Termsrv.dll hogging CPU in XP Home SP1

[Philip Herlihy]

I have a machine which boots happily if the Terminal Services service is
disabled using msconfig, but otherwise redlines with the CPU at 100%.
LSASS.exe is taking about 50%, with a SVCHOST.exe instance taking about 35%
at any one instant. If I kill the TERMSRV.dll thread in that SVCHOST (using
Process Explorer from sysinternals.com) everything calms down. I can't for
the life of me see why this is happening. I've been working on this problem
for two weeks...

Any ideas will be gratefully received.

 

[Guest]

Why not just rebuild the machine. Two weeks is way too long to spend on a workstation. If I spend more that 20 minutes on a machine it gets reimaged from via my RIS Server

Patrick Rous
Microsoft MVP - Terminal Serve
http://www.workthin.co

----- Philip Herlihy wrote: ----

I have a machine which boots happily if the Terminal Services service i
disabled using msconfig, but otherwise redlines with the CPU at 100%
LSASS.exe is taking about 50%, with a SVCHOST.exe instance taking about 35
at any one instant. If I kill the TERMSRV.dll thread in that SVCHOST (usin
Process Explorer from sysinternals.com) everything calms down. I can't fo
the life of me see why this is happening. I've been working on this proble
for two weeks..

Any ideas will be gratefully received

 

[Rajneesh Mahajan \(MSFT\)]

Can you check if port 3389 is taken by someone other than termserv? You can
use command "netstat -oan | findstr 3389" to find the process using port
3389. Then you can use command "tlist -s" to find name of process and hosted
services (in case of svchost.exe).

Rajneesh

 

[Philip Herlihy]

Thank you, Rajneesh, but nothing appears to be bound to port 3389. Threads
in the relevant instance of SVCHOST are bound to ports:
123
1025
3002
3003

 

[Philip Herlihy]

Thank you Rajnessh, but nothing appears to be bound to that port.

Threads in the relevant instance of SVCHOST are bound to:
123
1025
3002
3003

 

[Philip Herlihy]

Fair comment. Pride has a little to do with it, but the machine's
non-technical owner is very unlikely to be able to find their installation
disks, settings, passwords, etc. I'm certainly reaching the point of giving
up and rebuilding.

--
####################
## PH, London
####################

Why not just rebuild the machine. Two weeks is way too long to spend on a

workstation. If I spend more that 20 minutes on a machine it gets reimaged
from via my RIS Server.

 

[Rajneesh Mahajan \(MSFT\)]

Can you turn off remote assistance and see if it solves the problem? To turn
it off right click on "My Computer", choose Properties, click on Remote tab
and uncheck Remote Assistance. You might also need to restart the machine.

The 100% CPU usage might be because of a known issue with Remote Assistance
(which uses termserv). The problem will be fixed in XP SP2.

Rajneesh

 

[Philip Herlihy]

Thanks - I'm grateful for your help.

I've had to give the machine back tonight - the owner was desperate to use
it, so I simply set the Terminal Services service to "disabled". He won't
be able to use Remote Assistance or Fast User switching, I gather, but he
can live with that for now.

It was all working recently (although I'd noticed that Fast User Switching
wasn't enabled or just didn't work). I was using Remote Assistance to help
him quite frequently. I've no idea what it was that triggered the CPU
problem - maybe a critical update (automatically installed) set it off. I'd
be glad to have more details on the "known issue" - do you have a URL? I
hunted through the registry for hours looking for some setting that seemed
wrong...

--
####################
## PH, London
####################

Can you turn off remote assistance and see if it solves the problem? To turn
it off right click on "My Computer", choose Properties, click on Remote tab
and uncheck Remote Assistance. You might also need to restart the machine.

The 100% CPU usage might be because of a known issue with Remote Assistance
(which uses termserv). The problem will be fixed in XP SP2.

Rajneesh

 

[Rajneesh Mahajan \(MSFT\)]

I will try to find the exact details. However from what I have seen so far,
the chances of it happening are very rare. If you restore your machine to a
previous good state, this will probably go away even after turning on Remote
Assistance. Till that point turning RA off should be enough.

Rajneesh

 

[Philip Herlihy]

Thanks, I'll be grateful for anything you can find.

I think I may have neglected to try a system restore - it's hard to remember
everything I've tried. I was convinced there was some virus or worm on the
system, and this blinded me to other possibilities for quite some time.
Next time I have access to the machine I'll look to see if a suitable
restore point remains. At the moment the machine is running well with
Terminal Services disabled, and the only loss of functionality is the
unavailability of Remote Assistance.

--
####################
## PH, London
####################

I will try to find the exact details. However from what I have seen so far,
the chances of it happening are very rare. If you restore your machine to a
previous good state, this will probably go away even after turning on Remote
Assistance. Till that point turning RA off should be enough.

Rajneesh