Windows 10 defender firewall MpsSvc and Internet Sharing Services (ICS) consuming high CPU usage

Question

Here's the current performance of my computer: Recently, I've found a problem with my computer during idle: "Windows Defender Firewall" consumes 15 % of CPU While "Internet Connection Sharing" consumes 10% of CPU

I've run sfc scannow but the result is still the same

I have also checked that the Ethernet's connection sharing is off

In another article: https://social.technet.microsoft.com/Forums/windows/en-US/a8d7ba9e-13aa-4410-9b3e-5c859e6ec93b/high-cpu-usage-windows-firewall?forum=w7itproperf

Someone said he has the same issue due to excessive of firewall rules being set as a bug of a 3rd party firewall (I'm now using Avast firewall to replace the windows default one). So I checked my computer to see if it's the same issue as him but seems it isn't the cause of the issue:

I've exported the firewall rule list in the default windows firewall to count the number of rules running:

Here's the avast firewall rules setting:

Is there anything that I've missed? Why is the CPU usage that high?

Solution 1

I had the same issue on Windows 10, Firewall + ICS service constantly taking up 10% of CPU time.

I don't have Windows Defender enabled so couldn't follow the top answer's instructions. Instead:

Click Start and type wf.msc

Click Restore Default Policy

I'm sure it has the same effect as the other answer

Solution 2

I was having the same issue but I do use Windows Defender's firewall. Resetting the firewall defaults worked for me.

I found the fix at https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings/since-windows-10-fall-creators-update-1709/d03167cc-92e7-4d13-94ce-84fda7b0f94f

Reset Windows Defender Firewall:

Settings -> Update and Security -> Windows Defender -> Open Windows Defender Security Center -> Firewall and Network Protection -> Restore Firewall default settings > Click the button to restore the defaults

Or

Use the Windows Firewall repair tool:

https://support.microsoft.com/en-us/help/17613/automatically-diagnose-and-fix-problems-with-windows-firewall

Solution 3

In Services Manager, change the Startup Type of the Internet Connection Sharing (ICS) service from "Automatic" to "Manual". In Task Manager, kill the ICS SVCHOST instance that hogs 10% CPU. This will disable ICS but it will stop the CPU waste.

In previous answers I tried to "provide details" (as per this website guidelines) but the moderators did not agree that those details were constructive, so they deleted them. If you're interested, write to me in private, I guess.

Comments

[magicandre1981]

analyze the CPU usage with WPRUI/WPA.exe expand the stacks of the svchost.exe and based on the function names you should see what the service does.

[User2012384]

@magicandre1981 I found a workaround for me, I've tried using WPA to analyze, however, I found something abnormal: In the stack, I found a process "n/a?", I'm not sure whether it's a bug from microsoft or not.

[magicandre1981]

please share the ETL file (compress it as 7z to reduce the size)

[Biswapriyo]

ICS service is required as Windows firewall is dependent on it. If you use Avast firewall instead of Windows firewall, you may disable ICS.

[User2012384]

Oh, I see but what does ICS do?

[Biswapriyo]

See Wikipedia:Internet Connection Sharing.

[tuskiomi]

Any Idea why windows uses more cpu when the firewall is off?

[s1h4d0w]

Thank you for this! Was having these same issues the past weeks with no AV aside of Windows Defender. I had task manager open when I clicked "Restore Default Policy" and the CPU usage dropped immediately. Now my PC runs on a nice 20% CPU during normal use instead of constantly sitting at around 45%. I didn't really check the rules before clicking "Restore Default Policy", any idea on what usually/often adds these unnecessary rules?

[Ciaran]

Usually Windows will prompt you to allow access for some application to access the internet. Games in particular often trigger it.