TrustedInstaller.exe Takes a lot of Memory in Windows Server 2008

I was looking into this recently on a 2008 R2 server and below is what I found:

To see if trustedinstaller is doing anything have a look at c:\windows\logs\cbs\cbs.log.

If everything's good trustedinstaller should shut itself down after 10 minutes of inactivity.

In my situation I found that people leaving Server Manager open was keeping trustedinstaller running due to the "features summary" section that it displays and the default 2-minute refresh interval.

To check if this is your problem see if there are any mmc.exe processes running the server manager snap-in (add the command line column in task manager and look for servermanager.msc).

If there are then end them and watch for new entries being written to cbs.log.

If no new entries are being written to cbs.log then the trustedinstaller.exe process should shut down after 10 minutes.

If that works you could look at changing or disabling the server manager refresh (I haven't tried this yet but looks like it can be disabled for all users, see: Configure the refresh interval for Server Manager).

If you're still seeing new entries being written to the cbs.log after ending all server manager instances then suggest trying process monitor to track down the source (you may capture a script or something kicking off just before the cbs.log gets updated).

Hope this helps someone!

This blog post describes your exact scenario. There doesn't seem to be a smoking gun as to the cause just yet. The only real answer for now is plan for capacity and buy more RAM.