How-to· 4 min read· By the RemediateDesk team · Published October 15, 2026 ·All guides
1. Confirm it is sustained
A single reading of 100% means nothing; processors spike constantly. You are looking for load that stays high across several samples.
(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 2 -MaxSamples 5).CounterSamples.CookedValueFive readings two seconds apart. If they are all above roughly 90, carry on. If one is high and the rest are low, the user saw a spike and the ticket is probably about something else.
2. Find the process, in percent
The most common mistake here is Get-Process | Sort CPU. That CPU column is the total processor seconds the process has used since it started, so a service that has run for a month outranks the thing that is pegging the machine now. Ask for current percentage instead.
Get-CimInstance Win32_PerfFormattedData_PerfProc_Process |
Where-Object { $_.Name -notin '_Total','Idle' } |
Sort-Object PercentProcessorTime -Descending |
Select-Object -First 10 Name, IDProcess, PercentProcessorTimeHere 100 means one fully used logical core, so on an eight-core machine a single busy thread tops out near 100 and the whole machine near 800. This class also has the advantage of not being translated on non-English Windows, where Get-Counter paths are.
3. If it is svchost, find out which service
A busy svchost.exe is a container; the name tells you nothing. Map its process ID to the services it hosts.
Get-CimInstance Win32_Service -Filter "ProcessId=1234" | Select-Object Name, DisplayName, State
# or: tasklist /svc /fi "PID eq 1234"4. Is it a process, or the system itself?
If no process accounts for the load, the time is being spent in the kernel, and that points at a driver. Compare privileged, interrupt and DPC time.
Get-Counter '\Processor(_Total)\% Privileged Time','\Processor(_Total)\% Interrupt Time','\Processor(_Total)\% DPC Time' -SampleInterval 2 -MaxSamples 3High interrupt or DPC time with no hot process usually means a network, storage or graphics driver misbehaving. That is a driver update or a vendor conversation, not something to kill.
5. Read what the machine already said
Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2,3; StartTime=(Get-Date).AddHours(-24)} -MaxEvents 40 |
Select-Object TimeCreated, ProviderName, Id, MessageLook for clusters: the same provider repeating, a disk or controller warning, a service that keeps restarting. A cluster that begins when the complaint began is a lead.
The usual suspects
| Process | Usually means | Safe response |
|---|---|---|
| TiWorker.exe, TrustedInstaller.exe | Windows servicing is installing updates | Wait. Ending it mid-update can leave the component store damaged |
| MsMpEng.exe | Defender is scanning | Let the scan finish; if it never stops, review the schedule, exclusions and any second antivirus |
| SearchIndexer.exe | Search is re-indexing | Wait; investigate only if it persists for days |
| WmiPrvSE.exe | Something is querying WMI hard, often a monitoring tool | Find the caller in the WMI-Activity operational log before touching WMI itself |
| Browser, Teams, Outlook | A user workload | Ask the user to save, then restart the application |
| An EDR or security agent | Its own scanning or a fault in it | Do not end it. Capture process name, percentage over time and version, and escalate to the vendor |
What not to do remotely
Do not end system processes such as csrss.exe (see the csrss.exe guide for what to do instead) or wininit.exe - the machine will stop with a stop error. Do not end security tooling to “test” whether it is the cause; you have just disabled the protection and the customer will want to know why. And ending any application discards whatever the user had not saved, so ask first.
Rule out throttling
A processor that is cooking itself runs slowly and looks busy. If the clock is far below its maximum under load, the problem is thermal or power, and no software fix will help.
Get-CimInstance Win32_Processor | Select-Object Name, CurrentClockSpeed, MaxClockSpeedVerify, then decide whether to escalate
After any change, take the same five samples again and watch for several minutes, not one reading. The fix held if load stays down and the user's original symptom is gone. Escalate when kernel time stays high with no process to blame, when the culprit is a security product, when the machine is throttling, or when a virtual machine's host is the one starved.
RemediateDesk runs this same sequence on the real endpoint and will not mark a session resolved until a separate check has run after the fix; see the Windows support examples.
Step-by-step in RemediateDesk
To see this sequence run on a managed machine, from the first read-only check to the verified result, work through your first ticket. The approvals page explains which steps wait for a click.