Memory and Handle Quotas in the WMI Provider Service

Hi Julius, 

When wmiprvse hits quota limit that instance will stop working and get closed out. There is not really a way to use troubleshooting efforts prior to know if we are leaking handles in my opinion since it will close out when limit is reached or do we simply have a demand for more handles that is not a leak. What I always did in those cases was to double the quota handle limit and monitor the handle count to see if it satisfied handle usage requirement and if it didn't and I hit the new quota limit, then I was pretty sure had a handle leak. In the later, now turn to troubleshooting. 

Here is link of the blog series I did for different scenarios and there is one there for high handle count. They are dated and would not go the route of using debugger and htrace. Would do the gflags and then get process dump, but of course would most likely need Microsoft to look at the dump. Sometimes you can just use process explorer and right click on the instance of wmiprvse with high handle count and click on provider type and see if the provider running in that instance is something like ccm or event log provider to give you quicker clue to who is the culprit. Like in instance of event log usually a 3rd party doing heavy querying to the logs or someone has made the log size larger and it now takes longer or more expensive query to get thru all the entries when querying the event log.  You can also use Windows Performance Recorder tracing and analyze with Windows Performance Analyzer with the handle profile as a more up-to-date method to try and determine cause of leak. 
https://techcommunity.microsoft.com/t5/ask-the-performance-team/bg-p/AskPerf/label-name/wmiseries