cpu usage - Windows 10 System (ntoskrnl.exe) using CPU when machine has been idle for a while

I noticed that my laptop's CPU starts getting used (maybe 15% usage?) and the CPU fan turns on, generally in the evening when my laptop has been idle for 5 minutes or so. The process using the CPU was System which doesn't tell me a lot so I decided to leave Process Explorer running and monitoring threads for System. It started using CPU again and this is what I found:

The thread eating the CPU after a few minutes of idle had the start address ntoskrnl.exe!RtlAvlRemoveNode+0x7ba0. So it seems pretty core to the system. Does anyone know what might be causing this and/or how I could further diagnose it? I don't like my CPU fan spinning up like this and I would like to stop the system doing this.

I even disabled all scheduled tasks that are triggered on idle (finding them with PowerShell Get-ScheduledTask | Where-Object { $_.State -ne "Disabled" } | Select-Object TaskName, TaskPath, Triggers | Where-Object { $_.Triggers -match "MSFT_TaskIdleTrigger" }) and it still happens.

Answer

The thread's start address mentions RtlAvlRemoveNode. This is a function called through the ntoskrnl.exe. Rtl stands for Run-Time Library so (most likely and without get further into it) it gets called through a native application (which would be, for example, the autochk program). If you want to know more about the background there's a lot of information on this site. However it's only the start address, it's not necessary this function that causes the CPU time usage. Press the "stack" button to see the full call stack or use 3rd party tools like ProcessThreadsView.

You have two basic options:

• The trail and error approach: You disable applications for example through the Task Scheduler / Safe mode etc. hoping to disable the right application. (Applications could be the screensaver, defrag, search index, etc. most likely but not necessarly something that is triggered by the PC being idle)




• The analytical approach: You run further analysis to pinpoint the problem for example by further analysing the thread in question or using "Windows Performance Toolkit" to further identify the application that causes the CPU usage

Since the analytical approach has quite a lot of overhead - knowledge wise - I would suggest the trail and error approach. Although it's just educated guessing it's most likely you are not the only one having the problem, so trying out most common solutions should be a good approach.

If you don't get anywhere by trail and error you will have to switch to a more analytical approach. As HoD suggested in his comment, Windows Performance Toolkit is a good next step here. Once you have more information or run into specific trouble you can further specify you're question so we'll be able to help you.

There is also the chance this behaviour is caused by something like malware, bugs, problematic updates etc. please take that into account, especially if you use the trail and error method.