Windows: "Service host: Local system" runs with high CPU/disk load after boot since update

[German]German blog reader Willi B. contacted me by mail the days because he ran into a problem under Windows 8.1. Since one of the last updates he has the problem that the service "Service Host: Local System" runs with high load after boot since for some time. The problem repeats itself with the August 2022 update. The problem has been running through Windows for years.

The error description

German blog  reader Willi B. is still running a system with Windows 8.1 Pro version 6.3 build 9600, but is already running mostly Linux. During the July 2022 update for Windows 8.1, he encountered the following problem for the first time:

Hi Günter,

after last month's Windows updates, the "Service Host: Local System" was running crazy with high load and intense disk accesses (for about 5 minutes after logging in) and the fan was cooling at high speed, I restored a backup. Then the PC ran normally again. I left out the July updates, because I usually work offline under Windows.

Just installed the current August updates and the "Service Host: Local System" goes crazy again after a boot (see snapshot). This happens after every boot after login. After about 5 minutes everything is back to normal.

I have a Windows 8.1 Pro 32 bit version 6.3 build 9600.

The hardware is a Fujitsu Q5030 with Intel Core 2 Duo P8600 with 4 GB RAM.

Work 90% of the time on Linux, but haven't found any alternatives for Linux for 2 applications.

Windows 10 is not an option, Windows 11 impossible.

Maybe you or someone in your blog have a tip.

With kind regards

Willy

If you search the Internet for the term "service host: local system with high load" or for high disk I/O load, you will encounter many posts in forums and blogs.

"Service host: Local system" with high load

The user post here from Nov. 2020 deals with this isse.

service Host: Local system taking up to much cpu

My task manager tells me that my service Host: Local system running on high CPU with barely enough to do anything else

After ab update install, such scenarios can be an indication that either an update process has not yet been completed and is constantly running after Windows starts.

Generally, svchost.exe is responsible for various tasks and system processes that run under its supervision. I described some approaches to how to do this for Windows 7 a few years ago in the German blog post Windows: svchost.exe braucht viel Arbeitsspeicher/CPU. The problem is that the specific hints about fix updates or any tools are not applicable for newer Windows versions – you have to go through the following hints and implement them if necessary.

Tip: You can launch the Windows task manager and show the command line options (right click on an entry and select the context menu entry Command line). Then you see details, which task or system process is behind the  high CPU load.

Also note the hints given within my blog post Windows 10/11: Systems required 2-6 hours of update connectivity for successful updates and let your systems run for at least 5 hours, untill you try to evaluate the reason for high CPU load.

One approach to find out where things are stuck is to start Windows in clean boot mode without Microsoft services. Microsoft has described how to use msconfig to diagnose system problems in the article How to perform a clean boot in Windows. With the appropriate settings, problematic programs, services and drivers can be identified and uninstalled if necessary. If the problem is gone in Safe Mode, it is due to a Microsoft service, and you can try the following approaches.

Possible solutions to fix the problem

The problem can have different causes. Therefore, there is no "one solution", but you should follow different approaches step by step to fix the cause of the error.

Fix #1: Check system for damage

The first thing to do is to check for corrupted system files using the sfc /scannow and dism tools. I have described the relevant steps in the blog post Check and repair Windows system files and component store.

Fix #2: Disable Windows Update service

In the current case, it seems to be related to Windows Updates. You could disable the Windows Update service as administrator in services.msc for test purposes. If the load on the system decreases, this indicates that update processes are running or that the update store is broken.

Then it would be worth trying to install the update manually and give the system the opportunity to complete the update. Whether the update went through or failed can be checked in the update history (via the Control Panel or the Settings page from Windows 10).

Fix #3: Reset Windows Update automatically

In case of problems, there is also the possibility to reset Windows Update completely. There is an open source tool WUReset.exe, which can be downloaded from this website (at your own risk). Then open an administrative command prompt via Run as administrator and launch the tool.

The program, according to the website's description, is capable of deleting temporary files, scanning the Windows system image, detecting and repairing corruption, scanning all protected system files and replacing corrupted ones, changing invalid values in the Windows registry, resetting Winsock settings and much more.

Fix #4: Reset Windows Update manually

To do this, open an administrative command prompt via Run as administrator. Then execute the following commands:

net stop wuauserv
rd /s /q %systemroot%\SoftwareDistribution
net start wuauserv

Furthermore, the qmgr*.dat files can be deleted – these are used by the BITS service to store the downloaded update part files. To do this, execute the following commands:

net stop bits
net stop wuauserv
net stop cryptsvc
Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

Then, if not already done, execute the following commands in the command prompt to reset the Update Component Store (CSB).

Ren %Systemroot%\SoftwareDistribution\DataStore DataStore.bak
Ren %Systemroot%\SoftwareDistribution\Download Download.bak
Ren %Systemroot%\System32\catroot2 catroot2.bak

Windows should then be restarted. This will restart the services and recreate the Update Component Store (CSB). There are other steps such as resetting permissions for services, etc. that Microsoft describes in the post Windows Update – additional resources.

Additional resources

EI guess there are some cases where a registry entry (Ndu key in ControlSet001) is adjusted. NDU (stands for Windows Network Data Usage Monitoring Driver) is a Windows component (driver), and the adjustment described in the forum post here by SidneySnell and here is supposed to improve the performance. The background is probably that there was once a memory leak in NDU in Windows 8. But that should be the last variant to try.

If all measures don't help, and components like virus scanners or other third-party system tools can be ruled out as the cause, the only option is to reset or reboot Windows.