At almost 1AM EST, Windows 10 "System" process, starts chewing 71% CPU time...

[VirtualLarry]

What in the world could this be? It's NOT Windows Update, that I can see. (Pretty sure that's a service.)

This is the NT Kernel ITSELF. WTF? Surveillance features built-into the kernel? Turning on the camera?

 

[BarkingGhostar]

You upgraded, deal with it. LOL

 

[quikah]

Yes, the camera is turned on at 1AM to take an inventory of the surroundings in case MS needs to send a team in to take out anyone that might approach the PC with a Linux boot disk. Better put tape over your webcam.


You could try running Process Explorer to figure it out:
https://technet.microsoft.com/en-us/sysinternals/bb896653

This is not a problem unique to Windows 10.

 

[Elixer]

What in the world could this be? It's NOT Windows Update, that I can see. (Pretty sure that's a service.)

This is the NT Kernel ITSELF. WTF? Surveillance features built-into the kernel? Turning on the camera?

I bet it is that darn Application Experience BS.
Go into task scheduler, and under Application Experience, disable that. It is the darn CompatTelRunner.exe crap.

 

[VirtualLarry]

It is the darn CompatTelRunner.exe crap.

I don't think so. I've witnessed that too, and it shows up as "CompatTelRunner". This is just "System" AKA the NT Kernel itself.

 

[master_shake_]

all your data are belong to Microsoft.

call it a cloud backup you'll never get to use,

 

[Red Squirrel]

Would be interesting to have a packet sniffer going when it's doing weird stuff like that. I would guess to be more stealthy a lot of data is collected and stored locally and only sent in a big chunk at a certain time, such as after nn hours of idle.

 

[KillerBee]

You could try running Process Explorer to figure it out:
https://technet.microsoft.com/en-us/sysinternals/bb896653

They also updated to Sysmon v5.0
https://technet.microsoft.com/en-us/sysinternals/sysmon


and a good tutorial on how to setup and use it
https://cqureacademy.com/blog/server-monitoring/sysmon

 

[HitAnyKey]

Turn off your router at 12:45am, see what happens at 1am... Sniffer is your friend to see if its outbound

 

[[DHT]Osiris]

Uhh, it's probably just indexing, superfetching, something dumb like that. There's also a lot of 'background' garbage collection that Win does periodically. I tend to see it fishing around in the SXS folder when it does that. Not really sure what it's up to (nor do I tend to care).

 

[denis280]

You upgraded, deal with it. LOL

Lolllll, Sorry Larry but this too funny

 

[PliotronX]

1Am random high cpu usage... Smells like automatic maintenance.