Windows 10 VM pegs CPU at 100%

We have a Windows 10 VM with one vCPU and 8 gigs of RAM. It runs an HVAC design software that various users can RDP in and use. We've noticed that sometimes, the CPU will (seemingly randomly) max at 100%. When this happens, it becomes impossible to log in via RDP. The RDP connection times out. Log in attempts from the VMware web console are extremely slow. Once the log in screen is finally passed, a black screen appears with an error stating 'sihost.exe - System error The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application'. Clicking 'OK' dismisses the error message but the VM hangs at the black screen indefinitely. There is no mouse cursor available and the VM does not appear responsive to keyboard input.

I ran a Trend Micro virus scan and also ran the sfc/scannow command, both of which found no issues. When the VM gets in this state, the only way to 'fix' it is to restart it from vCenter. Does anyone have any other ideas or suggestions?

EDIT: I was able to determine that it is 'Service Host: Remote Desktop Services' that is pegging the CPU at 100%. I have no idea why this is happening because it doesn't happen when connecting or disconnecting to the VM via RDP. It seemingly happens out of nowhere.


CPU usage spikes on Windows can often be from updates. Often after an update/reboot, applications that use .NET Framework will run a little slower and use a bit more CPU while the new assemblies are linked to the new framework version. This can often show up as mscorsvw.exe in the process list. Based on the single core configuration of this server, I would recommend adding at least one more to reduce the impact of these updates.

You can also speed up the process and manually invoke the .net optization:

c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe executeQueuedItems 
schTasks /run /Tn "MicrosoftWindows.NET Framework.NET Framework NGEN v4.0.30319"
c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems 
schTasks /run /Tn "MicrosoftWindows.NET Framework.NET Framework NGEN v4.0.30319 64"

One final piece of advice would be to use Windows Server 2016/2019 instead of Windows 10, since updates are non-optional and run automatically on desktop versions.

Source: https://devblogs.microsoft.com/dotnet/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up/