Windows Server 2025 CPU Spikes to 100% Caused by Antivirus Real-Time Scanning — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Windows Server 2025 exhibits windows server 2025 cpu spikes to 100% caused by antivirus real-time scanning, causing degraded system or application performance. Performance Monitor (perfmon.exe) and Task Manager show elevated resource utilization for the affected component. Users and applications experience response time increases, timeouts, or failures. The problem may appear under specific load patterns or continuously. Without intervention it typically worsens over time as the underlying cause persists.

Environment & Reproduction

Reproducible on Windows Server 2025 under moderate to high load. The trigger is typically a workload pattern that exposes the configuration or software issue described in the root cause section.

# Monitor performance counter
Get-Counter 'Processor(_Total)% Processor Time' -SampleInterval 5 -MaxSamples 12
Get-Counter 'MemoryAvailable MBytes'
Get-Counter 'PhysicalDisk(_Total)% Disk Time'
Get-Counter 'Network Interface(*)Bytes Total/sec'

Root Cause Analysis

The root cause for this cpu-high-related performance issue on Windows Server 2025 involves either a misconfiguration, a resource leak, or a software component consuming more resources than expected. The Windows performance counters and ETW (Event Tracing for Windows) traces provide definitive evidence of the cause.

Quick Triage

Quick performance check to confirm the affected component.

# Fast triage
Get-Process | Sort-Object CPU -Descending | Select -First 10 Name,CPU,WorkingSet
Get-Counter 'Processor(_Total)% Processor Time'
Get-Counter 'MemoryPages/sec'
Get-NetAdapterStatistics | Select Name,ReceivedBytes,SentBytes

Step-by-Step Diagnosis

Use Performance Monitor and Process Explorer to identify the specific process and code path causing the resource usage.

# Detailed profiling
(Get-Counter -ListSet Process).Paths | Select-String 'cpu'
Get-Process | Sort WorkingSet -Descending | Select -First 5
xperf -on PROC_THREAD+LOADER+PROFILE -stackwalk Profile -BufferSize 512 -MinBuffers 10 -MaxBuffers 64

Solution — Primary Fix

The primary fix for this cpu-high performance issue involves configuration changes to the identified component or process.

# Fix for cpu-high
# Adjust antivirus exclusions for server workloads
Add-MpPreference -ExclusionPath 'C:inetpub','C:SQL','C:WindowsTemp'
# Or for non-paged pool:
Get-NlsData
# Or RSS:
Enable-NetAdapterRss -Name 'Ethernet'
Set-NetAdapterRss -Name 'Ethernet' -NumberOfReceiveQueues 8

Solution — Alternative Approaches

Alternatives include tuning at the hypervisor layer, upgrading hardware resources, or adjusting application-level configuration.

# Alt: Windows performance power plan
Powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c  # High performance
# Alt: Adjust processor scheduling
Set-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetControlPriorityControl' -Name Win32PrioritySeparation -Value 38

Verification & Acceptance Criteria

Performance counters return to baseline levels. Application response times recover. No performance alerts fired for 1 hour post-fix.

# Verify
Get-Counter 'Processor(_Total)% Processor Time' -SampleInterval 5 -MaxSamples 6
Get-NetAdapterRss -Name 'Ethernet'

Rollback Plan

Revert configuration changes if performance degrades further or if the fix causes instability.

# Rollback
Remove-MpPreference -ExclusionPath 'C:SQL' -ErrorAction SilentlyContinue
Set-NetAdapterRss -Name 'Ethernet' -Enabled $false

Prevention & Hardening

Establish performance baselines using perfmon data collector sets. Alert on sustained cpu-high utilization above threshold for more than 5 minutes.

# Baseline data collector
logman create counter PerfBaseline -c 'Processor(_Total)% Processor Time' 'MemoryAvailable MBytes' -si 60 -o C:PerfLogsbaseline.blg -b 01/01/2026 -e 12/31/2026 -f bincirc -max 100
logman start PerfBaseline

Related Errors & Cross-Refs

Related to other cpu-high performance issues: thermal throttling on physical servers (WHEA errors), VM balloon driver inflation on Hyper-V guests, storage latency correlation with I/O thread pool saturation.

Related tutorial: View the step-by-step tutorial for Windows Server 2025.

View all Windows Server 2025 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Windows Performance Analyzer (WPA) and xperf documentation at learn.microsoft.com. Windows Server 2025 performance tuning guide. Sysinternals Process Monitor and Process Explorer at sysinternals.com.