Winlogon.exe at 50% or 100% CPU (Fix)

There are apparently a variety of things that can cause the winlogon.exe process on Windows PCs to consume all available CPU, but I’ve found few references to this cause – corruption in Offline Files, even when Offline Files is disabled on the PC, on the server and on the domain (via Group Policy). Depending on the age of the PC, this will consume either 50% of the CPU (on newer dual-core systems) or 100% of the CPU (on older systems). This is the only non-malware winlogon.exe problem that I recall personally encountering.

Update: The original title & article indicated that this applied to Windows PCs on domains only, but Offline Files is available to non-domain PCs as well as long as Fast User Switching is not turned on.

I haven’t gone through to track exactly what’s causing the problem, just identified it as an Offline Files problem. We disable Offline Files for systems we’re configuring so individual PCs shouldn’t be caching them, but every once in a while a Windows XP box will decide that it needs to be doing something. The symptoms can include either all available disk space being consumed by the C:\Windows\CSC (technically, %windir%\CSC) or winlogon.exe going into a loop that interferes with use of the system.

While Microsoft provides instructions and a mechanism to Re-initialize the offline files cache and database, following those instructions has never worked for me – possibly because the systems I’m encountering are having problems despite Offline Files being disabled.

For me, the solution has been to do the unthinkable, go against all available instructions, and simply delete the entire contents of the C:\Windows\CSC directory (from Safe Mode if necessary).

Reportedly deleting the CSC folder’s contents breaks Offline Files in ways that can’t be recovered from, but that’s not a concern for me because we aren’t using that feature and have no expectation of doing so (also, I suspect that it actually is possible to recover from this without having to reinstall Windows – possibly as easily as dropping from the Domain & rejoining). We have very few users with laptops, even fewer that need access to office files on laptops while outside the office, and none where having patient information on local laptop drives outside the office is a good idea.

[contact-form-7 404 "Not Found"]

13 comments to Winlogon.exe at 50% or 100% CPU (Fix)

  • Based on other things I’ve seen, this error may not require that a PC be on the domain but it is likely to only happen when users are using traditional logins (Ctrl-Alt-Del, enter their username and password) because Offline Files is not compatible with Fast User Switching (where you click on a list of users on the Welcome screen).

  • Isaac

    WOW thank you for the post (and for Google for finding this post).
    I have been banging my head against the wall removing hardware, MSIE and any component I have installed recently.
    This really did the trick.
    Thanks!

  • Viebie

    Thank you Alan, you are a genius!

    • Glad it was helpful. I expect to do either a more in-depth article or at least a collection of links on ways to track down problems like this. The Sysinternals folks, forums and tools (now at Microsoft) are probably the best place to start for tracking down problems like this.

  • steve

    Awesome – it works!!
    Been having problems for ages!

  • Kevin Gooder

    I do not see a windows/CSC directory on my windows XP home edition operating system. I have the winlogon.exe file chewing up my cpu time. Any other suggestions?

    Thanks,
    Kevin

  • Brad

    Kevin:

    If you don’t see the c:\Windows\CSC directory, it could be hidden. Just enable hidden files & folders.

  • Andrew

    Thanks, this really helped. Winlogon.exe was at 45% of CPU. We do use offline files so I went into Offline Files tab in Windows Explorer Folder Options and deleted all files. It went down to 22%, but it could not delete one file which was in use. I turned offline files off and WinLogon.exe CPU went to 0%. I turned it back on and it stayed at 0%. (This was XP SP2.)

    • Glad this helped. One suggestion: unless it’s a PC that’s disconnected from the ‘net completely, I’d strongly recommend updating to SP3. Support for SP2 (including security fixes) stopped some time ago.

  • Brian Hinton

    This also worked for me, however, if xp doesnt show the CSC folder even though you show hidden files, just type it in and it will go to the directory. C:\Windows\CSC

  • This did help solve part of my problem:
    runing windows 7 professional on a toshiba satellite c660,
    about a month ago, started hanging during booting and it started having sound spikes,skipping and distortions on al processes, {mainly sound related} that i tried running that suggested an overload on the CPU, on checking the task manager, i found winlogon.exe and csrss.exe both had a high priority set , which could not be normalised..in addition to that, both processes do not have a description or the username indicated.Had tried alot of stuff out there in forums including:antivirus update,change/spyware,online scans, disabling realtek’s sound features/ clean windows install/drivers update etc nothing worked.
    After deleting the ofline files, my sound is now stable…no more distortion..plus boot time is restored to normal thanx again
    Now am concerned about the fact that the two processes mentioned above do not hav a description and username whereas when i boot in safemode, they are available + their priorities are still at high, please help me out.thanx alot.

  • Gaurav

    Well on my laptom ofline files option was disable, i enabled it then only found the CSC folder. I Went to C:/windows/CSC folder and delete all he content. Still problem is not resolved. WINLOGON.EXE is still taking 99% of CPU and my laptop (with XP Professinal ser pack 2) is running dead slow Please help ASAP, my laptop is useless becoz of this problem

  • nathan

    in windows xp, if you cant see the csc folder after enabling view hidden folders, there is another option at the bottom that says hide system files, take that checkmark out too, and you will be able to see it

Leave a Reply

 

 

 

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>