Norton 360 Deluxe appears to trigger repeated Base Filtering Engine (BFE) / Windows Filtering Platform activity, causing recurring CPU spikes and severe battery drain on my Windows 11 ThinkPad

[gokalpkursad_gungor]

Detailed description:
I was investigating unusually poor battery life on a Lenovo ThinkPad T14s Gen 2 running Windows 11 with Norton 360 Deluxe fully updated.

During light use, LocalServiceNoNetworkFirewall repeatedly caused CPU usage to jump by roughly 10–15% every few seconds. I checked the service details and confirmed the activity was in the BFE / Windows Filtering Platform service host.

I then captured the issue using Windows Performance Recorder / Windows Performance Analyzer. During the high-CPU periods, the dominant call path included:

rpcrt4.dll!RPC_INTERFACE::DispatchToStubWorker
→ BFE.DLL!BfeRpcTransactionCommit
→ BFE.DLL!BfeTxnCommit
→ BFE.DLL!BfeTxnCoordinatorCommit
→ BFE.DLL!BfeObjectMgrCommitPhaseOne

The pattern repeated every few seconds.

I uninstalled Norton 360 Deluxe and rebooted. Immediately afterward, the recurring BFE CPU spikes disappeared and have not returned.

The laptop also became noticeably cooler and battery drain improved dramatically under comparable use. With Norton installed, a discharge test went from 100% to 31% in about 3 hours 22 minutes, despite using only about 30% display brightness. After removing Norton, battery drain was substantially slower while using about 50% brightness and the same kind of light workload.

netsh wfp show state also showed numerous Norton / Norton LifeLock / NLOK WFP providers, filters and callouts. I also saw Avast-labelled WFP components even though I have never installed Avast separately, which may be related to the current Norton/Gen networking stack.

I have retained the WPR/WPA .etl trace and WFP state data and can provide them privately to Norton engineering if useful.

Has anyone else seen similar LocalServiceNoNetworkFirewall / BFE CPU activity with current Norton 360 builds?

[SoulAsylum]

@gokalpkursad_gungor

Windows Filtering Platform service host

@gokalpkursad_gungor Here is what I have found regarding bfe.dll and its functionality. Please post your progress so we may follow-up!!

AI Overview

The Windows Filtering Platform (WFP) service host runs the Base Filtering Engine (BFE) inside a standard svchost.exe process to manage and filter network traffic. [1, 2]

What Is It?

• Core Function: It is a system service framework built into Windows that handles network packet processing, firewalls, and IPsec configurations. [1, 2]

• Service Host (svchost.exe): The user-mode manager for WFP is the Base Filtering Engine (bfe.dll), which runs safely inside a shared service host process. [1]

• Not a Firewall: WFP itself is an underlying platform and API, but tools like Windows Defender Firewall rely completely on it to block or permit network connections. [1]

Why Is It Running?

• Network Security: It processes every inbound and outbound network packet to keep your computer safe from unauthorized access.

• Third-Party Apps: Antivirus programs, VPNs, and monitoring tools hook into WFP to inspect or control web traffic.

• Essential System Operation: Windows requires this service active for normal internet and local network connectivity

My questions and suggestions are:
1- Do you have entries within your Windows host file that are from GenDigital? If so remove them and reboot. These are redirects Norton is using for protections that should already work without them.

2- Do you see the files listed in the screenshot below? If so, also remove them and reboot. These are also machine learning additions that are NOT needed. They are for machine training.

Regards,
SA