I don't reboot very often, maybe once or twice a month.
Over the past couple of months I've noticed that after reboots my Win 8.1 x64 MCE system runs one thread and does more or less continuous but low-rate I/O for some minutes (e.g. 15 or 20 minutes, after which it stops). I noticed it again after Windows Update dropped its load this week.
Today I did some reboots to try to diagnose this.
The process that's running is System, and it's using up one of the 24 logical processors (i.e., it shows a continuous roughly 4.2% CPU usage). After, say, 15 or 20 minutes of doing this the System CPU usage just drops suddenly to near-zero (e.g., 0.01%) and the system runs normally thereafter.
During the time System is running that thread I can't start such things as CHKDSK and System Restore. They just hang, then they proceed when whatever System is doing finally ends.
I've watched the Resource Monitor and the System process accesses the master file table of my system volume or backup drive (i.e., G:\$Mft),. I also saw it occasionally write to C:\Windows\System32\config\SOFTWARE.LOG1. But those may be coincidence - it's not consistently showing any disk or network access, even though the I/O is constant, so I suspect whatever I/O activity it is doing may be something like IOCtl calls. To do what, I don't know.
- My system is otherwise well-tuned and stable, and free of malware (verified with MalwareBytes Anti Malware), and I actually feel no significant impact from this - other than if I'd like to do a System Restore or something right after reboot I can't until it finishes.
- Nothing is logged in the System Event Log that gives any clue as to what it's doing or why it should be doing this.
- SFC /VERIFYONLY reports everything's healthy.
Could it be Windows Defender doing some kind of after-boot scan (though I'd expect that to busy MsMpEng, not System)? On my list of things to do is to disable Defender and see what changes.
This activity by the System process shows increasing I/O rates up to a point where it peaks, then it drops to zero and starts up again. Some of the increases are gradual and some quicker. Check out this oddball pattern of the thread's I/O rate, from Process Hacker:
It's clearly following an algorithm of some sort, and not random, as it does finally finish. Maybe some kind of cache compaction or... ???
My next step will be to set up the Windows Performance Recorder to see if it will shed more light on exactly what's being done.
Any other suggestions?