Can anyone tell me what WMI is doing? Thousands of events runs all the time event ID 5861

SonyaAnn

Reputable
Feb 15, 2015
31
0
4,530
0
I see two instances of wmi running all the time, there's also one that says server and another that says reverse something but these do not run long. Below are both the general information and the details on this event.

Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};


System

- Provider

[ Name] Microsoft-Windows-WMI-Activity
[ Guid] {1418EF04-B0B4-4623-BF7E-D74AB47BBDAA}

EventID 5861

Version 0

Level 0

Task 0

Opcode 0

Keywords 0x4000000000000000

- TimeCreated

[ SystemTime] 2017-09-23T07:20:08.309942800Z

EventRecordID 7613

Correlation

- Execution

[ ProcessID] 4520
[ ThreadID] 720

Channel Microsoft-Windows-WMI-Activity/Operational

Computer DESKTOP-L2LHDAJ

- Security

[ UserID] S-1-5-18


- UserData

- Operation_ESStoConsumerBinding

Namespace //./root/subscription

ESS SCM Event Log Filter

CONSUMER NTEventLogEventConsumer="SCM Event Log Consumer"

PossibleCause Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };


 

Phillip Corcoran

Titan
Moderator
MERGED QUESTION
Question from SonyaAnn : "Any idea what WMI is doing on my Windows 10 Pro desktop?"



 

SonyaAnn

Reputable
Feb 15, 2015
31
0
4,530
0


I apologize I asked the question and clicked post, then it made me log in and the question was no where to be found so I tried again.
 

ASK THE COMMUNITY

TRENDING THREADS