LocalServiceNoNetworkFirewall high CPU: finding what BFE and the firewall are chewing on

What the name means

LocalServiceNoNetworkFirewall is not a program. It is the name of a service host group: the svchost.exe process started with -k LocalServiceNoNetworkFirewall. Windows puts services with the same security needs in one host process, and the group name is only a label for that set.

Microsoft's documentation says Windows 10 and later split most services into their own host processes, with a few deliberate exceptions. The Base Filtering Engine (BFE) and the Windows Firewall service (mpssvc) are kept together in one host group, so a busy svchost carrying this name means one of those two is working hard.

1. Identify the process and the service inside it

Get-CimInstance Win32_Service -Filter "Name='BFE' OR Name='mpssvc'" |
  Select-Object Name, DisplayName, State, ProcessId
tasklist /svc /fi "imagename eq svchost.exe"

Take the shared ProcessId, then measure that exact process rather than trusting Task Manager's name:

$id = (Get-CimInstance Win32_Service -Filter "Name='BFE'").ProcessId
1..5 | ForEach-Object {
  Get-CimInstance Win32_PerfFormattedData_PerfProc_Process -Filter "IDProcess=$id" |
    Select-Object IDProcess, PercentProcessorTime
  Start-Sleep 2
}

To confirm the grouping on this machine, Microsoft says the marker is a SvcHostSplitDisable value of 1 in the service's registry key:

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\BFE' -Name SvcHostSplitDisable -ErrorAction SilentlyContinue

2. Is it the firewall rules, or something feeding them?

BFE manages the filters that the firewall and other products install. High CPU here is most often about how many rules or filters it is processing, or about another product repeatedly changing them. Count first.

(Get-NetFirewallRule).Count
Get-NetFirewallRule | Group-Object DisplayGroup | Sort-Object Count -Descending | Select-Object -First 10 Count, Name
Get-NetFirewallProfile | Select-Object Name, Enabled

A very large total, or one group with thousands of near-identical entries, is the lead. Practitioners commonly report this after a third-party firewall or network-monitoring tool was installed and later removed, leaving its rules behind.

3. Is a second firewall or security product fighting it?

Two products that both manage filtering can drive each other into constant rewrites. On Windows client editions you can ask Windows what is registered; this namespace does not exist on Windows Server.

Get-CimInstance -Namespace root/SecurityCenter2 -ClassName FirewallProduct | Select-Object displayName
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName

Also ask when it happens. Spikes that line up with a VPN connecting or a cable being plugged in point at the network-change path; a constant load points at the rule set.

4. Read what the service logged

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; Id=7031,7034; StartTime=(Get-Date).AddDays(-2)} |
  Where-Object { $_.Message -match 'Base Filtering Engine|Windows Defender Firewall|Windows Firewall' } |
  Select-Object TimeCreated, Id, Message
Get-WinEvent -LogName 'Microsoft-Windows-Windows Firewall With Advanced Security/Firewall' -MaxEvents 30 -ErrorAction SilentlyContinue

Event 7031 and 7034 in the System log mean a service crashed or terminated unexpectedly. Repeated entries for BFE are a different problem from steady high CPU and usually point at a faulting third-party filter driver.

5. Fixes, and which ones change the machine

1. Remove the redundant product. Two firewalls is the cleanest finding and the cleanest fix, done through the product's own uninstaller.
2. Export before you touch rules. This is read-only and gives you a way back.
3. Remove orphaned rules that belong to software no longer installed, after reviewing them.
4. Reset to defaults only as a last resort.

netsh advfirewall export "C:\Windows\Temp\firewall-before.wfw"

Resetting the firewall (netsh advfirewall reset) removes every custom rule, including ones that line-of-business applications and remote access depend on, and restarting BFE stops the services that depend on it and briefly interrupts filtering. Both need a technician's approval and an export taken first. Never stop or disable the firewall to "see if the CPU drops", and do not end the svchost process: it hosts a security control.

6. Verify

Re-run the five-sample measurement from step 1 and compare the rule count. Keep watching through a network change, because that is when the trigger usually returns. Check that the firewall profiles are still enabled afterwards.

Get-NetFirewallProfile | Select-Object Name, Enabled

Where RemediateDesk fits

RemediateDesk gathers steps 1 to 4 on the real machine as read-only checks and tells you what it found: which service owns the process, how many rules exist and whether a second security product is registered. It proposes any change, such as an export, a rule removal or a service restart, as an exact command that needs approval, and a reset to defaults is the sort of action your own never-allowed or always-ask lists can cover. It is a good fit for the evidence-gathering; the decision to delete rules belongs to a person. The Windows support examples show the same pattern, and AI IT support compared with scripts explains why the approval step exists.

Frequently asked questions