rpcss wmiprvse cpu usage RRS feed

  • Question

  • I have looked at a number of questions related to wmiprvse cpu usage, but none of the situations fit exactly.  I have no error codes.  The cpu for wmiprvse stays in the range of 10-20%.  As far as I can see, there is no inordinate memory usage (about 20% of 8gb).


    If I suspend "svchost.exe (RPCSS)" in the Resource Monitor, cpu for wmiprvse.exe drops to nothing.


    As far as I can tell there's nothing special about this machine (running Windows Professional 64-bit) and two other Windows 7 machines, one running 64-bit Professional, the 64-bit Premium.


    When I try to trace events for "WMI-Activity" I get a message when I start the trace:

    Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    In the trace I get a pattern similar to:

    GroupOperationId = 362; OperationId = 258119; Operation = Start IWbemServices::ExecQuery - select * from Win32_Process; ClientMachine = Local; User = .\SYSTEM; ClientProcessId = 0; NamespaceName = \\.\root\CIMV2


    ProviderInfo for GroupOperationId = 362; Operation = Provider::CreateInstanceEnum - Win32_Process; ProviderName = CIMWin32; ProviderGuid = {d63a5850-8f16-11cf-9f47-00aa00bf345c}; Path = %systemroot%\system32\wbem\cimwin32.dll


    Stop OperationId = 258119


    N.B. the ClientProcessId=0.


    Tracing while RPCSS is suspended yields no entries in the log.


    {d63a5850-8f16-11cf-9f47-00aa00bf345c} is the 'WBEM Framework Instance Provider", which is probably not the real cause.


    Where do I go next?


    Friday, May 24, 2013 4:25 PM


All replies

  • Hi,


    Generally speaking, it is quite normal that the WmiPrvSE process cost 4-6 percent of CPU consumption when a specific software requires its facilities.


    The WmiPrvSE.exe is a host process for WMI provider services.WMI provider services were loaded in-process with the WMI Service (a new request to WMI would restart the WMI Service). This is an essential service which will start whenever a specific piece of software requires its facilities.


    Meanwhile, there are a few blogs regarding troubleshooting high CPU usage in WMIprvse.exe. Please refer to the following links for more troubleshooting information:

    Using Netmon to figure out the source of high CPU in WMIprvse.exe


    Is WMIprvse a real villain?


    Hope this helps

    Vincent Wang
    TechNet Community Support

    Tuesday, May 28, 2013 3:24 AM
  • I have the exact same problem as the original poster, except it is draining something like 40-60% of my CPU. I have followed the external links and tried to asses what is going on and it seems that there is an infinite loop being caused by cimwin32.dll. Is there some sort of solution for that? 

    Friday, May 31, 2013 5:25 AM
  • I did a search on the message:  "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99"

    This time I added the error code: 0x80041003

    One of the first entries was: http://social.msdn.microsoft.com/Forums/en-US/winserver2008appcompatabilityandcertification/thread/6fcc4447-4d68-4ab8-8ca2-2c0a8bddb584/

    Bingo.  That cut back the cpu utilization.

    • Marked as answer by ramsey Tuesday, June 18, 2013 2:49 AM
    Tuesday, June 18, 2013 2:49 AM
  • My case: wmiprvse.exe endless loop to tzres.dll, CPU usage 40-60%, constant spiking, Vista Home Premium, SP2

    After no success, following multiple forum tips, resorted to deleting programs while watching CPU usage.

    Cause in my case: TRUSTEER RAPPORT software, recommended by my local bank. Once deleted, problem solved.

    Just wanted to put out there another potential source

    Friday, June 21, 2013 5:37 PM
  • Just thought I'd add my experience so that others may benefit. In my case it was the "Search Toolbar by Ask.com"

    Had the exact same issues, high CPU caused by WmiPrvSE.exe, investigated using process monitor and the majority of the lines from the log were to do with tzres.dll

    CPU usage between 40-70% constantly.

    Tried disabling Trend security agent real time scan but it continued until I removed the above software. 

    Friday, April 17, 2015 1:34 AM