WMI Provider Host excessive CPU

[Bernard Cadogan]

My apologies if this is the wrong place for this question but I've scoured the web and although I have found many people asking the same or very similar questions I have failed to find any answers that resolve the problem.

I'm running Windows 10 Pro at the 1909 level on an i5 processor with 16 GB of memory and an SSD. I have a major problem with WMIPrvSE.exe continuously burning 20%+ of the processor (for days on end) - it is not using a great deal of memory (250MB or so) and it does no physical I/Os according to task manager but it does do a significant number of "other" I/Os. 

The problem is there does not seem to be any way that I can find of tracking down why this is happening. If I look in the WMI-Activity/Operational log in Event Manager I see a lot of messges reporting error code 0x80041032 which seems to be associated with requests being issued for some data but then a timeout occurring before the data is recieved. This is the text of one such Event Log entry:-

Log Name: Microsoft-Windows-WMI-Activity/Operational
Source: Microsoft-Windows-WMI-Activity
Date: 12/01/2020 21:36:10
Event ID: 5858
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: Tower3620
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = TOWER3620; User = TOWER3620\Bernard; ClientProcessId = 28064; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory WHERE Tag='Physical Memory 0'; ResultCode = 0x80041032; PossibleCause = Unknown
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}" />
<EventID>5858</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2020-01-12T21:36:10.852378600Z" />
<EventRecordID>265967</EventRecordID>
<Correlation />
<Execution ProcessID="2680" ThreadID="2320" />
<Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
<Computer>Tower3620</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Operation_ClientFailure xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
<Id>{00000000-0000-0000-0000-000000000000}</Id>
<ClientMachine>TOWER3620</ClientMachine>
<User>TOWER3620\Bernard</User>
<ClientProcessId>28064</ClientProcessId>
<Component>Unknown</Component>
<Operation>Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory WHERE Tag='Physical Memory 0'</Operation>
<ResultCode>0x80041032</ResultCode>
<PossibleCause>Unknown</PossibleCause>
</Operation_ClientFailure>
</UserData>
</Event>

When I look for ClientProcessID 28064 in Task Manager it is nowhere to be found - its terminated.

ProcessID 2680 is WIndows Management Instrumentation, but its CPU utilisation is alwys effectively zero.

Below is another example of a log entry - same error code but very different message, ProcessID 5372 no longer exists:-

Log Name: Microsoft-Windows-WMI-Activity/Operational
Source: Microsoft-Windows-WMI-Activity
Date: 12/01/2020 21:28:33
Event ID: 5858
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: Tower3620
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = TOWER3620; User = TOWER3620\Bernard; ClientProcessId = 5372; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_Bios; ResultCode = 0x80041032; PossibleCause = Unknown
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}" />
<EventID>5858</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2020-01-12T21:28:33.751355300Z" />
<EventRecordID>265964</EventRecordID>
<Correlation />
<Execution ProcessID="2680" ThreadID="29552" />
<Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
<Computer>Tower3620</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Operation_ClientFailure xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
<Id>{00000000-0000-0000-0000-000000000000}</Id>
<ClientMachine>TOWER3620</ClientMachine>
<User>TOWER3620\Bernard</User>
<ClientProcessId>5372</ClientProcessId>
<Component>Unknown</Component>
<Operation>Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_Bios</Operation>
<ResultCode>0x80041032</ResultCode>
<PossibleCause>Unknown</PossibleCause>
</Operation_ClientFailure>
</UserData>
</Event>

I'm completely stumped on how to resolve this issue - can anyone help please?

[#2]

I've got a similar issue, any success in trying to resolve this?

[#3]

@ktoerne - yes I did manage to resolve it but more by luck than anything. I tried some other forums but no one seemed to come up with an answer as to how you could track the cause of the problem down. I really not sure it is possible. However I discovered purely by accident that it was Garmin Connect that was causing the problem on my machine. I believe the issue is basically caused by an application asking for some windows instrumentation data. I was running Garmin Connect to upload data from my Garmin Edge 25 cycling computer to Garmin's web site and when the process was finished (only takes about 30 seconds each time) I would click close on the Connect application and it would go away but continue running with an icon in the little box that you get when you click on the upwards pointing arrow on the right of the task bar. I right clicked this and it gave me the option to "Exit" Garmin Connect and instantly the problem went away as the app closed down completely. I have reported the problem to Garmin but they haven't done anything about it.

So all I can suggest is that you bring up task manager and then selectively try completely closing any non Windows system app you find in that list on the bottom right of the screen and see which one is causing your problem - assuming you're not running Garmin Connect of course - if you are then you probably have an easy answer. 

Good luck. 

[#4]

+1 this.
In my case, it was Garmin Express which caused excessive CPU Usage through WMI Provider Host.

Thanks for the information @bernard

[#5]

@Adrianonfire You're right - my apologies, I meant to say Garmin Express. Glad I was able to point you in the right direction and sorry I mistyped the name.

Bernard

[#6]

@Bernard Cadogan- wow thanks, this also worked for me (exiting Garmin Express)

[#7]

@markdotai My pleasure Mark, its feedback like this that makes me think it was worth while posting what worked for me even if I cant explain why. Thank you.

[#8]

Many thanks @Bernard Cadogan! After hours of struggling with this you pointed me into the right direction!

[#9]

WMI Provider Host shouldn't normally use much CPU, as it shouldn't normally be doing anything. ... Locate the “Windows Management Instrumentation service” in the list, right-click it, and select “Restart”. If you see consistently high CPU usage, it's likely that another process on your system is behaving badly.

[#10]

@Smith_J Yes, another process is causing the problem, although it is WMI Provider that is using the excess CPU. The other process is Garmin Express and how to deal with it has been explained in the previous posts. The problem has been reported to Garmin but so far they have not released any fix for it.

[#11]

@Bernard Cadogan +1 for finding this - worked for me too. I had hit a dead end because all the PIDs that had caused the WMI errors were no longer in the process table - and even turning on Process success auditing in the Security Log hadn't enabled me to track anything down. Good old Garmin :-(.

[#12]

Great - solved my issue instantly. Garmin express it is.

[#13]

Just chiming in: it was also Garmin Express for our 2010 Dell desktop computer. Many thanks! The computer was barely functioning but the impact of shutting down Garmin Express was immediate and dramatic!

[#14]

@codetojoy Delighted to be of help - the really frustrating thing is Garmin seems to have ignored my report of the problem - I’ll have to have another go at them. I suspect many more people are seeing this problem and not just those of you who have responded on this thread. I appreciate your feedback and thank you.

[#15]

You are a genius! It works for me too.  Thanks! @Bernard Cadogan 

[#16]

@BeaLozer Thanks, I updated my Garmin Express to 7.1.4.0 a couple of weeks ago and it seems Garmin have fixed the problem in that release - I’m also running WIN 10 Pro at the 2004 level, just in case that is relevant.

[#17]

@Bernard Cadogan Thank you very much! Now I also installed the new version and seems that the bug is fixed. I am not an IT person, therefore your easy solution helps me a lot. Thanks!

[#18]

@Bernard Cadogan 

Thanks so much! It works for me. I try to find application one by one and to see what happens. It turns out that Notepad++ caused the problem in my case.