svchost hogs CPU

[McEve]

Hi,

We have a mixed AD domain with about 200 computers, Win2000, win98 and WinXP.

We are now excperiencing a great deal of trouble with the WinXP computers. Ever 12 seconds the CPU reaches 100% utilization - (svchost is hogging the CPU). The eventlog is full of Log Off events, category 3, every 12 seconds.

A packetsniffer shows the 2 DC's sending an incredible amount of LDAP and DS traffic to the WinXP, and also the same kind of traffic between the two DC's. We're talking 50 entries a second constantly in the packet sniffer log between the DC's, all DS and LDAP.

netdom verify WinXPWorkstation on the DC returns an error:

The secure channel from WinXPWorkstation is invalid.

netdom reset results in netdom verify verification, and interestingly also stops the constant traffic from the DC to the Workstation.

Now... what could be causing this behaviour? how can I stop this traffic and get the WinXP computers to behave again? All the WinXP's show this behaviour.

I'll be happy for any suggestions!

 

[PeteH2]

This sounds like a browsing issue. Is there a regular-ish time between occurances ?

Pete...

 

[McEve]

Hi Pete,

Yes there is a regular time between occurances - 12 seconds, around the clock.

You might be right that it is a browsing issue - reinstalling the NIC drivers on the client makes it quiet for about 20 sec, then it starts all over again. But if I try browsing the network before the 20 sec is up, svchost hogs the CPU immediately. Have a look here:

http://automaker.questus.dyndns.org/task.html

 

[PeteH2]

What happens when you disable the browsing service on all the XP clients ?
What happens when all the XP clients are powered off ?

Pete...

 

[McEve]

Ok, I thought I'd let you know what caused the problem.

It was a policy. Auditing Directory service Access was enabled, and XP didn't like that one bit.

This was a hard one to find....