ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Intermittent High CPU usage due to ccsvchst.exe on servers with EDR and SEP

book

Article ID: 241141

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

Intermittently CPU utilization will spike on servers with SEP installed and EDR enabled. Range includes between 70 to 90% utilized by ccsvchst.exe.

Cause

Too many enabled EDR events will cause CPU to spike during heavy usage times.

Resolution

Remove the following from the EDR event types:

  • AntiMalware scan interface (AMSI) activity
  • Process Launch activity
  • Process terminate activity