it seems that on many servers (w2k8 and w2k12) in our environment suddenly svchost hosting Dhcp, EventLog, lmhosts, Wcmsvc services started to use 1 CPU core by 100%. Sometimes it is also WmiPrvSe. It all seems to have started on Saturday 7pm (CET) synchronously. I did not see any special event in eventlog by that time. What the heck can it be? Please advice where to look and what to investigate. Servers are mainly virtual and I can see clearly in vSphere CPU graph when the load started.
No idea if this will work for you, this is something of a shot in the dark. I had a similar issue once - it was caused by wmiprvse service going nuts, and as I recall we solved it by moving WMIprvse to its own process:
`sc config WMIprvse type= own`
Note space after '='. See Microsoft kb490995. We never got to the root cause.