warfare Specialist "From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Professional x 64 version 1809 / build 17763.437 / NCSP 22.17.0.183 / Norton Core v.282 on Android 1.93
Kudos1 Stats

Re: Windows Firewall CPU

It looks like this is a problem that has been reported as an issue with the Windows 10 Fall Creators update, possibly related to Hyper-V.  There is a topic on the Microsoft forums that offers some suggested ways to fix this:

https://answers.microsoft.com/en-us/windows/forum/windows_10-other_setti...

Kudos0

Re: Windows Firewall CPU

Here is some information on ntoskrnl.exe and high cpu/memory usage. https://appuals.com/high-cpu-or-disk-usage-by-ntoskrnl-exe-on-windows-10/

Read through the whole page. I would suggest you do not download the Reimage Plus software. 

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: Windows Firewall CPU

Thanks, that seems to be the problem. I think I may have fixed it by Settings>Update & Security>Windows Defender>Turn On Windows Defender Antivirus>Firewall and Network Protection>Restore Firewalls to Default. That appears to fix the problem.

Thanks to everyone who assisted in resolving this issue.

Andrew

Kudos0

Re: Windows Firewall CPU

Good to hear the fix suggested in the Microsoft thread seems to have worked for you!

This thread is closed from further comment. Please visit the forum to start a new thread.