Fixing High CPU Usage and Memory Leak Issue by Svchost.exe (wuauserv)

The wuauserv service is a standard Windows update service that is used to scan a computer, search, download, and install new security patches and updates from Windows Update or local WSUS servers. In some cases, the wuauserv service may not work correctly, causing excessively high CPU and RAM usage. Due to the fact that the wuauserv is running inside the container process svchost.exe, it looks for the user that the svchost process is using too much RAM and CPU resources on your Windows device. In this article, we’ll show you how to solve the problem of high memory and CPU usage by the wuauserv process in Windows 7 and Windows 10.

Wuauserv Service in Windows 7 Uses Up to 50% of CPU and Memory

Some users began to complain about poor performance issues on their computers running Windows 7. The problem manifests itself as follows: daily at one and the same time (each user at own time) the computer begins to slow down. The Task Manager shows that the process svchost.exe uses up to 1.2-2 GB of memory and up to 100% CPU of one core. As a result, it is impossible to use the computer during 30-60 minutes: it becomes terribly slow and constantly hangs.

Problems have appeared on Windows 7 SP1 x86 and x64 clients when receiving updates from the local SCCM server (used to manage Microsoft updates on clients). Run Task Manager on a client and sort the running processes by the memory or CPU usage in the Processes tab. You can see that the current process svchost.exe is using 11% CPU and 1.2 GB of memory. In fact, the svchost.exe is a container process, in which other programs and system service threads are running. Using Task Manager, you won’t be able to understand, which thread (service) causes high system load.

More detailed information about a process and its threads can be obtained using Process Explorer utility.

Run procexp.exe and find the problem process svchost.exe that uses too much memory and / or CPU.

Open its properties and go to the Threads tab. Here you can clearly see that the wuauserv (Windows Update) thread consumes the most part of the CPU and memory within the svchost.exe process (the wuauserv service scans the system and the update server for updates). Due to some code problems, the wuauserv begins to leak and consumes all available memory up to 1.5-2 GB (maximum size available for the process) and starts actively using the paging file. The system gets slow.

What’s interesting is that the problem more often appears on the clients having 2 GB of RAM. If a PC is having 4 GB of memory or higher, the problem is not so obvious to the users, because the memory leaks in wuauserv doesn’t exceed 2 GB.

If you stop wuauserv using services.msc console, the high memory and CPU load in your Windows will reduce drastically. And svchost.exe starts to use only 180-200 MB of memory.

First of all, we have tried to reset the settings of Windows Update agent following the instructions given in the article “How to Reset Windows Update Agent Configuration“. The problem was solved and has not appeared for some days, but later it has occurred again. It seems that the size of the local cache and the update database reaches some limit, and wuauserv starts using memory high (leak) again.

We have tried a lot of other methods, but only the installation of the following patches for Windows Update agent really helped:

• https://support.microsoft.com/en-us/kb/3050265 (The update of Windows Update agent from June, 2015);
• https://support.microsoft.com/en-us/kb/3065987 (The update of Windows Update agent from July, 2015);
• https://support.microsoft.com/en-us/kb/3102810 (The patch for Windows 7/ 2008 R2, which allows to solve the problem of high CPU and memory load during the installation of updates using WSUS, from November, 2015).

After the updates have been installed, the memory usage by wuauserv process has reduced to 200 MB, and the update scanning process has taken much less time.

Wuauserv: High CPU and Memory Usage on Windows 10

The problem when the Windows Update service loads the processor high and uses too much memory, also occurs in different Windows 10 builds.
Open the Task Manager and find the process svchost.exe which consumes too much memory or CPU resources. Right click on it and select “Go to Services“.

Verify that the wuauserv service is running as part of this svchost.exe process (Windows Update service). Make sure that the wuauserv (Windows Update service) is running as part of the svchost.exe process.

Since the Task Manager doesn’t allow you to determine which of the system services running inside the svchost process causes a high computer load, you need to use Process Explorer (as described above). Make sure that the high CPU and/or memory load is caused by the wuauserv service (in our example this is the C:\WINDOWS\system32\wuaueng.dll library).

Unlike the above case with a memory leak in the update service in Windows 7,  there is no universal patch that fixes the problem for Windows 10. Below we list the basic steps that you should take to reduce the memory and CPU usage by the Windows Update service.

Wait for Windows Updates to Install

If the Windows Update service is currently scanning your computer or installing updates, then a high load of the computer should not surprise you. Try to wait (1-2 hours depending on the performance of the computer) and wait until wuauserv finishes downloading and installing updates.

Run the Windows Update Troubleshooter

Try to diagnose Windows Update Service 10 with the integrated Window Update Troubleshooter. Go to the Settings -> Update and Security -> Troubleshoot. Select item Windows Update (Resolve problems that prevent you from updating Windows) -> Run the troubleshooter.

The utility will check the status of the service and try to fix the problems found.

Clear the SoftwareDistribution and catroot2 folders

Try to reset the SoftwareDistribution and catroot2 folders.

• The C:\Windows\SoftwareDistribution folder stores temporary Windows Update service files and downloaded update files;
• The %windir%\System32\catroot2 folder contains the signatures of the update packages.

Let’s try to clean them with the following script (save the code into a text file with the * .bat extension and run it as administrator):

attrib -h -r -s %windir%\system32\catroot2
attrib -h -r -s %windir%\system32\catroot2\*.*
net stop wuauserv
net stop CryptSvc
net stop BITS
ren %windir%\system32\catroot2 catroot2.old
ren %windir%\SoftwareDistribution SoftwareDistribution.old
ren "%ALLUSERSPROFILE%\application data\Microsoft\Network\downloader" downloader.old
net Start BITS
net start CryptSvc
net start wuauserv

Check and Repair Windows System Files and Component Store

Check and repair the system files of your Windows image with the following commands:

sfc /scannow
and
DISM /Online /Cleanup-Image /RestoreHealth

Check your computer for viruses

Check your Windows for viruses in offline mode using a rescue disk (Kaspersky Rescue Disk or Avira Rescue System).

Update your Windows 10

1. Update your version of Windows 10 by installing the current build;
2. Manually download and install from Microsoft Update Catalog (https://www.catalog.update.microsoft.com/Home.aspx) the last cumulative updates for your Windows version (Microsoft fixes bugs and various Windows errors every month and adds fixes to the cumulative update package).

Turn off Windows Update Delivery Optimization

Go to the Settings -> Updates and Security-> Windows Update -> Advanced Options -> Delivery Optimization. Disable the option “Allow downloads from other PCs” and reboot your device.

Uninstall the latest Widows updates

If the problem with high CPU and memory utilization by the wuauserv service occurred immediately after the installation of new Windows updates, try to uninstall this updates one by one (Control Panel -> Programs and Features -> View Installed Updates). Sort the updates by installation date, right click on the update, and select Uninstall.

Disable Windows Update Service

I never recommend you to disable the Windows Update service, since you will stop receiving security updates and expose your computer to the risk of hacking or infection. Disabling the update service can be used as a temporary step, when other ways to restore the normal operation of the system won’t help.

Open the Services management console (services.msc), find the Windows Update service, stop it and change the startup type to Disabled. Save the changes and restart the computer.

On the second Tuesday of the following month, be sure to manually download and install new cumulative updates for your Windows 10 build. Enable the wuauserv service. Perhaps your problem will be fixed in the new updates.