ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.
Intermittent High CPU usage due to ccsvchst.exe on servers with EDR and SEP
Article ID: 241141
Updated On:
Products
Endpoint Protection
Issue/Introduction
Intermittently CPU utilization will spike on servers with SEP installed and EDR enabled. Range includes between 70 to 90% utilized by ccsvchst.exe.
Cause
Too many enabled EDR events will cause CPU to spike during heavy usage times.
Resolution
Remove the following from the EDR event types:
- AntiMalware scan interface (AMSI) activity
- Process Launch activity
- Process terminate activity
Feedback
Yes
No
Powered by
