Powershell.exe process running as system on several domain machines pushing cpu usage to 100%

Question

I have several machines on a domain all running a 'powershell.exe' process as system and its smashing the pants off the servers. They're all 100% CPU and, naturally, ground to a halt.

This is Windows server 2012 R2 on HyperV virtual machines.

Killing the process fixes the issue for a while, but then later the CPU smashes the ceiling again and everything just grinds to a halt.

This powershell process was also running on the underlying hypervisor, causing further issues.

Any thoughts?

Solution

You need to determine which script PowerShell is running that is causing the issue. You should be able to see that by adding the "CommandLine" column in task manager details view, or you could also look at it like this:

gwmi win32_process | where {$_.processName -eq "Powershell.exe"} | select -prop processName,ProcessId,commandLine

The CommandLine field will contain the script being run by that PowerShell process.