Intermittent High CPU usage due to ccsvchst.exe on servers with EDR and SEP
book
Article ID: 241141
calendar_today
Updated On:
Products
Endpoint Protection
Issue/Introduction
Intermittently CPU utilization will spike on servers with SEP installed and EDR enabled. Range includes between 70 to 90% utilized by ccsvchst.exe.
Cause
Too many enabled EDR events will cause CPU to spike during heavy usage times.
Resolution
Remove the following from the EDR event types:
- AntiMalware scan interface (AMSI) activity
- Process Launch activity
- Process terminate activity
Feedback
thumb_up
Yes
thumb_down
No