Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my ESX box, I have a Windows XP low resource machine that I use to host a few scripts and management tools for my (virtual) servers.

Whenever my box is idle for 20-30 minutes, without fail, the CPU and IO usage go to almost 100%. The moment I move the mouse, the usage drops very quick. Within about 5 seconds, it is just a regular VM acting how it should.

After this, it is like nothing has happened and it is very fast again.

I have read the other answers here which haven't helped, and I found the VMWare Guide which did not help either - the Virtual Machine is set up correctly (as far as I can see) - ACPI Uniprocessor etc. and Windows XP as the template.

I was wondering if anyone knows what is going on? Also, the thing that confused me the most was that I left Process Explorer running and managed to track it down to a svchost.exe process - unfortunately it was the large one that hosts a huge chunk of services.

I would of expected it to be the Idle process that would be taking the cycles, or the guest to show nothing and just busy on the ESX box... So this problem has stumped me.

Anyway, I read the good answer here, and if no one knows what is happening, I will try to implement it (the reason I haven't is that I don't really want to restart this machine - it is doing critical tasks at the moment). This server is a vanilla XP Pro SP3 install + VMWare Tools + Filezilla + A few management scripts (which I wrote and work fine if the PC is not left to idle).

enter image description here

enter image description here This is an example of the machine running at 100%, I then move the mouse and disconnect console - you can see, it takes just over 20 minutes, then, it goes back to 100% CPU and IO.

Does anyone know what is happening?

share|improve this question
are the guest tools installed? check and see that its using the right drivers, what kind of vmnic are you emulating? check the mouse and video drivers, specifically – SpacemanSpiff Oct 18 '11 at 4:53
@SpacemanSpiff Tools installed, Nic is "Flexible" (driver "VMware Accelerated AMD PCNet Adapter), Video card is set to 4MB memory, (driver VMware SVGA II) Keyboard (driver) is "standard 101/102 Microsoft...". – William Hilsum Oct 18 '11 at 4:59
How do the power saving settings look? Is it maybe starting a resource-intensive screen saver? – Shane Madden Oct 18 '11 at 5:00
@ShaneMadden Screensaver is just "Windows XP" ... The basic flag one! I haven't changed any power settings from the default options. Currently set at Scheme - "Home/Office Desk", Monitor off in 20 mins, hard disk/standby - never. Can't see anything else relevant. – William Hilsum Oct 18 '11 at 5:10
@Labradort - I am certain there is no Malware, I really want Windows XP as I just need a lightweight OS for running a few scripts, why would I want to run Windows 7 on this? In fact, if I found my ISO, I would have installed Windows 2000 (which I have used before for this sort of task)... Just because something is dated, doesn't mean it is useless, and yes, I am expecting solid performance. – William Hilsum Nov 3 '11 at 18:43

Have you totally disabled all power management? Have you disabled hybernation? Have you disabled the screensaver?

share|improve this answer
Hibernate was never turned on (checked, default is off). As for screensaver, it is active, but just the default flag/Windows XP screensaver. I have the counterpart screensaver (Windows 2008 Logo) running on my other VMS without problems. The screensaver can be active without seeing the problem (tested)... It appears that the problems starts between 20-30 minutes after the last time I touched the machine. – William Hilsum Oct 18 '11 at 5:27
... After Googling, other people have also suggested the Screensaver - I have since disabled this, but, I am still getting the same problem. – William Hilsum Oct 30 '11 at 6:55
Now that the screen saver is disabled, can you leave process explorer up and sorted by CPU and see what's jumping to the top of the list? – mrdenny Oct 31 '11 at 18:56
I just confirmed what I thought in my original question - it is the big svchost process - - I think I am going to have to separate the processes to examine further... although, I am going to pause this machine and set up a new VM tomorrow to see if I can recreate the issue. – William Hilsum Oct 31 '11 at 19:20
Try disabling the "Security Center" service. It's what runs the Windows Security Center which is what the apps under svchost are. – mrdenny Oct 31 '11 at 19:24

I think you can use Process Explorer (From SysInternals) to try and drill down to which service is hammering the CPU.

share|improve this answer
I have already done this (the first picture) and tracked it down to the large process that hosts a load... I am going to go further down this route and try to split up the services when I have a bit more time. – William Hilsum Oct 31 '11 at 12:21
D'oh - sorry, completely missed that! But yeah, I'd stick with that route and keep persevering. Trial and error gets a bit old. You could try stopping as many services as you can, though. You might need to bite the bullet and reboot though. – Dan Oct 31 '11 at 12:41

Looks like a .NET recompile after doing SP3/windowsupdates etc. (see IOstats)

share|improve this answer
I don't believe this machine even has .Net installed on it yet... certainly on the cards. – William Hilsum Oct 31 '11 at 12:22
However, the load should be gone after some minutes/hours (depending on cpu/ram/hdd). Whats the current status? – CyberOptic Nov 1 '11 at 12:58
This has been going on for weeks, and as I said, .Net isn't installed - it is just a default Windows XP install, no updates, no nothing! – William Hilsum Nov 1 '11 at 13:21
Weird. I would suggest to have a look at the IO with filemon or similar. – CyberOptic Nov 8 '11 at 8:59

I've never tried this, but is it possible to hot-clone the desktop and remove / disable / point to nowhere its network cards? You can then leave this box doing its critical stuff and then do as much troubleshooting as you like on the dummy system.

share|improve this answer

I've seen similar behavior on non-virtual XP workstations. The behavior is the same as you describe: High CPU, high disk activity, and it stops almost immediately as soon as I touch the keyboard or move the mouse.

This may be Windows updating its prefetch cache. It normally runs in the background after a period of inactivity. There's a nice description here; scroll down to the "Prefetch" section. The last paragraph in the section states that the system will periodically fire up the defrag utility to try to move all of the prefetch files into a single contiguous area. It should normally only last for a couple minutes, but if you're in the habit of clearing our XP's prefetch directory (which you shouldn't), it would have more work to do to rebuild it. It's not clear to me whether the defrag part of this process can be disabled. TweakUI has an option to disable background disk optimization, but it's vague on exactly what it does.

If that isn't it, another possibility is be the Windows Indexing Service, which is on by default. It can be disabled with little impact if you don't use the Windows built-in search much. Since it's indexing your (virtual) disk, it will definitely cause disk I/O to spike, and CPU usually rises as well.

share|improve this answer
Windows Update are set to manual... unless it still does something in the background (will try to explore more tomorrow), as for Indexing service, it is off by default on XP. – William Hilsum Nov 2 '11 at 1:02

See if you have the Windows Indexing Service running. It may be that during idle periods, the indexer is indexing your drives, and that is what is gobbling your cpu resources.

In My Computer, right click on each hard disk in turn, and choose "Properties".

Un-check the "Allow Indexing ..." check box at the bottom of the Properties window.

See if your performance increases.

share|improve this answer
Indexing service is not on by default in Windows XP, and, I have confirmed it is off. – William Hilsum Nov 4 '11 at 19:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.