7

After not safely removing a flash drive a few years ago, I lost all of my data on a drive. Luckily I was able to find a data recovery program to restore the data, but it was a time consuming process. Since then I have always practiced safely removing drives, but occasionally get the error that the drive is still in use by a program. The problem has been happening much more frequently on my Win 10 PC the last few months.

The message that the drive is still in use comes up despite not having any applications open, so I started reading up on how to find out what background process is causing the problem. I read a little about the Systeminternals suite and downloaded it, found the logs for the error messages, and the process, which turned out to be the system. I then looked at the thread, and found what I think is the process associated with the problem.

As it turns out, it's the same thing every time I have the problem, regardless of which flash drive the problem occurs with:

"ntoskrnl.exe!SeAccessCheckWithHint+0x1c620"

I know ntoskrnl.exe is the kernel, but I'm trying to find out what the "!SeAccessCheckWithHint+0x1c620" means?

How can I go about finding more information as to what it is doing with my drives to prevent them from being safely ejected? (if the answer is a memory dump, which type, and how would I research the results of it)

How can fix the problem, aside from updates (I've done all of my Windows updates, and driver updates), and aside from restarting the computer each time this happens?

If the problem potentially related to the drive being indexed by the system, will I have to turn indexing off each time I plug the drive in or is there a way to make the system stop indexing all removable drives? Thank you,

JD21763
  • 71
  • 1
  • 2
  • Same solution is here https://superuser.com/questions/965549/high-cpu-from-ntoskrnl-exe-during-idle-on-getstacklimits – gavenkoa Aug 04 '22 at 09:59

3 Answers3

9

Task Scheduler:

\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic and \Microsoft\Windows\Defrag

run from background tasks Security and Maintenance - Automatic Maintenance

causes ntoskrnl.exe!SeAccessCheckWithHint+0x1c620

Try to disable defrag on this flash drive.

In my laptop i turned off the RunFullMemoryDiagnostic task because they were using 20% ​​cpu when idle.

chasm
  • 111
  • 1
  • 3
  • Why did you submit the same exact answer that was already deleted once? – Ramhound Mar 02 '21 at 14:29
  • If you have edited your answer to make it suitable then in future please flag it to be undeleted rather than simply reposting it. – Mokubai Mar 02 '21 at 15:23
  • 6
    Please upvote this answer. It should be the accepted answer, because it solved my problem when I had the System process running and consuming CPU for no apparent reason with a thread showing to constantly be in the SeAccessCheckWithHint() call. – Michael Goldshteyn Jul 07 '21 at 14:56
  • Solved also my problem, after many unhelpful results online. Thank you! – Shlomi A Nov 02 '21 at 14:15
  • 2
    Disabling RunFullMemoryDiagnostic in Task Scheduler resolved it for me! I wish I could tip you @chasm! – adfaklsdjf Dec 25 '21 at 14:38
  • 2022 update: Windows 10 does not defrag SSD, instead it trims it. It's bad for SSD not to trim it in the long term. But According to @adfaklsdjf, stopping Windows from doing full memory diagnostic during idle time saves my laptop from going overheated. – Yvon Apr 16 '22 at 01:13
  • @Yvon the memory diagnostic is not doing trim on SSDs.. the filesystem does that when you delete files. This is about RAM, not disk storage (hard drive or SSD). – adfaklsdjf Apr 17 '22 at 21:12
  • 2
    @adfaklsdjf Yes that's what I meant to say, because the answer above says to disable both memory diagnostic for RAM and defrag for SSD. I only did the first, and it was successful. – Yvon Apr 18 '22 at 02:38
  • My laptop was running the fans pretty hard when it didn't seem like it should be. I saw the "System" process using a lot of CPU, the Process Explorer threads tab pointed me to "SeAccessCheckWithHint", which led me to this post. Checked Task Scheduler and saw that the memory diagnostic task was actually presently running. Killed it and the "System" process immediately went back down to low CPU use. +1, I'm keeping that task disabled from now on. – Truisms Hounds Aug 01 '22 at 17:16
0

From late 2020 I had also been having the "ntoskrnl.exe !SeAccessCheckWith Hint+0x1c620" issue with multiple threads causing the System process to consume 5%-20% of the CPUs all day every day.

After the recent upgrade to Windows 10 21H2 the problem went away. But it came back as "ntoskrnl.exe !SeAccessCheckWith Hint+0x1c790" about 30 minutes later. Same bazillion threads constantly spawning and gobbling up CPU. Grrrrr!

I went back and tried all other suggestions I had tried before: disabling Windows Search service, disabling the Automatic Maintenance Tasks mentioned above, Dism /Online /Cleanup-Image /RestoreHealth etc. etc. Nothing changed.

Several days back I stumbled on a fix that works for me. The System process now hovers between 0%-3% CPU like it used to. All I did was put a CD into the DVD drive. Bizarre.

There was no methodical troubleshooting involved here, I was just tidying my desk and found an unlabelled CD and wondered what was on it. After inserting the CD I saw my Rainmeter CPU graph quickly drop to 1%.

I have had the LG DVD-RAM SATA multi-drive for a long time (since Vista days) and it works just fine although it isn't used very often these days. I have never set the DVD Region because I don't use the drive to play DVDs. My guess is that something changed in how autorun works in Windows 10 20H2, or, the drive has developed a problem sensing when no media is present.

I have been able to reproduce the error by ejecting the CD, opening File Explorer, a few minutes later the System process goes nuts. Put a CD in the drive and a few minutes later the System process idles as normal.

A data CD or audio CD works.

rixtech
  • 9
  • 1
0

In my case, it turned out to be... corrupt system restore. Turned off and deleted all restore points before turning back on.

I discovered this by watching task manager launch windows system protection just before the SYSTEM CPU usage jump.

ntoskrnl.exe seaccesscheckwithhint+0x1c790 High System after 10 minutes

Next step would have been to delete the systemvolumeinformation folder from winpe.

Col32n
  • 1
  • 1
  • 1
    As it’s currently written, your answer is unclear. Please [edit] to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Aug 25 '22 at 08:46
  • As you (presumably) aren't the OP, shouldn't you qualify your first line with "In my case, it turned out to be..."? – Greenonline Aug 25 '22 at 14:31