How is this cpu usage being calculated? Process manager or some external (possibly 3rd party app/appliance). Do you have any security add-ons either in Thunderbird or on the host itself that might be loading Thunderbird whilst it/they check the contents, similar to how a a/v appliance would check something randomly downloaded from the internet? Also, are these files and/or emails sourced locally within the firm or external or a mix. The previous point would lend a lot of priority if so.

If Possible could you share a screenshot or log of a sample pdf (sanitized if needed, in content or source/target email address(es)) when this occurs.

Thanks Corey for answering so fast. CPU is calculated by Windows Taskmanager. Kaspersky is installed, Deactivating it temporarly has no effect. The profil is under e:\users\%username%\AppData\Roaming\Thunderbird\ e: is a partition of the local SSD. e:\users\%username%\ is used for the active directory´s user profile. We have tried different pdf files from different sources. They open, if saved, immediatelly. The time to wait depends on size.

So the local ssd is internal or external ? also it's partitioned with simple volumes or something on a dynamic disk (like LDM). Is Kaspersky running on the client side of AD or run BY the AD controller? Take a look at both Kaspersky and AD loads/cpu draw during the same operations.

Hi Corey, its a local ssd SATA connected, simple volumes, Kaspersky Endpoint Security 10, running on the WTS (windows terminal server).

Seems to be complicated. Does anyone know, when the next release is planed? Perhaps the issue is fixed.