Forum Discussion
Endless WebDAV requests caused by WqlEventQuery
WMI event subscriptions might periodically trigger disk enumeration or other system calls that, directly or indirectly, cause WebDAV requests.
You’re absolutely right—WMI event subscriptions can definitely kick off background system queries, including disk enumeration. If you have any mapped WebDAV drives or related shell extensions, these background calls can sometimes trigger unexpected WebDAV network requests, even when you’re not actively accessing those drives. This can lead to random network traffic, authentication prompts, or slowdowns, especially in enterprise environments.
If this behavior is causing issues, you can try auditing which WMI events or scripts are registered (using Get-WmiObject -Namespace root\subscription -Class __EventFilter), or limit/unmap unnecessary WebDAV connections. Have you noticed these WebDAV calls showing up at specific intervals, or tied to certain events?
Yes, the WebDAV requests are directly connected to the WqlQuery I posted above. The requests stop as soon as the WqlQuery is not active anymore.
The frequency of WebDAV requests solely depends on the interval provided in the WqlQuery. So currently it's set to 1s and I see 4 requests per second. If it's 2s I see 4 requests every two seonds etc.
