The Windows Server 2008-2012 Domain Controller Security template is comprised of two PowerShell component monitors and several Windows Event Log Monitors. Can you try either disabling just the PowerShell component monitors, or changing the polling method of the Windows Event Log Monitors from WMI to RPC, and report back if either of those options reduces the CPU load on the monitored server?
↧