This time it is in our development environment. We are integrating with an external report engine and one of my tasks is to look at some performance statistics to see if we need extra hardware to support the report services. The reporting engine is still a 32-bit process so I wrote a bit of code to thunk down from our 64-bit .Net code to 32-bit before calling the reporting service.
After that I hook up our test/performance harness to make the system run 100 reports. That CPU was under siege for well over 10 minutes. After same tuning and monitoring I realized the CPU was not spent in the reporting process (nor our application services for that matter), it was the 64-bit version of rundll32.exe. Out comes the Sysinternals Process viewer. It turns out rundll32 was running:
rundll32.exe ntprint.dll "printer name"
The process is trying to install a printer. I tried it manually and we don't have the printer driver locally. So I guess this process failed repeatedly but kept trying. I looked up some documentation and found the option to turn off the printing portion of the report and everything works like charm. Just another day in the office...