Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A CPU spike every 10 minutes is a clue, not a diagnosis: Configuration Manager does not have one universal “10-minute high CPU” fault. First identify whether the affected machine is an endpoint or the site server, then capture the process using CPU and correlate its start time with the relevant Configuration Manager logs and scheduled activity. A compliance script, WSUS/IIS workload, inventory backlog, deployment retry, or unrelated agent can all look like an SCCM problem.
1. Identify the computer and process
Start during a spike. In Task Manager, open Details, sort by CPU, and note the executable, PID, user, and start time. Use Process Explorer or Process Monitor to inspect its parent process and command line; a busy child process may be launched by CcmExec.exe without consuming CPU itself.
For a short sample, run an elevated PowerShell window:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Get-Counter 'Processor(_Total)% Processor Time',
'Process(*)% Processor Time' `
-SampleInterval 1 -MaxSamples 60This captures one-second samples for a minute. The cumulative CPU value from Get-Process is not a measure of a brief spike by itself, so compare repeated samples or use Performance Monitor, Windows Performance Recorder/Analyzer, or Sysinternals tools for attribution.
#1 Best Overall
- [Brand Overview] Thermalright is a Taiwan brand with more than 20 years of development. It has a certain popularity in the domestic and foreign markets and has a pivotal influence in the player market. We have been focusing on the research and development of computer accessories. R & D product lines include: CPU air-cooled radiator, case fan, thermal silicone pad, thermal silicone grease, CPU fan controller, anti falling off mounting bracket, support mounting bracket and other commodities
- [Product specification] Thermalright PA120 SE; CPU Cooler dimensions: 125(L)x135(W)x155(H)mm (4.92x5.31x6.1 inch); heat sink material: aluminum, CPU cooler is equipped with metal fasteners of Intel & AMD platform to achieve better installation, double tower cooling is stronger（(Note:Please check your case and motherboard for compatibility with this size cooler.）
- 【2 PWM Fans】TL-C12C; Standard size PWM fan:120x120x25mm (4.72x4.72x0.98 inches); fan speed (RPM):1550rpm±10%; power port: 4pin; Voltage:12V; Air flow:66.17CFM(MAX); Noise Level≤25.6dB(A), leave room for memory-chip(RAM), so that installation of ice cooler cpu is unrestricted
- 【AGHP technique】6×6mm heat pipes apply AGHP technique, Solve the Inverse gravity effect caused by vertical / horizontal orientation, 6 pure copper sintered heat pipes & PWM fan & Pure copper base&Full electroplating reflow welding process, When CPU cooler works, match with pwm fans, aim to extreme CPU cooling performance
- 【Compatibility】The CPU cooler Socket supports: Intel:115X/1200/1700/17XX AMD:AM4;AM5; For different CPU socket platforms, corresponding mounting plate or fastener parts are provided（Note: Toinstall the AMD platform, you need to use the original motherboard's built-in backplanefor installation, which is not included with this product)
Common clues:
| Process at the spike | Where to look first |
|---|---|
CcmExec.exe |
Client activity and policy in CcmExec.log; determine what action it launched. |
powershell.exe, wscript.exe, or cscript.exe |
Baseline discovery/remediation, Configuration Manager scripts, application detection, and command line. |
WmiPrvSE.exe |
Inventory provider or custom WMI query; identify the provider/namespace before blaming WMI generally. |
msiexec.exe |
Application enforcement, installer repair, or a deployment detection/retry loop; inspect AppEnforce.log. |
TiWorker.exe or Windows Update-related svchost.exe |
Windows servicing or update scanning, not necessarily the Configuration Manager client. |
w3wp.exe |
On a site server, identify its IIS application pool; investigate WSUS/SUP if it is WsusPool. |
smsexec.exe |
Site-server components, inboxes, and database activity; check component status and dataldr.log where relevant. |
sqlservr.exe |
SQL workload and waits, including Configuration Manager or WSUS database processing. |
Also check whether antivirus or EDR is scanning the Configuration Manager cache or temporary content. It may be the actual CPU consumer even when its activity coincides with a client operation.
2. Establish whether it is client-side or site-server-side
On an endpoint, the usual log directory is C:WindowsCCMLogs. On a site server, use the site-server log directory and the component-specific logs. Open logs with CMTrace and correlate entries against the spike timestamps. Microsoft’s Configuration Manager log reference describes these logs; available logs vary by installed features and product version.
| Activity | Useful logs |
|---|---|
| General client activity and SMS Agent Host | CcmExec.log |
| Configuration items, baselines, and remediation | DCMAgent.log, CIAgent.log |
| Configuration Manager script execution | Scripts.log |
| Policy evaluation | PolicyEvaluator.log |
| Client hardware inventory | InventoryAgent.log, InventoryProvider.log; sometimes Mifprovider.log or FileSystemFile.log for specific inventory paths |
| Application installation or enforcement | AppEnforce.log |
| Client software-update activity | WUAHandler.log, ScanAgent.log, UpdatesDeployment.log, UpdatesHandler.log, LocationServices.log, ContentTransferManager.log |
| Site-server hardware-inventory processing | dataldr.log, inbox activity |
| Management-point availability | mpcontrol.log |
mpcontrol.log records management-point availability checks every 10 minutes, according to Microsoft’s log documentation. That timestamp pattern alone does not show that the management point caused the CPU spike.
You can search relevant client logs for activity near the incident, but review the surrounding entries rather than treating a keyword match as proof:
Rank #2
- Cool for R7 | i7: Four heat pipes and a copper base ensure optimal cooling performance for AMD R7 and Intel i7.
- Quiet Cooling Fan: SickleFlow 120 Edge with Dynamic PWM control (690–2,500 RPM), designed for low noise and peak cooling performance.
- Simplify Brackets: Redesigned brackets simplify installation on AM5 and LGA 1851|1700 platforms.
- Versatile Compatibility: 152mm tall design offers performance with wide chassis compatibility.
- Easy Installation: Easy to install with included thermal paste for hassle-free setup and optimal cooling performance.
$logs = @(
"$env:WINDIRCCMLogsCcmExec.log",
"$env:WINDIRCCMLogsDCMAgent.log",
"$env:WINDIRCCMLogsCIAgent.log",
"$env:WINDIRCCMLogsInventoryAgent.log",
"$env:WINDIRCCMLogsInventoryProvider.log",
"$env:WINDIRCCMLogsScripts.log",
"$env:WINDIRCCMLogsPolicyEvaluator.log",
"$env:WINDIRCCMLogsAppEnforce.log"
)
Select-String -Path $logs -Pattern `
'start|evaluation|remediation|retry|failed|timeout|inventory|execution'Compare timestamps carefully: client and server logs may use different time zones or formats, and work may be queued or reported asynchronously.
3. Check compliance baselines and scripts early
A baseline can launch discovery or remediation scripts that query WMI, enumerate files or registry entries, inspect software, restart services, or repeatedly make a change another policy reverses. Multiple baselines may contain the same costly check. A real-world community report matching this symptom found that lengthening a baseline interval stopped the spikes, but this is not a Microsoft-confirmed universal cause (reported case).
Inspect deployed baselines and their configuration items under Assets and Compliance > Compliance Settings. Check both the baseline evaluation schedule and the discovery/remediation logic. Look for full-disk scans, broad WMI queries, scripts without practical time limits, repeated installer calls, or a remediation that never leaves the item compliant. Then match script start times and process ancestry to DCMAgent.log, CIAgent.log, and Scripts.log.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Test narrowly: move the suspected baseline to a test collection, or change only its interval or one suspected item. Observe several expected recurrence periods. Confirm that CPU drops and compliance reporting remains fresh enough for the business requirement before broadening the change. Do not disable every baseline simply because CcmExec.exe appears somewhere in the process tree.
Rank #3
- CONTACT FRAME FOR INTEL LGA1851 | LGA1700: Optimized contact pressure distribution for longer CPU life and better heat dissipation
- ARCTIC's P12 PRO FAN: More power at any speed - more powerful and quieter than the P12, especially at low speeds. Higher maximum speed for optimal cooling performance under high load
- NATIVE OFFSET MOUNTING FOR INTEL AND AMD: Shifting the cold plate center towards the CPU hotspot ensures more efficient heat transfer
- INTEGRATED VRM FAN: PWM-controlled fan that lowers the temperature of the voltage converters and thus ensures reliable performance
- INTEGRATED CABLE MANAGEMENT: The PWM cables of the radiator fans are integrated in the sheathing of the hoses so that only a single visible cable is connected to the motherboard
4. Review configured schedules, not just defaults
Inspect the effective client settings delivered to the device in the console at Administration > Client Settings, including higher-priority custom settings. Review compliance evaluation, hardware and software inventory, software updates, application deployment evaluation, policy polling, and any custom script or remediation schedule. Also check Monitoring > Deployments for repeatedly failing required applications, packages, task sequences, or updates.
Microsoft documents a default client policy polling interval of 60 minutes and typical default hardware inventory, software inventory, and software metering schedules of seven days. These defaults are configurable; a particular deployment or custom task can run more often. Thus an exact ten-minute recurrence is more suggestive of a custom schedule, retries, remediation, or an external component than the normal default inventory schedule. See Microsoft’s client settings documentation. Aggressive re-evaluation can affect client and network performance; Microsoft cautions against lowering the default software-deployment re-evaluation interval without monitoring the result.
Check Windows Task Scheduler for vendor-created inventory, repair, or PowerShell tasks as well as Configuration Manager health tasks. Inspect installed monitoring agents, endpoint-management extensions, and other third-party integrations. A management tool may be scheduling work that happens to involve Configuration Manager.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →5. Distinguish client inventory from site-server inventory backlogs
On a client, inventory load may stem from too many enabled classes, a custom WMI provider that is slow or failing, oversized custom data, file/registry inventory over a broad scope, or repeated inventory errors. Check InventoryAgent.log and InventoryProvider.log around the spike; narrow or test custom classes and rules rather than disabling all inventory.
Rank #4
- [Brand Overview] Thermalright is a Taiwan brand with more than 20 years of development. It has a certain popularity in the domestic and foreign markets and has a pivotal influence in the player market. We have been focusing on the research and development of computer accessories. R & D product lines include: CPU air-cooled radiator, case fan, thermal silicone pad, thermal silicone grease, CPU fan controller, anti falling off mounting bracket, support mounting bracket and other commodities
- [Product specification]AX120R SE; CPU Cooler dimensions: 125(L)x71(W)x148(H)mm (4.92x2.8x 5.83 inch); Product weight:0.645kg(1.42lb); heat sink material: aluminum, CPU cooler is equipped with metal fasteners of Intel & AMD platform to achieve better installation
- 【PWM Fans】TL-C12C; Standard size PWM fan:120x120x25mm (4.72x4.72x0.98 inches); fan speed (RPM):1550rpm±10%; power port: 4pin; Voltage:12V; Air flow:66.17CFM(MAX); Noise Level≤25.6dB(A), the fan pairs efficient cool with low-noise-level, providing you an environment with both efficient cool and true quietness
- 【AGHP technique】4×6mm heat pipes apply AGHP technique, Solve the Inverse gravity effect caused by vertical / horizontal orientation. Up to 20000 hours of industrial service life, S-FDB bearings ensure long service life of air-cooler radiators. UL class a safety insulation low-grade, industrial strength PBT + PC material to create high-quality products for you. The height is 148mm, Suitable for medium-sized computer case
- 【Compatibility】The CPU cooler Socket supports: Intel:1150/1151/1155/1156/1200/1700/17XX/1851,AMD:AM4 /AM5; For different CPU socket platforms, corresponding mounting plate or fastener parts are provided
On a site server, a different failure mode is possible: Microsoft documents sustained SMSExec.exe CPU when hardware-inventory processing fails and MIF files accumulate in inboxesauthdataldr.boxprocess. Check dataldr.log, inbox file counts, and component status. The Microsoft troubleshooting article also identifies an unusually high ArchitectureMap.NextGroupKey value as a diagnostic clue (hardware-inventory failure troubleshooting).
Resolve the provider or schema issue, remove unnecessary custom inventory, or reduce broad file and registry collection as appropriate. Back up the site database before any database-level correction. Do not delete inbox files or edit Configuration Manager database tables without Microsoft Support guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Investigate software updates, WSUS, IIS, and SQL separately
If the spike is on a client, determine whether it aligns with update scanning, deployment evaluation, download, or installation using the update logs listed above. A failed deployment, update scan, or detection method may repeat or be re-evaluated; compare client logs with deployment status and server-side activity.
Recommended Free Tools
If the spike is on the site server, check whether w3wp.exe belongs to the WSUS application pool, commonly WsusPool, and whether its CPU aligns with synchronization, IIS requests, client scan activity, or SQL work. Review Software Update Point synchronization status, WSUS database maintenance and size, update revisions, SQL CPU/waits, and failed synchronizations or timeouts. In IIS Manager, identify the pool before changing its limits.
Best Value
- [5-inch IPS LCD Screen] The radiator features a magnetic top cover with a built-in display, offering a resolution of 480x854. It allows real-time monitoring of various system parameters and, combined with the TRCC control software, supports custom background themes for personalized display.
- [Excellent Cooling Performance] The CPU cooler is primarily composed of a dual-tower design, two fans, and a magnetically attached top cover featuring a 5-inch IPS LCD screen. Six pure copper heat pipes paired with a nickel-plated copper base ensure optimal contact with the CPU. Combined with a high-speed rotation of 2150 RPM, this configuration delivers superior cooling efficiency for the heatsink.
- [Heatsink Specifications] Overall dimensions of the CPU cooler: 125x135x164mm (LxWxH), fan dimensions: 120x120x25mm, fan speed: 2150 RPM±10%, airflow: 69 CFM, operating noise ≤27 dB(A), fan power interface: 4-pin PWM, RGB interface: 5V 3-pin ARGB. The dual fans included with the heatsink feature S-FDB V2 bearings, known for their longevity, ensuring sustained cooling performance over time.
- [AGHP Heat Pipe Technology] The 6x6mm heat pipes utilize AGHP Gen 5.0 technology, effectively countering the adverse effects of gravity in both vertical and horizontal orientations. The pure copper heat pipes, combined with a nickel-plated micro-engraved copper base via reflow soldering, enhance cooling performance across dual platforms while accommodating GPU and RAM clearance with a designed offset.
- [164mm Height] The heatsink cooler stands at 164mm in height, ensuring compatibility with mainstream ATX cases. The cooling towers feature a matte black coating, while the magnetic top cover incorporates a display screen, blending high-performance cooling with innovative design. The dual-tower, dual-fan layout is engineered for seamless compatibility with tall RAM heat spreaders and GPU installations.
A historical community case involving SCCM 1702 reported ten-minute CPU spikes in the WSUS IIS pool and discussed memory limits and CPU throttling (case report). It is old-version evidence, not a current universal fix or a basis for changing WSUS ports, private-memory limits, or throttling on a current system. First establish whether IIS, synchronization, client scans, or SQL is actually responsible. Throttling can reduce peak CPU while making synchronization take longer.
7. Make the smallest justified change, then verify
- Capture evidence: Record the affected host, process, parent, command line, CPU timestamps, and relevant log entries.
- Match action to schedule: Identify the baseline, inventory class, deployment, update scan, scheduled task, or server component at those times.
- Test one change: In a test collection or on a representative server, reschedule or disable only the suspected workload. If necessary, optimize its script or narrow its inventory scope.
- Observe several cycles: Confirm the spikes stop across multiple recurrence periods and that the targeted action still completes.
- Check side effects: Verify compliance and inventory freshness, deployment success, and that site-server inboxes are not accumulating work.
- Expand carefully: If the test succeeds, apply the change to a limited production group first and monitor before wider rollout.
Less frequent evaluation reduces load but delays detection or remediation. Disabling inventory can affect reports, collections, or compliance rules that depend on it. Repair or reinstall the client only when evidence shows damaged client state or failed health checks, not as a first response to an unidentified scheduled workload. Microsoft’s client health-check guidance describes checks involving SMS Agent Host and the CcmEval scheduled task.
For site-server CPU that remains high, growing inventory inboxes, persistent WSUS/database failures, or a suspected product defect on a supported branch, escalate with logs and timestamps to Microsoft Support. Avoid restarting services or manually triggering cycles before capturing evidence; both can temporarily change symptoms or add workload.
Quick Recap
Quick diagnosis matrix
| Evidence | Confirm with | Likely next step |
|---|---|---|
| PowerShell/WMI process at repeat intervals | Parent process, command line, baseline logs | Test the specific baseline or script; lengthen schedule or optimize query. |
| Client inventory runs slowly or errors | InventoryAgent.log, InventoryProvider.log |
Narrow custom classes/rules or correct the provider. |
SMSExec.exe high on site server plus MIF backlog |
dataldr.log and dataldr.boxprocess growth |
Resolve inventory processing failure; avoid deleting files or direct DB edits. |
w3wp.exe high on site server |
IIS pool identity, WSUS sync and SQL timing | Diagnose the actual WSUS/IIS/SQL workload before changing pool settings. |
msiexec.exe repeatedly starts |
AppEnforce.log, deployment status, detection method |
Correct the failed install or detection/remediation loop. |
Only mpcontrol.log has ten-minute entries |
Process samples and other logs | Do not infer CPU causation from the health-check cadence. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
