Identify when ShellExperienceHost uses > 24% CPU

There was an unidentified update between July 3-17, 2018. Something updated but left ShellExperienceHost.exe File version 10.0.14393.447, Date modified 56/2018.

The problem is this version uses >24% CPU and never reverts to the Suspended mode as it should. I have to launch Process Explorer in Admin mode and manually suspend it.

I have searched high and low since July and found the same thing repeatedly, Update and reboot. That doesn’t work on a few of my servers.

Until I can rebuild them I need to find a way for LibreNMS to detect and trigger a powershell script to do the job. One kink that I face it that the PID is never the same.

Anyone have any ideas? Funny that I have to turn to an OpenSource piece of software running on Linux to tame Windows 2016.