100% CPU utilization. /system32/svchost.exe -k dcomlaunch -p. (Windows 11)

svchost.exe -k DcomLaunch -p is a host process for core Windows services. In the screenshot, it includes BrokerInfrastructure, DcomLaunch, Power, PlugPlay, and SystemEventsBroker. Killing it can cause a bugcheck because it is hosting critical system services.

To narrow down the source of the 100% CPU after sleep, use this sequence:

1. Confirm which hosted service is involved
   • Open Task Manager and sort by CPU.
   • If the high-CPU process is svchost.exe, note its PID.
   • Use Process Explorer as administrator.
   • Open the svchost.exe process properties, go to Threads, select the thread consuming high CPU, and select Stack.
   • This shows which functions are active inside that service host.
2. Capture the problem while it is happening
   • Collect a Windows Performance Recorder (WPR) trace while CPU is high.
   • Keep the recording short because the file grows quickly; a few minutes is enough.
   • Also collect a performance monitor log with a 1-second to 5-second snapshot interval.
3. Analyze the trace in Windows Performance Analyzer (WPA)
   • Add CPU Usage (Precise).
   • Zoom to the affected time range after resume.
   • Apply Utilization by Process, Thread.
   • Make ReadyThreadStack and CPU Usage (ms) visible.
   • Expand the target process and sort by CPU Usage (ms), Ready (us) [Sum], and Waits (us) [Sum].
   • Expand the relevant NewThreadId and inspect ReadyThreadStack to see whether the thread is running, waiting on I/O, waiting on a timer, or being readied by another thread.
4. Check whether one service inside the shared host is the trigger
   • If the issue repeats and the offending process is a shared svchost, break out each service into its own svchost temporarily:

      sc config <service name> type= own
   

   • Restart that service.
   • Run tasklist /svc to verify it is now in its own svchost.
   • Repeat until the high-CPU service is isolated.
   • Important: after testing, revert the change:

      sc config <service name> type= share
   

   Then restart the service.
5. Check for a DCOM permission issue if svchost.exe remains the offender
   • In some cases, high CPU for svchost.exe is caused by DCOM permissions.
   • Resetting the DCOM permission stack can help by removing these registry values:
     1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole:"DefaultAccessPermission"
     2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole:"DefaultLaunchPermission"
     3. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole:"MachineAccessRestriction"
     4. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole:"MachineLaunchRestriction"
   • Warning: incorrect registry changes can cause serious system problems and may require reinstalling Windows.
6. Use basic CPU triage first
   • In Task Manager, sort by CPU.
   • In Resource Monitor, open the CPU tab and sort by Average CPU.
   • Focus first on the top consumers around the time the system wakes.

The most direct path is: capture a WPR trace during the post-sleep spike, inspect the hot thread in Process Explorer, then isolate the hosted service if needed by splitting shared svchost services temporarily.

References:

• High CPU usage troubleshooting guidance
• CPU Analysis
• Troubleshooting issues with system resources