100% CPU at startup, for next 45 mins, then fine all day

[Philip]

So I'm at a loss here, and I think I've tried all common
fixes, and can't find anything exactly like this in KB or
newsgroups...

20 Dell OptiPlex workstations, same hardware config same
software config:

Windows 2000 SP4
2.4GHz Proc
256MB RAM
20 Workstation Win2K Network

This Monday, 3 users came in and complained they hit CTRL
ALT DEL to log in and then it just sat there. 10 mins
later they were prompted to log in then it took another 10
or so mins for the desktop to come up. Desktop comes up,
hit CTRL SHIFT ESC and 3 mins later Task Manager opens and
shows CPU useage is at 100%. Only process getting any
kind of time is RTVScan (Symantec AV) along with system
idle and the normal. 10 mins later, CPU is down to
between 0 and 20 as normal and the system is then fine for
the rest of the day. The following procs are runnings:

SMSS
CSRSS
SVCHOST x 2
ASFAgent
Iap
TNSLSNT
SlpService
GearSec
SLPMon
MSPMSPSV
RTVScan
Oracle

No hardware or software has recently been added or
changed. Latest virus defs, no viruses, no
SpyWare/AdWare/MalWare.

Ideas?

 

[Scott Harding - MS MVP]

Disable any unnecessary processes and test. I would suspect it's the AV
scanner.

 

[Philip]

Had done that, even to the point of uninstalling the
Symantec AV, testing (with no change), then installing a
smaller, free AV (AVG by GriSoft) for testing over time.

 

[Bryan Martin]

How bout network saturation? Check the hubs/switches and see if bandwidth
is somehow being exceeded. You may also want to check the response time of
the domain controller if exists. Also if the domain controller exists check
to make sure DNS is operating as expected.

Bryan

 

[John Wunderlich]

The following procs are runnings:

Missing from that list of processes is LSASS (Local Security Authority
Service) which, I believe, is needed to validate logins?

-- John

 

[nut cracker]

Have you made any changes to your DHCP scope lately? Make sure that your AD
is configured correctly... sites, subnets, scope options and all that...

it sounds like it is waiting for DNS to return login server information, and
is resorting to a broadcasting function. Make sure that your clients are
using the internal DNS servers that have AD Inegrated zones as well.

NuTs

 

[Guest]

it's there, forgot to list it, but yea that would cause
some problems