WMI Provider Host - High CPU Usage

[gardenman]

Hi, after the latest Windows Updates, I keep having "WMI Provider Host" randomly take up about 15% of my CPU. When it does this, the PC gets noticeably louder (fans). The total CPU usage goes up to 20%. Usually my PC idles around 5% CPU usage (web browser, WinTV open).

It usually runs for a minute or so then drops back to its normal CPU usage (0.1%). It does this at random intervals. Sometimes every 5 minutes, sometimes every hour or so. It happened approximately 5 times in the last hour.

These don't help:
- Letting it finish what it's doing.
- Closing it out. It comes back.
- Virus/malware scans come up clean.
- Task Scheduler is not showing any tasks running when it happens.

I tried to track down a service that may be causing the problem but I found no errors relating to the extra CPU usage times in my event logs. More info: https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings/wmi-provider-host-high-cpu-usage-and-laptop/44cb3953-a883-404a-a94f-ee4f363d3a4b?page=2 There are occasional errors in the log file from the day before, but none today and it's still happening.

I'm looking for a way to fix this. I'm not looking to reinstall Windows, repair Windows, or uninstall updates. Discovering what is causing the problem and possibly disabling it would be great. Other ideas are welcome.

 

[Colif]

Windows Management Instrumentation - tells us what it is at least.

here be a few suggestions (don't download anything) - https://windowsreport.com/wmi-provider-host-high-cpu-usage-windows-10/

curious, if you right click header in task manager and add command line to the shown items, does it show a path to anything? I doubt it will. Have you right clicked WMI Provider host and looked at properties? knowing what is running it might help you identify it in process exploder

Have you looked in Resource monitor on the CPU tab? Might give a clue as well.

 

[johnbl]

here is info on how to check for problems that would effect a WMI provider
(stopping services might help isolate which service is causing the problem)

https://windowsbook.org/fix-wmi-provider-host-high-cpu/

also run a Malwarebytes scan. people report this problem when Conduit Search is installed on the system.

 

[gardenman]

Thank you both for the replies.

I had to reboot again because of another problem and it seems to be slightly better. WMI Provider Host still pops up and uses 15% of the CPU but it's only lasting 15-20 seconds or so. This almost seems within normal range for other background processes like Windows Update. Previously it was happening way too often and lasting a full 60 seconds or more.

To Colif:
The first link you provided is good info, but it's slightly above my head. I don't understand most of it, but I understand it's an integral part of Windows.

No luck on the Command Line view. It's shown but with no parameters or anything. Also no luck on properties of the executable that is running with Process Explorer. It was all kind of generic information.

I opened Resource Monitor and looked at it but didn't really study it and try to figure it out yet. I'll keep it in mind.

To johnbl:
The first thing I did was run a Malwarebytes scan. I've also now done a full Defender scan (2 mil+ files). Those found nothing. I'm pretty sure there is no Conduit Search installed. I don't install much of anything. Other than a ton of dump files, the last thing I downloaded was a game from UBIsoft, directly from their game launcher a few months back.

The problem started within 24 hours of the latest Windows updates, but like I said above, I don't want to remove any updates.

As for the other links that you both provided, they have basically the same information on them and I will look through it and let you know what happens.

I just found this today but also haven't been through it yet:
https://blogs.technet.microsoft.com/askperf/2014/08/12/wmi-how-to-troubleshoot-high-cpu-usage-by-wmi-components/

The biggest problem I'm having now (or maybe it's not a problem) is that it's happening ALOT less often now that I rebooted (a 2nd time after updates). That's both a good thing (less problems), and a bad thing (it's harder to track and figure out what's going on). I can go for hours with no extra CPU usage, then sometimes it happens multiple times an hour.

Verified 15% CPU usage today by WMI Provider Host
3:12pm - About 15 seconds.
8:41pm - About 15 seconds. <-- Firefox open and browsing this forum and replying.
8:55pm - About 20 seconds.
9:12pm - About 20 seconds.
I have seen it happen when Firefox is closed too. I was gaming MOST of the day so it likely happened many other times and I didn't notice because I was in a game.

Thanks again. Give me time, I'm slowly digesting everything you've said and trying to figure out my next move with this problem, if any. I'll reply once I have more info or more questions.

 

[Colif]

Green text? you break forums doing that (i am joking but its hard to tell for sure)

WBEM is a set of management and Internet standard technologies developed to unify the management of distributed computing environments, facilitating the exchange of data across otherwise disparate technologies and platforms. WBEM = Web Based Enterprise Management


I must have helped someone in past with this as I have this - https://www.microsoft.com/en-au/download/details.aspx?id=7684

what anti virus are you using? https://answers.microsoft.com/en-us/windows/forum/windows_10-performance/wmi-provider-host-is-killing-my-computer/decd24de-1989-43b1-a4c0-6b6e23e04138?auth=1

these might help: https://social.technet.microsoft.com/Forums/windows/en-US/48432bdd-88bc-4057-8252-128a49918d1e/wmiprvseexe-w10-home-x64-causing-high-cpu?forum=win10itprohardware

 

[gardenman]

I don't like the color picker in the editor here. I'd rather have the basic 16 colors, it would be easier to choose a color.

I remembered that I took a backup of my system the day after the updates and I restored that backup to a VM. I booted it up and noticed that the WMI Provider Host was taking up a large amount of CPU resources in it, just like my real OS. This is a good place to test things and not have to worry about messing things up. (It takes up more CPU resources in the VM because it has less CPU resources allocated to it).
VM Screenshot: https://s9.postimg.org/3mxolfv9r/VM1.jpg

I downloaded the WMIDiag.exe from the link you provided and ran it. It extracted 4 files, one of which was a DOC file. I don't have Office but opened it in Wordpad and was able to decipher some text. Another file was a VBS script so I assumed that was what I suppose to run. In the VM, I took a guess and ran it on the Admin command prompt like: wsript wmidiag.vbs
It ran for 15 minutes and eventually came up with an error, I think it was minor, it disappeared 10 seconds later with no user input from me. Here is the JUST the command prompt output: https://pastebin.com/rUCUp6Z5
The document mentioned 3 log files that the script creates. I found them and upload them here (along with the command prompt output): https://www.sendspace.com/file/996kog
It looked like maybe 2 services are reliant on the WMI host? Both from MS? I need to re-read this.

A Resource Monitor screenshot: https://s9.postimg.org/3zp2rnnu7/resmon.jpg
I still haven't looked into that.

I have not looked into the other links that you both sent yet. I plan on doing that in the VM now.

I'm using Defender as anti-virus + Malwarebytes (on demand only, not the in memory scanner part).
I think my PC came with Norton or McAfee but it that was 8 years ago and it was removed shortly after I got the PC. I probably ran the full removal tool also to get rid of it. I don't think that is the problem. This only started after the latest Windows updates.

The last link that you sent, I've pretty much already read all of the links referenced in there.

I've worked 2+ hours on this today and I still have alot of things to try (the commands in those link that you both sent, I can try those in my VM). I will probably wait until tomorrow to continue. My game is calling my name. Thanks for the replies.

Edit: Times I've noticed WMI running the last 24 hours or so:
1140pm 1156pm 118am 121am 125am 141am 1215pm 1231pm 103pm 315pm 404p 542p 559p
Each time about 20 seconds now at 15% CPU.

 

[Colif]

does it run anytime or only when PC is idle? Cause, worrying about PC randomly doing things at idle is a waste of your time, it will run background processes in that time simply because you aren't using PC.

I know the Saturday after every CU it will run the Windows modules installer app and update my shop apps

I think there is a program you can download that lets you track what is using specific services, might be from sysinternals since they are owned by Microsoft now. I will look at images later, brain isn't working today

 

[Colif]

See if you can match the PID of 4576 (which shows in resource monitor) up with process explorer, as I can see it has PID column. MIght help to highlight WinPrvSE.exe and choose its properties, as the threads tab shows everything linked to it

For example - mine:

I haven't looked into what all these things are or do but its a start

Alas PID aren't set in stone, that service in my PC has a different number, only slightly different (its 4580)

 

[gardenman]

It runs at all times, whether idle or not. Even while typing in a reply here on the forums. I'm also pretty sure that it runs while gaming.

It just showed up at 12:04am. I have Process Explorer, Netflix, and WinTV open. The PID is 15708.
12.48 CPU [Process Explorer screen shot when it's acting up.]
00.02 CPU [Process Explorer screen shot when it's acting normal.]

Maybe you are thinking of ProcDump by SysInternals.
https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
I haven't explored it yet but it looks complicated.

I looked at the info from the WMIDiag earlier. There's over 36500 lines of text in the 3 logs. I looked at just the output that I got on the command prompt and found these lines which could be helpful:

Spoiler

36295 17:24:08 (0) ** INFO: WMI service has dependents: ......... 2 SERVICE(S)!
36296 17:24:08 (0) ** - Security Center (WSCSVC, StartMode='Automatic')
36297 17:24:08 (0) ** - Internet Connection Sharing (ICS) (*) (SHAREDACCESS, StartMode='Manual')
36298 17:24:08 (0) ** => If the WMI service is stopped, the listed service(s) will have to be stopped as well.
36299 17:24:08 (0) ** Note: If the service is marked with (*), it means that the service/application uses WMI but
36300 17:24:08 (0) ** there is no hard dependency on WMI. However, if the WMI service is stopped,
36301 17:24:08 (0) ** this can prevent the service/application to work as expected.

As for the links you both provided earlier:
https://windowsreport.com/wmi-provider-host-high-cpu-usage-windows-10/
https://windowsbook.org/fix-wmi-provider-host-high-cpu/
I have tried the following (real Windows, not VM):

msdt.exe -id MaintenanceDiagnostic
It said "Troubleshooting has completed. No changes or updates were necessary".

msdt.exe /id PerformanceDiagnostic
It said "Sorry, this troubleshooter doesn't work with this version of Windows".

I have not tested the other things listed on the pages yet. I still have several things to try out (listed above) that I haven't gotten to yet. I'm slowly working through it all.

 

[Colif]

depends on priorities, which is more interesting, fix PC or do a 4 hour race around USA (I know which would be more fun, why I didn't ask that)

this is for win 8, it seems helpful though not sure how to change for win 10: https://blogs.technet.microsoft.com/askperf/2014/08/12/wmi-how-to-troubleshoot-high-cpu-usage-by-wmi-components/

 

[gardenman]

Vrooooom, I'd rather be racing than doing this any day.

My system is having problems booting right now, likely due to a dead battery. I get time/date errors and overclock has been reset errors. Therefore, anything listed below that requires a reboot will probably be the last things that I try.

Here's a list of things I've tried and need to try:

For this page: https://windowsbook.org/fix-wmi-provider-host-high-cpu/
1. Restarting WMI Service (only) didn't help.
2. The System Performance Troubleshooter didn't help.
3. Not tried yet. (Reboot into Safe mode and try troubleshooters).
4. Tried it, didn't help. [Screenshot]
5. Tried it, didn't help. HOWEVER, interesting find about the services. See 1st screen shot.
[Screenshot 1]
[Screenshot 2]

For this page: https://windowsreport.com/wmi-provider-host-high-cpu-usage-windows-10/
1. Tried it, didn't work (Troubleshooter)
2. Tried it, didn't work (Troubleshooter)
3. Tried it, didn't work. The PID in the log file was from a previous day or two and the PID only pointed to the actual WMI service. There were no new errors being generated each time the WMI takes up the additional CPU usage.
4. I don't have it.
5. I don't have it.
6. I do have drivers for an HP Officejet 6800 installed (used occasionally). I don't see any HP services listed in the Services section of Task Manager.
7. I don't have it. (Conduit Search previously suggested by johnbl).
8. A malware/virus check was the first thing I did. It came up clean.
9. Have not tried all of that out, and it's a good idea of things to try.
10. Tried it, didn't help. See #5 on the first link. It's the same thing.
11. I don't have either.
12. I don't have it.
13. I don't have it.
14. I don't have it (not installed or even listed in Optional Components).
15. Not tried yet.
16. Not tried Clean Boot yet.

For this page: https://blogs.technet.microsoft.com/askperf/2014/08/12/wmi-how-to-troubleshoot-high-cpu-usage-by-wmi-components/
I tried the first command and I don't think it worked. WMI ran afterwards and it still looked like it always did. Nothing extra when choosing Properties on it. Also I think the output should say OWN on the TYPE line, but it doesn't. It might have changed since Win8, or something else didn't work. (I did restart WMI after the first command).

Edit: I've tried a few additional things since I've posted this and updated the list above.

 

[gardenman]

I tried one more of the steps above, a "Clean Boot" and to my surprise, it worked. I didn't expect it to work because the problem only surfaced after a Windows Update and I've had so many problems out of Windows Updates lately.

All of this testing has been done in the VM copy of my system. I tested for 40 minutes in Clean Boot with no extra WMI CPU usage. I then tested back in normal mode and had extra WMI CPU usage within 3 minutes. After several more reboots, I determined it was the Sidebar/Gadgets.

Today I ran the following additional 30-min tests:

In the VM with the Sidebar enabled:
4:32p - start
4:33p - 15% WMI - closed out with Task Manager
4:36p - 15% WMI - closed out with TM
4:39p - 15% WMI - let it run, it lasted 45 seconds
4:56p - 15% WMI - let it run, lasted 15 seconds
5:02p - end

In the VM with the Sidebar disabled:
9:13p - start
9:43p - end
WMI CPU usage stayed below 1% usage as it should.

I've done an additional 40 mins of testing without the Sidebar enabled and seen no extra WMI CPU usage.

During my tests, I had Task Manager open in both the VM and on my host Windows so I could tell which one was causing the extra CPU usage when it happened. It was happening on my host system both times, and often. But the VM stopped when I disabled the Sidebar.

I really depend on these gadgets and have for the past 8 years. I've seen alternatives but nothing that can compare to the actual gadgets and info they give and the small footprint they have. For now, I'll just have to put up with it. I may write the author of 8GadgetPack (which is the Sidebar that I'm using) and ask him about it. I've emailed him before and he was nice and knowledgable. It could be a specific gadget. I've haven't tested that yet.

I'm going to call this solved. Since Colif gave the page that suggested a Clean Boot, I'll give him the Best Answer. I haven't actually tried the Clean Boot on my real system yet as I'm almost afraid to reboot due to poor shape my system is in. I did close the Sidebar.exe once on my main system and it didn't help, which is odd.

TY both for the answers and help.

 

[gardenman]

Hi janeb, I appreciate the answer.

The problem was was 2 gadgets in the sidebar, specifically the Network Meter and Drives Meter from addgadget.com were causing the WMI Provider Host to spike the CPU usage. A clean boot helped determine this. I removed the sidebar and 8GadgetPack from Windows 10.

It has taken me a while to figure out replacements but I have now switched to Rainmeter, "skins" that emulate the old addgadget.com gadgets, and a custom gadget that I've built in C++ for the GPU in order to get all of the same information I had in the sidebar.

Another month+ of my time spent on fixing problems caused by Windows Updates (once again).

Thanks for the reply.