High CPU (IIS process) in Exchange 2016 VM server

Identify what is killing the CPU. I recommend Process Explorer http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Identify what AppPool is causing this
Fix your code

In terms of diagnosing what App Pool is causing trouble, you can:

Select the server
Go to IIS > Worker Processes

Hi, when the issue occured, I event could not do a remote access to that server.

I thought the code is default from Microsoft?

Hello,

how many vCPU is assigned to the virtual server and how much memory?

It validates within the operating system that the process consumes a greater amount of processor.

Run a monitor performance inside the server.

I remain attentive to your comments..

Hi, it has 40 core (2 x 20) and 80 GB RAM

Good Morning

80 GB of RAm for a server is much, first because the VM never consumes all the ram that is assigned.

Since the hypervisor assigns RAM to other VMs that require it.

I recommend lowering the amount of RAM to the server as well as the amount of vCPU.

Of equal I recommend to execute before a performance monitor in the operating system to validate how much resources you are consuming and it is very important that you do it.

I remain attentive to your comments...

regards..

Is there any chance for this plan?
- Open a port in Mail server
- Attack that server (ie: TCP half sync on that port), so CPU is increased

then leading to a kind of DoS

Some Tips for High CPU issues :

https://blogs.technet.microsoft.com/exchange/2015/04/30/troubleshooting-high-cpu-utilization-issues-in-exchange-2013/

Hi, it seems like we was attacked inside LAN via hping3 tool. After some research, I simulated the attack with the same symptoms.

So how can we avoid it in the future?

ps: Not sure the attacker is from our IT team or other Department

configure your firewalls , anti-virus ,Policies  ...etc to stop scanning tools

Also, in the System Event viewer, I saw this one:

The name "MAIL           :0" could not be registered on the interface with IP address 192.168.55.21. The computer with the IP address 192.168.55.31 did not allow the name to be claimed by this computer.

Select allOpen in new window

.21's name is mail.domainA.com
.31's name is mail.domainB.com

Please run the exchange calculator to properly size the server, throwing resources won't fix the issue. Too much means longer startup etc.

Try using wire shark to check the traffic going in and out of the machine.

Also if you have Av installed, make sure the exclusions are set

Hi, I'm installing Snort on Exchange server, should it be ok ?

Not sure if it can prevent the Ddos or other attacks (ie: DNS spoof, ARP poisoning...)