Intermittent High CPU usage due to ccsvchst.exe on servers with EDR and SEP

Products

• Endpoint Protection

Issue/Introduction

Intermittently CPU utilization will spike on servers with SEP installed and EDR enabled. Range includes between 70 to 90% utilized by ccsvchst.exe.

Cause

Too many enabled EDR events will cause CPU to spike during heavy usage times.

Resolution

Remove the following from the EDR event types:

• AntiMalware scan interface (AMSI) activity
• Process Launch activity
• Process terminate activity