Resolution: Uninstall Windows Defender Application Guard UWP and Server.
I recently ran into an issue where every time I started my Work Windows 10 laptop the fan would kick on high. Glancing quickly at Task Manager I could always see VMMEM and vmwp.exe (Virtual Machine Worker Process) chugging away and eating the CPU and battery.
What is VMMEM?
The vmmem process is a virtual process that the system synthesizes to represent the memory and CPU resources consumed by your virtual machines. In other words, if you see vmmem consuming a lot of memory and CPU resources, then that means your virtual machines are consuming a lot of memory and CPU resources.
Virtual Machines Running?
Very odd as I have ZERO Hyper-V machines running
Hmm perhaps it is Windows Sandbox?
- Turn Windows Features On and Off (upper left)
- Windows Sandbox
Nope that is disabled as well
Well what is causing the issue? Hmm maybe it is a performance issue?
Maybe I am having a Performance Issue?
Side Note: reporting on counters is easy but not very good at root cause. See day job.
- Admin CMD prompt
- Perfmon / report
Hmm looks like I have a bad service. MSDTC is failed. Well that could cause some memory issues and VMMEM is perhaps related. Lets fix that. What you are supposed to do is dig through the EventView (great powershell queries exist for that)… or you could try the oldest trick in the book!
Cool well I fixed something that was broken. That’s nice. Still have the high process usage.
Nuclear Option – Hard core root cause
Shutdown the Hyper-V service
Net stop vmcompute
This will tell you all dependent processes.
Oh look VMMEM utilization is at dead stop! What is the root cause?
Windows Defender Application Guard
Turning this off required a reboot and did resolve the VMMEM process running at startup.
Next up. Why?
Looks like it was a UWP application
Windows Defender Application Guard Companion – https://www.microsoft.com/en-us/p/windows-defender-application-guard-companion/9n8gnlc8z9c8?activetab=pivot:overviewtab
Another interesting thread
Windows Defender Application Guard (WDAG) was absolutely the root cause. However, just disabling is only the first part of research. Anyone know a way to enable the feature without the CPU and battery drain?