Constant CPU and Memory spikes from windows processes

Start by identifying which of those Windows processes is actually driving the spikes, because System, Service Host, and Antimalware Service Executable are umbrella processes and the fix depends on which one is responsible.

1. In Task Manager:
   • Open Task Manager and sort by CPU on the Processes tab.
   • If needed, go to Details and add the PID column.
   • If Service Host or WMI Provider Host (WmiPrvse.exe) is involved, note the PID.
2. In Resource Monitor:
   • Open Start > type resmon > open Resource Monitor.
   • Go to the CPU tab.
   • Sort by Average CPU and watch which process stays at the top during a spike.
3. If System is the main offender, use Process Explorer:
   • Run Process Explorer as administrator.
   • Right-click System > Properties > Threads.
   • Select the high-CPU thread and choose Stack to see what functions are running.
   • For better stack results, configure symbols in Process Explorer by installing Debugging Tools for Windows, then in Process Explorer go to Options > Configure Symbols, and set Dbghelp.dll to C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll.
4. If Antimalware Service Executable (MsMpEng.exe) is one of the top consumers:
   • Check whether Microsoft Defender Antivirus real-time protection is the source of the high CPU usage.
   • Review other software on the machine as a possible cause first.
   • If needed, use the Microsoft Defender Antivirus Performance Analyzer first, then Process Monitor, and finally Windows Performance Recorder (WPRUI or WPR command-line) if the analyzer does not identify the root cause.
5. If Service Host (svchost.exe) is the main source:
   • This often means one hosted service is causing the spike.
   • Open an elevated Command Prompt.
   • Break the suspected service out into its own svchost process:

          sc config <service name> type= own
     

   • Restart the service.
   • Run:

          tasklist /svc
     

     to verify it is running in its own svchost process.
   • Then monitor CPU again to identify the exact service.
   • Important: after testing, revert it:

          sc config <service name> type= share
     

     then restart the service.
6. If WmiPrvse.exe or Winmgmt appears in the spikes:
   • In Task Manager > Details, identify the PID for WmiPrvse.exe.
   • Or in Task Manager > Services, locate Winmgmt, note the PID, and use Go to details.
   • Then open Perfmon from an elevated command prompt.
   • In Performance Monitor, add Process > ID Process for all WmiPrvse# instances.
   • Then add Process > %Processor Time for the WmiPrvse# instance matching the PID consuming CPU.
   • This isolates the exact WMI instance involved.
7. If the spikes are hard to catch, collect traces while the issue is happening:
   • Collect a Performance Monitor log with a 1-second to 5-second interval.
   • Collect a Windows Performance Recorder (WPR) log during the spike.
   • Do not let the WPR log run for long because the file grows quickly; a few minutes is enough.
   • For a singular Microsoft process, run ProcDump twice during high CPU, spaced several minutes apart.

One higher-risk case is DCOM-related svchost.exe CPU usage on virtual machines. That guidance involves deleting specific registry values and carries a serious warning that incorrect registry changes can require reinstalling Windows. That should only be considered if the issue is specifically narrowed to that scenario.

Based on the processes listed, the most likely next step is to narrow it down in this order: MsMpEng.exe, then svchost.exe service isolation, then System thread stack analysis with Process Explorer.

References:

• High CPU usage troubleshooting guidance
• Troubleshoot performance issues related to real-time protection
• Troubleshoot WMI high CPU usage issues
• Troubleshoot Microsoft Defender Antivirus performance issues with Process Monitor
• Troubleshooting issues with system resources