Virtual Machine CPU: Recurring 100% Usage at Noon — Investigation and Troubleshooting Guidance

Question

Virtual Machine CPU: Recurring 100% Usage at Noon — Investigation and Troubleshooting Guidance

Jim-2564 0

Problem description

I am experiencing a recurring issue with my Azure virtual machine running Windows in the Central US region. For the past two days, around 12 pm Central Time, the VM's CPU usage spikes to 100%, causing it to become unresponsive. The high CPU usage persists during these periods, and I observe that Windows Defender seems to be the abnormal process consuming the most CPU. The VM is hosting Remote Desktop Services and SQL Server. Despite efforts, I am unable to determine the exact trigger for these spikes and want guidance on troubleshooting and resolving the issue.

Environment

Azure Windows virtual machine in Central US, hosting Remote Desktop Services and SQL Server.

What I've already tried

I have used monitoring tools to confirm the high CPU condition, checked the responsible process (Windows Defender), reviewed health notifications and logs, and noted a VM restart on 2026-10-05. I attempted to run diagnostic scripts inside the VM, but the server's slow performance prevents effective execution. I have not made any configuration changes or applied exclusions yet.

Current status

I am seeking assistance to identify the root cause of the recurring CPU spikes around noon, verify if Windows Defender or other processes are involved, and receive recommended troubleshooting steps to resolve the issue.

Jim-2564 0 Reputation points

2026-10-07T19:01:19.6733333+00:00
The problem started the day that we received this message.

Redeploying due to host failure (Unplanned)

At Monday, October 5, 2026 at 6:08:53 AM CDT, the Azure monitoring system received the following information regarding your Virtual machine:

We're sorry, your virtual machine isn't available and it is being redeployed due to an unexpected failure on the host server. Azure has begun the auto-recovery process and is currently starting the virtual machine on a different host.

Recommended Steps

Check back here for status updates

As of now, we have received no updates on this and nothing else in the environment has been changed. Also noticing that the Service Host: Remote Desktop Services service is running at high memory usage and also seems to be showing up on top processor usage more than I believe it should.
Jim-2564 0 Reputation points

2026-10-07T19:02:04.7266667+00:00
The problem started the day that we received this message.

Redeploying due to host failure (Unplanned)

At Monday, October 5, 2026 at 6:08:53 AM CDT, the Azure monitoring system received the following information regarding your Virtual machine:

We're sorry, your virtual machine isn't available and it is being redeployed due to an unexpected failure on the host server. Azure has begun the auto-recovery process and is currently starting the virtual machine on a different host.

Recommended Steps

Check back here for status updates

As of now, we have received no updates on this and nothing else in the environment has been changed. Also noticing that the Service Host: Remote Desktop Services service is running at high memory usage and also seems to be showing up on top processor usage more than I believe it should.

1 answer

Your answer

Jim-2564 0 Reputation points

2026-10-07T19:01:19.6733333+00:00

The problem started the day that we received this message.

Redeploying due to host failure (Unplanned)

At Monday, October 5, 2026 at 6:08:53 AM CDT, the Azure monitoring system received the following information regarding your Virtual machine:

We're sorry, your virtual machine isn't available and it is being redeployed due to an unexpected failure on the host server. Azure has begun the auto-recovery process and is currently starting the virtual machine on a different host.

Recommended Steps

Check back here for status updates

As of now, we have received no updates on this and nothing else in the environment has been changed. Also noticing that the Service Host: Remote Desktop Services service is running at high memory usage and also seems to be showing up on top processor usage more than I believe it should.
Jim-2564 0 Reputation points

2026-10-07T19:02:04.7266667+00:00

The problem started the day that we received this message.

Redeploying due to host failure (Unplanned)

At Monday, October 5, 2026 at 6:08:53 AM CDT, the Azure monitoring system received the following information regarding your Virtual machine:

We're sorry, your virtual machine isn't available and it is being redeployed due to an unexpected failure on the host server. Azure has begun the auto-recovery process and is currently starting the virtual machine on a different host.

Recommended Steps

Check back here for status updates

As of now, we have received no updates on this and nothing else in the environment has been changed. Also noticing that the Service Host: Remote Desktop Services service is running at high memory usage and also seems to be showing up on top processor usage more than I believe it should.

Answer 1

Hi Jim,

A spike at the same time every day, with Windows Defender as the top process, usually means a scheduled Defender scan is running across a busy SQL Server and RDS host with no exclusions. Here's how to confirm it and fix it.

1. Run commands without RDP

Because the VM is unresponsive during the spike, use Run command > RunPowerShellScript on the VM in the Azure portal (or the Serial Console) for the checks below.

2. Confirm the scan schedule

Get-TimeZone
Get-MpPreference | Select-Object ScanScheduleDay, ScanScheduleTime, ScanScheduleQuickScanTime, ScanParameters, ScanAvgCPULoadFactor, RandomizeScheduleTaskTimes
Get-MpComputerStatus | Select-Object QuickScanStartTime, FullScanStartTime

Azure VMs use UTC by default, so 12 PM Central would show as 17:00 in the VM's clock. You can also open Event Viewer at Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational and look for event 1000 (scan started) and 1001 (scan finished) around that time.

3. Move the scan to off-hours

Set-MpPreference -ScanScheduleDay Everyday -ScanScheduleTime 02:00:00 -ScanParameters 1

ScanParameters 1 makes it a quick scan instead of a full scan. If Defender is managed by Intune, Group Policy, or Microsoft Defender for Endpoint, change the schedule there, because local settings will be overwritten.

4. Add the recommended SQL Server exclusions

Scanning live database and backup files is a very common cause of high CPU. Microsoft's guidance is in Configure antivirus software to work with SQL Server. For example:

Add-MpPreference -ExclusionExtension ".mdf", ".ndf", ".ldf", ".bak", ".trn"
Add-MpPreference -ExclusionProcess "C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Binn\sqlservr.exe"

Change the path to match your SQL Server version and instance name. If you use FSLogix profile containers for RDS, exclude those .vhd/.vhdx files too.

5. Limit how much CPU scans can use

Set-MpPreference -ScanAvgCPULoadFactor 30 -EnableLowCpuPriority $true

This applies to scheduled scans only, not real-time protection.

6. Check the VM size

If it's a B-series (burstable) VM, check the CPU Credits Remaining metric in the portal. If credits run out, the VM is throttled and a daily scan can push it over the edge. Running RDS and SQL Server on the same VM is also heavy, so consider a larger size if CPU stays high after the changes above.

If the spike continues after moving the scan, share the output from step 2 and the Defender events from that time window, and we can dig further.

If this answer helps, please click "Accept Answer" so others with the same issue can find it.