5
2
Today I installed a new CPU cooler onto my desktop that actively monitors the CPU temps and will adjust the fan speeds as needed. It also alters an LED on the cooler based on the temps of the CPU.
I noticed now with this new cooler that when I lock my system and let the screen timeout and turn off, the CPU usage will spike and stay spiked until I activate the system again by touching the mouse or hitting a key to turn the monitor back on. At that point, it will stop spiking and normal out.
Looking around for some solutions to this, most people that had similar issues resulted in having an ASRock motherboard with an application issue, I, however, have a Gigabyte board with no special software for it installed.
My system has not changed other than the cooler and the case it is in since the last time it was turned on so this is something that has apparently been going on prior and this new cooler is now making me aware of it.
I'm not sure what would be causing this. I have tried monitoring the processes while the system goes into its 'idle' state with the lock screen on and the monitors auto-turning off.
For example here is a screenshot from procmon.exe showing CPU usage in a small time-frame from when the screen timed out til I rewoke it:
MsMpEng.exe seems to be the culprit. At the highest peak, it was at 28% CPU usage which ProcMon says was a 'Process Profiling' operating. Basically every event seems to be listed as 'Process Profiling' for it while the screen is off yet the CPU is hitting 20-30% consistently soon as the screen turns off.
Does anyone know why this would be happening, and how to stop it? I don't want my system to be trucking along while it's not in use and I do not want to turn it off between usage as there are some programs I do want running in the background (messaging related things) in case I got something important.
Edit :: Using 'Remote Process Explorer' I confirmed it is definitely MsMpEng.exe hitting the CPU to 30% and holding it there while the screen has turned off. I disabled 'Real Time Protection' and this does not seem to help prevent it from happening. Is there a way to stop this behaviour without completely disabling Windows Defender?
Can you confirm the CPU wasn't running at 30% before you changed the cooler? Honestly my guess is that your other cooler did exactly the same thing, but it was quieter, so you didn't notice it. "MsMpEng.exe is a core process of Windows Defender, which is Microsoft's antispyware utility." - So Windows Defender is doing a scan when your system is locked, likely as it was always configured to do, you just never noticed. – Ramhound – 2016-03-16T16:59:12.070