High CPU usage on Endpoint Protection client when processing a policy update.

book

Article ID: 169548

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

During policy updates, the ccSvcHst.exe process on clients running Symantec Endpoint Protection (SEP)  can be observed using high CPU on a single core. This CPU usage may last for several minutes. On systems with a single core, this may lead to the system becoming unstable or unresponsive for an indefinite period of time.

No error message will be displayed. ccSvcHst.exe will show using a high amount of CPU usage in Windows task manager for several minutes.

Cause

This issue can be caused when the client processes an exceptions policy that has an excessive number of entries (over 1000).

Resolution

Symantec does not recommend deploying exceptions policies with more than 1000 entries. Additional details on exception limitations can be found here: https://support.symantec.com/en_US/article.TECH237241.html