System CPU Process & Thread ntoskrnl.exe RtlSidHashLookup
Just trying out Windows 8.1 and it seems like the system process was constantly at 10-20%. Not nice (literally, it was bogging the machine down too).
I found this: http://blogs.technet.com/b/markrussinovich/archive/2008/04/07/3031251.aspx which leads us to two great tools and the beginning of our troubleshooting:
- Process Explorer – http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
- Kernrate Viewer (KrView) – http://www.microsoft.com/en-us/download/details.aspx?id=24853
Looking into the system’s threads a bit deeper with process explore I found the item that was eating up CPU usage.
- ntoskrnl.exe RtlSidHashLookup
A quick google (http://lmgtfy.com/?q=ntoskrnl.exe+RtlSidHashLookup) found:
Running this the sfc command below turned up nothing as shown in the screenshot
- sfc /scannow
And if that were the case, you’d probably then be looking for this:
- GUIDE: CNBJ2530.DPB and prncacla.inf Corruptions – Windows 8/8.1 – http://www.sysnative.com/forums/windows-update/7702-guide-cnbj2530-dpb-and-prncacla-inf-corruptions-windows-8-8-1-a.html
>It has come to our attention at there has been a recent explosion of people reporting corruptions with the CNBJ2530.DPB file in Windows 8 and 8.1.
Unfortunately my issue had something to do with a firefox plugin that I’ve still not figured out. But it turns out restarting Firefox solved the issue and has not appeared again. I’m still on Firefox 29 because 30 looks appalling and eats up yet another %10 more ram. I ran that test with the same plugins and same tabs open on another machine that I don’t regularly use.
I should mention, I have a slight suspicion it could have been VMWare Workstation too, but based on the order and timing of randomly turning off apps and not being able to repeat the problem, it’s only for the benefit of notes.
The problem cam back, so I started doing some general service tuning and used these guides:
Since then, I have not seen this issue come back. I’m pretty sure one of the services I disabled in the blackviper guide is what fixed it.