Monitoring CPU on workstations

This article explains how to monitor CPU usage on Windows 10 computers and generate an alert and process dump when it exceeds 80%.

First, I had to import these MPs:

Name	Version	Sealed
Microsoft.Windows.Client.Win10	10.0.0.2	True
Microsoft.Windows.Client.Win10.Aggregate	10.0.0.2	True
Microsoft.Windows.Client.Win10.BusinessCritical	10.0.0.2	False
Microsoft.Windows.Client.Win10.Monitoring	10.0.0.2	True

I didn't have a lot of time to test this but in a nutshell some things don't work out-of-the-box as you'd expect. There's a thing called Business Critical client monitoring that involves adding computers to a group. I tried that and got weird results and because of time, I just ended up enabling the Microsoft.Windows.Client.Win10.Processor.CPUUtilization monitor that targets the Microsoft.Windows.Client.Win10.Processor class.

I initially tried the Microsoft.Windows.Server.10.0.OperatingSystem.TotalCPUUtilization monitor but it wouldn't alert even with a 20% usage threshold and queue length at 0.

The next problem was that I wanted to get a dump of CPU usage by process like the high CPU monitor for server OSs. Lo and behold the diagnostic that does that isn't included in the high CPU monitor for workstations.

To overcome this, I created an unsealed mp called  Microsoft.Windows.Client.Win10.Monitoring.Overrides and added this diagnostic to it:

<Diagnostic ID="Microsoft.Windows.Client.Win10.Processor.TopCPUUsage.Diagnostic" Comment="List Top CPU Consuming processes." Accessibility="Public" Enabled="true" Target="Windows1!Microsoft.Windows.Client.Win10.Processor" Monitor="Windows2!Microsoft.Windows.Client.Win10.Processor.CPUUtilization" ExecuteOnState="Error" Remotable="true" Timeout="300">
<Category>Maintenance</Category>
<ProbeAction ID="PA" TypeID="WindowsServer!Microsoft.Windows.Server.TopCPUUsage.ProbeAction.PowerShell">
<IntervalMilliseconds>2000</IntervalMilliseconds>
<NumSamples>5</NumSamples>
</ProbeAction>
</Diagnostic>

You also need to add these references:

<Reference Alias="Windows2">
<ID>Microsoft.Windows.Client.Win10.Monitoring</ID>
<Version>10.0.0.2</Version>
<PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
</Reference>

<Reference Alias="WindowsServer">
<ID>Microsoft.Windows.Server.Library</ID>
<Version>10.1.0.6</Version>
<PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
</Reference>

<Reference Alias="Windows1">
<ID>Microsoft.Windows.Client.Win10</ID>
<Version>10.0.0.2</Version>
<PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
</Reference>

I'm actually surprised this worked. This is using the existing probe action module that server OSs use for the high CPU monitor. All I had to do was give it a unique ID and point it to the monitor I wanted the diagnostic to run in and set the class to the same as the monitor class and it worked a treat.