Fall update v.1709 creates problems: CPU usage and Desktop wallpaper

Macrom said:

Really uninstall Hyper-V isn't a solution it's a workaround for high cpu usage. I think Hyper-V and most Vpn clients uses ICS to share Network connections with guest and for internal switch and this is because ICS auto starts if they are present

Yeah, the bug I logged should really be "Base Filter Engine causes high CPU use..." since that seems to be the root cause. Can't change the title at this point, though.

Found another thread on this subject at superuser.com.

asampal said:

Found another thread on this subject at superuser.com.

Thank you for sharing. Looking forward both threads

Macrom said:

Thank you for sharing. Looking forward both threads

There is also a thread over at Microsoft answers, however no solution has emerged up to now.
Fall Creators Update Resulting in High CPU Use By Service Host - Microsoft Community

Did anybody try the firewall cycling I mentioned earlier? (which solved the very same issue for me).

AlexNik said:

Did anybody try the firewall cycling I mentioned earlier? (which solved the very same issue for me).

As I mentioned, my work system (with the problem) is using Kaspersky's firewall. I did try to pause/start protection with its control panel, but it didn't help.

Hi! This is fefrei from the SuperUser question.
I just wanted to report that I am also using Hyper-V. Uninstalling that did not help, however. What did provide relief was disabling the Internet Connection Sharing service. It magically changed to Manual (Trigger Start) but didn't try to start, and this calmed down the Windows Defender Firewall service. (As I wrote in the SuperUser question, for my system, there is a definite connection between the starting ICS service and the firewall, via repeating RPC calls.)

fefrei said:

Hi! This is fefrei from the SuperUser question.
I just wanted to report that I am also using Hyper-V. Uninstalling that did not help, however. What did provide relief was disabling the Internet Connection Sharing service. It magically changed to Manual (Trigger Start) but didn't try to start, and this calmed down the Windows Defender Firewall service. (As I wrote in the SuperUser question, for my system, there is a definite connection between the starting ICS service and the firewall, via repeating RPC calls.)

Disabling ICS is not really an option for many because it will be indirectly needed for things such as Docker (depends on Hyper-V, which depends on ICS), and likely other tools. By turning this off, you won't know in the future why something that seems unrelated fails to work.

asampal said:

As I mentioned, my work system (with the problem) is using Kaspersky's firewall. I did try to pause/start protection with its control panel, but it didn't help.

I was referring to the Windows Defender Firewall, however, due to past lessons learned, I believe it is questionable if a 3rd party security application is yet fully compatible with Fall Creators Update (I have experience with Symantec Enterprise products in the recent past), or, due to a misconfiguration during the upgrade, Windows Defender Firewall is together with Kaspersky controlling network access in your system. If you are willing to try, please uninstall Kapersky Firewall and cycle/reset Windows Defender Firewall.

My configuration is a laptop, with Hyper-V installed with three machines and three networks - networks now deleted for the sake of testing.

Further research shows that after pressing Restore, I triggered a series of 2032 (screenshot below), 2010, 2004, 2005 and 2006 events in event viewer, which included automatic reconfiguration of application rules for both inbound and outbound traffic. In the series of events, ICS had the leading role. The firewall can be also reset by pressing "Restore Default policy" in Windows Defender Firewall And Advanced security application.



For reference, below is a list of inbound and outbound rules related to ICS configured in my system.

I don't think this is related to security software, unfortunately. I've been running ESET NOD32 AntiVirus (which has no firewall component on its own) together with the Windows Defender Firewall. Uninstalling NOD32 had no effect on this issue. (I did not try resetting the firewall rules.)