Forum Discussion
Microsoft Intune Certificate Connector causes high CPU Usage
Hi all we have setup SCEP with our On-Prem Environment and Intune, which is working fine so far. We discovered that the the Process"Microsoft.Intune.Connectors.PkiRevoke" is eating up all CPU. We...
Hi marckuhn - thanks for getting back on this.
From our perspective, the Event IDs 3003 stopped from being logged by november 9th. However, Event IDs 2 er still there, as well as the high CPU load from the microsoft.intune.connectors.pkirevoke.exe process unfortunately.
Any idea as to what is different from that one environment you are talking about?
From our perspective, the Event IDs 3003 stopped from being logged by november 9th. However, Event IDs 2 er still there, as well as the high CPU load from the microsoft.intune.connectors.pkirevoke.exe process unfortunately.
Any idea as to what is different from that one environment you are talking about?
Hmm, after restarting the PkiRevokeConnectorSvc service the error 3003 is back as well.
I can't really tell why but I took the road and removed the Certificate Connector on that server and reinstalled it there. What I didn't activated now are the PKCS points, just SCEP and Cert Revocation. I still use the SYSTEM User for this.
My CPU on this server is back to normal, even though I have also that 3003 errors in the log. I wasn't able to test the revocation successfully. I think this isn't working at least in my environment.
I have a Server 2019 with all AAD related tools on it like AADC, App-Proxy, Cert Connector, NDES.
What I didn't configure was the "Logon as a service" permission for my NDES Service Account. Do you have this in place on your side?
Best regards,
Marc
- I tried a repair of the Intune Connector. Not holding my breath though 😉
This morning before the repair I noticed it is not just CPU it is claiming, also the assigned memory is way above 400MB (while after a restart of the service it is about 25MB).
Our situation is pretty equal. Win Server 2019, Azure App Proxy, Intune Certificate connector (with just SCEP en Cert Revocation configured). Running it as service account though. with "Logon as a service" user rights.
What I am wondering, that 3003 error points towards a "Failed to download revocation requests". I am curious whether our proxy setup with the bare minimum whitelisted URLs is holding us from downloading those revocation requests causing some sort of a memory leak and CPU drain.
