Windows 10: Fall update v.1709 creates problems: CPU usage and Desktop wallpaper

I experienced this high CPU problem as well after the FCU and (temporarily) resolved it by uninstalling Hyper-V. This is not a great solution as I need it for Docker. The problem also isn't universal; on my home system I'm not seeing a performance hit even with Hyper-V installed.

The Internet Connection Service has a dependency on the Base Filter Engine (you can view these dependencies in the Services application), which, at least on the problem system, is also showing high CPU use. My sense is that ICS is consuming CPU because the BFE is having problems getting going when Hyper-V (other components might cause the same problem, based on comments here) is installed. The BFE is one of the components involved in providing firewall services. It's not strictly the Windows Firewall that is at fault, as I'm using Kaspersky's Firewall on this work system.

I've logged an issue with Windows Feedback here. Feel free to upvote it if you're experiencing the problem. Hopefully this can be resolved quickly.

 

Really uninstall Hyper-V isn't a solution it's a workaround for high cpu usage. I think Hyper-V and most Vpn clients uses ICS to share Network connections with guest and for internal switch and this is because ICS auto starts if they are present

 

Yeah, the bug I logged should really be "Base Filter Engine causes high CPU use..." since that seems to be the root cause. Can't change the title at this point, though.

 

Found another thread on this subject at superuser.com.

 

Thank you for sharing. Looking forward both threads

 

There is also a thread over at Microsoft answers, however no solution has emerged up to now.
Fall Creators Update Resulting in High CPU Use By Service Host - Microsoft Community

Did anybody try the firewall cycling I mentioned earlier? (which solved the very same issue for me).

 

As I mentioned, my work system (with the problem) is using Kaspersky's firewall. I did try to pause/start protection with its control panel, but it didn't help.

 

Hi! This is from the SuperUser question.
I just wanted to report that I am also using Hyper-V. Uninstalling that did not help, however. What did provide relief was disabling the Internet Connection Sharing service. It magically changed to Manual (Trigger Start) but didn't try to start, and this calmed down the Windows Defender Firewall service. (As I wrote in the SuperUser question, for my system, there is a definite connection between the starting ICS service and the firewall, via repeating RPC calls.)

 

Disabling ICS is not really an option for many because it will be indirectly needed for things such as Docker (depends on Hyper-V, which depends on ICS), and likely other tools. By turning this off, you won't know in the future why something that seems unrelated fails to work.

 

I was referring to the Windows Defender Firewall, however, due to past lessons learned, I believe it is questionable if a 3rd party security application is yet fully compatible with Fall Creators Update (I have experience with Symantec Enterprise products in the recent past), or, due to a misconfiguration during the upgrade, Windows Defender Firewall is together with Kaspersky controlling network access in your system. If you are willing to try, please uninstall Kapersky Firewall and cycle/reset Windows Defender Firewall.

My configuration is a laptop, with Hyper-V installed with three machines and three networks - networks now deleted for the sake of testing.

Further research shows that after pressing Restore, I triggered a series of 2032 (screenshot below), 2010, 2004, 2005 and 2006 events in event viewer, which included automatic reconfiguration of application rules for both inbound and outbound traffic. In the series of events, ICS had the leading role. The firewall can be also reset by pressing "Restore Default policy" in Windows Defender Firewall And Advanced security application.





For reference, below is a list of inbound and outbound rules related to ICS configured in my system.

 

I don't think this is related to security software, unfortunately. I've been running ESET NOD32 AntiVirus (which has no firewall component on its own) together with the Windows Defender Firewall. Uninstalling NOD32 had no effect on this issue. (I did not try resetting the firewall rules.)

 

Ok - often when trying to troubleshoot this sort of issue, it is good to (as the song says) - "Start the beginning - a very good place to start".

I suggest you create a virtual hard drive, and clean install Windows 10 on that as dual boot without doing anything, and see what your CPU situation. Check indexing, turn off start up programs, disable apps starting background etc.

Then work forward customising wallpapers or whatever.

This way, you can often get to your desired endpoint with no issues, or at least identify the culprit. Make regular image backups during this process (using Macrium differentials is great for this), so you cn back track.

 

I was actually pointing towards the cooperation of the two firewalls ( Kaspersky - WDF ) and the possibility of the one not properly disabling the other.
And another one (with the very same happy end as mine):
After update to version 1709, Internet connection sharing stays - Microsoft Community

 

Resetting Windows Defender Firewall indeed solved my issue. I did with the procedure indicated in the thread above,
Settings -> Update and Security -> Windows Defender -> Open Windows Defender Security Center -> Firewall and Network Protection -> Restore Firewall default settings

After that, I disabled the Firewall again, because I'm using F-Secure, then the issue is gone. Even with ICS set to automatic and active. Thanks for the info.

 

Resetting Windows Defender Firewall also worked for me. Thank you!