Resolution: Uninstall Windows Defender Application Guard UWP and Server.
I recently ran into an issue where every time I started my Work Windows 10 laptop the fan would kick on high. Glancing quickly at Task Manager I could always see VMMEM and vmwp.exe (Virtual Machine Worker Process) chugging away and eating the CPU and battery.
What is VMMEM?
The vmmem process is a virtual process that the system synthesizes to represent the memory and CPU resources consumed by your virtual machines. In other words, if you see vmmem consuming a lot of memory and CPU resources, then that means your virtual machines are consuming a lot of memory and CPU resources.
Virtual Machines Running?
Very odd as I have ZERO Hyper-V machines running
Hmm perhaps it is Windows Sandbox?
- Turn Windows Features On and Off (upper left)
- Windows Sandbox
Nope that is disabled as well
Well what is causing the issue? Hmm maybe it is a performance issue?
Maybe I am having a Performance Issue?
Side Note: reporting on counters is easy but not very good at root cause. See day job.
- Admin CMD prompt
- Perfmon / report
Hmm looks like I have a bad service. MSDTC is failed. Well that could cause some memory issues and VMMEM is perhaps related. Lets fix that. What you are supposed to do is dig through the EventView (great powershell queries exist for that)… or you could try the oldest trick in the book!
Cool well I fixed something that was broken. That’s nice. Still have the high process usage.
Nuclear Option – Hard core root cause
Shutdown the Hyper-V service
Net stop vmcompute
This will tell you all dependent processes.
Oh look VMMEM utilization is at dead stop! What is the root cause?
Windows Defender Application Guard
Overview of WDAG: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview
Turning this off required a reboot and did resolve the VMMEM process running at startup.
Next up. Why?
Looks like it was a UWP application
Windows Defender Application Guard Companion – https://www.microsoft.com/en-us/p/windows-defender-application-guard-companion/9n8gnlc8z9c8?activetab=pivot:overviewtab
Another interesting thread
Windows Defender Application Guard (WDAG) was absolutely the root cause. However, just disabling is only the first part of research. Anyone know a way to enable the feature without the CPU and battery drain?
8 comments on “Resolved: Excessive Persistent VMMEM CPU utilization”
I had this problem after using wsl, so this was helpful:
I was excited when I found this post. I was experiencing exactly the same: high CPU usage (20% or more) from VMMEM. Unfortunately, Windows Defender Application Guard was already turned off on my machine. I’d recently installed Docker plus turned on WSL (linux) on my Win 10 machine. I tried reversing all that. WSL removed, no Docker services running. VMMEM continued to churn the CPU. This was with no virtual machines running. I finally unchecked Hyper-V in “Turn Windows features on or off”, rebooted and that got rid of VMMEM. Posting my fix here in case someone else has similar experience and finds your post as I did.
LikeLiked by 1 person
Glad you fixed it. Did you by chance submit the bug via the feedback hub? We have been looking for a replication of this bug
I have reported this on feedback hub, as it is becomming very inconvenient for me. I’ve attached perf data so hopefully this will help towards the general problems in reaching a resolution.
The brief description in my report is here, hope it helps:
I experience this problem several times per wee. My laptop runs very slowly, the fan ramps up to full and it starts consuming large amounts of CPU, RAM and especially disk, it often becomes totally unresponsive for up to 30 seconds. Killing Docker Desktop and Hyper-V has no effect. A reboot is the only reliable solution as I’ve not been able to find the root cause after 30 mins and just don’t have the time to properly investigate and fix it. The reboots are quite disruptive as I have all sorts of documents open, Teams, Visual Studio, VS code, WSL, and lots of other tools too – it can take half an hour to save them all, restart and get them all back (and even longer for my concentration!)
I Have just noticed that Task Manager is telling me vmmem is using 100% disk and no RAM today!
In windows feedback hub (winkey+F) when you submit this bug or the one you have in the past. Please click the share button to your bug and send it to me. I can have Microsoft Engineering take a look at it.
Try to stop this Windows services: CmService & hvsics
I have the same issue and I found the root cause.
The root cause of my case is DockerDesktopVM. When I opened hyper-V manager I saw DockerDesktopVM is running. Then, I connected to this VM and saw “write failed” message repeating indefinitely. Looks like this VM is trying to write something and continuously failed.
How I solve this?
I open DockerDesktop application, and then DockerDesktopVM stop trying to write something. After that, I turned off DockerDesktop application, and then DockerDesktopVM shut down by itself. Finally, vmmem is gone.