Windows Server 2022 NetworkProfile 4004 Events High CPU

[BenjiDuff]

Hi,

We have 2 Windows Server 2022 machines, one is physical and one is virtual. Both are seeing high CPU usage. The Network List Service is the cause of this. We see constant 4004 events in Event Viewer Network Connectivity Level Changed: true, disconnecting it from the network instantly resolves it. Has anybody else experienced this? I've tried both E1000 and VMXNET 3 adapters so don't believe it's driver related.

Have done further testing and reproduced consistently on a fresh install, only occurs when logged on as a domain user and only while logged on, if we log on as a local account it doesn't occur. There's minimal Group Policies applied so don't believe it's them. It's not CU related either.

Thanks

Ben

[#2]

When in doubt, use Process Monitor https://docs.microsoft.com/en-us/sysinternals/downloads/procmon Try to run it for a while and save the capture and see if there's a lot of network requests/processes that should be there or similar

[#3]

It's the NCSI tests, it's spamming our proxy server, it looks like they're succeeding so not sure why it keeps going. Turning off NCSI (ActiveProbing to 0) resolves the issue. Why?

[#4]

Can't you exclude it from the proxy? The Domain User get's the settings pushed by GPO for the proxy?

[#5]

Checked again and it doesn't matter if it's going through the proxy or direct. constant connections to www.msftconnecttest.com.

[#6]

At least you have a work-around in place by setting the registry key, but can't explain the constant connections for NCSI...

[#7]

@BenjiDuff Hello! we had the same problem with ours virtuals Windows Server 2022, if you run an http trace (with fiddler or wireshark) you can find like 10 http request per sec to the remote active probe location www.msftconnecttest.com/connecttest.txt.

This behavior was disrupting our cpu performance and our proxies was bombarded from those requests. The only workaround we found, before disabling the Active Probe via registry, was to disable/enable the network interface from the hypervisor, doing this the netprofm service stopped spamming. 

We still do not know what is causing this.

[#8]

We have the same issue. I just can't reproduce manually, only happens when remote users log in.

[#9]

@SolFelds 

I have the same issue. I can reduce the load by add new network cards to the VM. But still has load, when a user logs in into console, or RDP.

[#10]

We have the same issue as well. 3 Server 2022 DC's all on 3 different ESXi servers. When logged in, high CPU usage (20 GHz+), when logged out normal CPU usage. Since this thread was started almost 2 years ago, has Microsoft still not released a fix for this or are we all to stay logged off of our Servers now?