CSA: svchost runs msiexec

[wyley.johnson]

I have noticed that when a windows update occurs, svchost.exe tries to run msiexec. If this is denied, svchost utilizes a large amount of memory and CPU usage jumps to 90%. Is there anyway around creating an exception for this activity except for limiting to only the specific user (i believe it is 'system')?

[tsteger1]

In order to allow WSUS or other patch management tools to install MS Office and other MSI type updates without user intervention, you'll have to allow MS svchost.exe to execute msiexec.exe.

Tom