11-26-2018 03:31 PM
11-26-2018 03:31 PM
Hello, this problem is a bit complicated to describe, but i joined in on a thread here to post my experiences: https://social.technet.microsoft.com/Forums/en-US/ca8b8e3d-b6df-426f-b58f-c9e4adbd1612/windows-serve...
Since that forum isn't monitored much, i wanted to cross post it here to see what folks think, and this first post will contain some notes about my environment and the troubleshooting that i've done thus far.
WHAT I SEE AS THE PROBLEM
When launching Server Manager, the servermanager.exe will take high CPU on a 2x core VM, one process will take 50%. On a 4x core VM, it will take 25%. Attempting to launch it again will continue to stack CPU usage.
WHERE PROBLEM OCCURS
These are en-us builds.
Server 2019 (OS Build 17763.134), Windows 10 1809 for Business (OS Build 17763.134) wit features install of RSAT, Windows 10 1803 for Business (OS Build 17134.286)
HOW IT PRESENTED IN MY ENVIRONMENT
For me, I believe it may be something in my group policies that's causing it. Since when i built the gold image prior to templatizing and joining to the domain, the ServerManager.exe was running and I used it to install roles/features.
That being said, i have a *large* number of group policy modifications occuring in my domain, so i would need assistance translating what could potentially cause this new server manager in 2019/1809 to not function.
An important note regarding this issue is that Server 2016 VMs with servermanager.exe 10.0.14393.2608 are fine.
However, Windows 10 1803 with rsat and servermanager.exe 10.0.17132.1 also exhibits high cpu and never runs.
WHAT IVE DONE
.Net repair tool
.Net verification tool
Symantec Endpoint Protection (version 14.2 build 1015, 14.2.1015.0100) (However, this gets installed when the image is not joined to the domain and Server Manager still works, so i doubt it is this)
Physical and virtual systems, Virtualization is on VMware vSphere 6.7 Update 1/ESXi 6.7 Update 1. For VMs, the SID reset and other customzations are done via VMware's OS Customization.
I went through a Symantec Endpoint Proection client upgrade for all client and server images, to 14.2.1031.0100, and this made no impact to functionality.
One other thing to note in my experience with this issue is that from any of my Server 2016 machines (physical/virtual), since Server Manager works, i am able to add any of my Server 2019 machines into the Server 2016 Server Manager, and i can see the unique Server 2019 roles/features.
So this leads me to believe that the underlying frameworks are okay, and it's something to do with how it's trying to execute on the local machine.
Finally, I've done a small procmon analysis between a working server 2016 domain joined machine when launching servermanager.exe and a non-launching RSAT 1809 Windows 10.
Basically, the amount of events that servermanager.exe and a child process spawn on a non-working Server2019/1809 is 66 in about 1 second when it ceases all attempts at doing anything.
While on a working load, it's 21,438 events in just under 10 seconds, when i closed the logging.
Attached pic shows the left procmon is non functional on 1809, while right one shows matching step and working logs from 2016.
11-27-2018 03:40 AM
In case anyone also wanted to see a similar procmon analysis of the ServerManager.exe process on a Server 2019 GUI (Build 17763.134) domain joined machine where the application doesn't spawn and consumes cpu.
On Server 2019, as can be seen in the screenshot, the ServerManager.exe process behaves exactly like the Windows 10 1809 build. 69 events and ceases doing anything, save eating cpu.
I'm not very experienced in digging into the underlying frameworks of processes/system calls/etc, but i looked at the threads of the ServerManager.exe process on the box as it was at high cpu, and this is what i saw:
What i see there looks like the thread !RtlUserThreadStart. I pasted a stack of the thread as well, if that can be of assistance.
11-29-2018 02:05 PM
I have only spent 5 minutes on this so far, but I saw the same issue with Symantec Endpoint Protection version 14.2 MP1 with patch 1031 (the latest I know of.
If I learn more, I'll post.
12-13-2018 02:02 AM
01-24-2019 11:38 AM
It is the SEPM causing the issue. You can either remove the device and application control or can create an exception in sepm: Windows exception - File, file is servermanager.exe and select application control.
02-03-2019 03:32 PM - edited 02-08-2019 03:09 AM
Hi @chris905, I created exceptions for both security/file as well as a custom application and pointed to C:\Windows\System32\ServerManager.exe However, it's still an issue like nothing is changed. I haven't tried a case where i would remove SEP from a domain joined machine to see if it is still a problem, but as i stated a few times above, it's highly unlikely that it's SEP.
I'm just surprised not more people are affected by this.
02-14-2019 11:00 AM
Same issue here, did you ever find a solution?