Troubleshooting computers that slow down when System Center Endpoint Protection is running scans.
How do i troubleshoot and find the cause of these types of problems?

Hi,

Could be either disk or CPU problems, I would check a running system and use performance monitor to monitor disk I/O and CPU. You can try changing how much CPU the scan should use as well.

Normally I would see this when the user has a non-SSD disk which is almost full..

Regards,
Jrgen

check the KB3050265 ... this is related to your issue

Did these problems just start because we are having the same problems. Machines don't want to login (they just set there and spin, scans are hanging up. Computers are getting so slow you can't do anything. We have the patch mentioned above installed already but this just started happening in the last few days. not sure what to do but it looks like the problem is with Endpoint Protection.

check the KB3050265 ... this is related to your issue

Really? How? That KB is for the Windows Update Agent and has nothing to do with SCEP scans.

We have started having issues w/ our workstations today, as today is their weekly scans.  The end users PCs are coming to a crawl.  Hopefully a resolution is posted soon.  

Have you opened a case with Microsoft yet? They may not be aware of any issues or will be able to help you troubleshoot yours and identify the actual issue.

I have, I will let you know what they say.

Yes please do. We are having issues as well som im really interested in hearing what they have to say.

I would also be interested in the resolution.  We have some workstations with users who report the same issues and at least one admin with the issue.  Should we all spam MS Support with open cases or leave them to do their work with the half dozen cases already opened?

What looks like the same issue is also being discussed in the Forefront forum.

 https://social.technet.microsoft.com/Forums/forefront/en-US/cf550839-fa7d-40aa-b4ea-c32846cc8659/system-center-2012-r2-endpoint-protection-hanging-on-full-scans

Our solution so far is to post-pone tomorrow's Full Scan until we can resolve the issue.

Have any of you observed an svchost process using up gigs of memory on the computers? In my case the users say its SCEP but i believe the issue might be a Windows Update one.

• Edited by TribleTrouble 21 hours 53 minutes ago typo

Have any of you observed an svchost process using up gigs of memory on the computers? In my case the users say its SCEP but i believe the issue might be a Windows Update one.

• Edited by TribleTrouble Friday, August 28, 2015 9:57 AM typo

I did see that on one machine and wasn't sure whether it was the same issue.  I got a "you're out of memory" alert on a system with 16GB.    SVCHost said it was using 300MB and the MsMPEng process said it was using 100somethingMB.  Where the other 15GB went, I don't know.

Well you should see that in the task manager if you view all users.

It's possible that I didn't click the "Show processes from all users" but I thought I had.  Which was why I was even more confused.  (Un?)fortunately, I can't replicate the issue on that workstation.  I'll keep trying though.

To quote my post in a very similar thread, https://social.technet.microsoft.com/Forums/en-US/cf550839-fa7d-40aa-b4ea-c32846cc8659/system-center-2012-r2-endpoint-protection-hanging-on-full-scans:

=============

Looks like we have a HotFix from Microsoft for KB3076895 on Windows 7 and Windows Server 2008R2.

https://support.microsoft.com/en-us/kb/3090303

I haven't had a chance to test it yet though.  Comes with the usual caveats from Microsoft, "proceed with caution and only deploy to machines actively running into the problem and whatnot."

=============

The hotfix appears to have solved my our problems.

Yes have seen svchost.exe using 1+GB of memory on several systems. At first thought it might be branch cache related to large SCCM apps using the branch cache option but further investigation showed it was linked to: wuauclt.exe wuauserv.dll. You might want reset the Windows Update components on that computer and check for free space on C:. 10% is the recommended minimum I think.

Here's a link for the reset: Reset