Forum Discussion
marckuhn
Nov 08, 2021Brass Contributor
Microsoft Intune Certificate Connector causes high CPU Usage
Hi all we have setup SCEP with our On-Prem Environment and Intune, which is working fine so far. We discovered that the the Process"Microsoft.Intune.Connectors.PkiRevoke" is eating up all CPU. We...
ANDRES365
Nov 17, 2021Copper Contributor
We have exactly the same problem. Degraded the VM to two vCPUs, which are always full in use. Service is not usable.
OS is Server 2022 with all updates.
Seems like a bug, any news on this?
marckuhn
Nov 17, 2021Brass Contributor
Hi all
currently i don't have this issue anymore on one of our environments. Do you have any errors in the event Log regarding revocation of cert's?
Best regards,
Marc
currently i don't have this issue anymore on one of our environments. Do you have any errors in the event Log regarding revocation of cert's?
Best regards,
Marc
- Raymond Huis in 't VeldNov 17, 2021Brass ContributorHi marckuhn - thanks for getting back on this.
From our perspective, the Event IDs 3003 stopped from being logged by november 9th. However, Event IDs 2 er still there, as well as the high CPU load from the microsoft.intune.connectors.pkirevoke.exe process unfortunately.
Any idea as to what is different from that one environment you are talking about?- Raymond Huis in 't VeldNov 17, 2021Brass ContributorHmm, after restarting the PkiRevokeConnectorSvc service the error 3003 is back as well.
- marckuhnNov 17, 2021Brass Contributor
I can't really tell why but I took the road and removed the Certificate Connector on that server and reinstalled it there. What I didn't activated now are the PKCS points, just SCEP and Cert Revocation. I still use the SYSTEM User for this.
My CPU on this server is back to normal, even though I have also that 3003 errors in the log. I wasn't able to test the revocation successfully. I think this isn't working at least in my environment.
I have a Server 2019 with all AAD related tools on it like AADC, App-Proxy, Cert Connector, NDES.
What I didn't configure was the "Logon as a service" permission for my NDES Service Account. Do you have this in place on your side?
Best regards,
Marc