Hi Everyone,
I have been battling with this issue for 3 months now and still cannot resolve it.
My version of Windows 10 is 1903 (OS Build 18362.535)
I have followed this link in trying to resolve it:
https://www.itechgyan.com/wmi-provider-host/
I basically followed and executed all the steps, but the problem is still there.
They tell you to go into the event viewer wmi-activity/operational and check the WMI Activity log to view the ClientProcessID that is causing the issue.
I do find the process ID in the log, but cannot find it in task manager services and even in tasklist command.
It says Component = Unknown and PossibleCause = Unknown. That is very reassuring for the end user, ahahah.
If Microsoft does not know it, then who should know it?
I also updated all my device drivers to the latest versions using drivereasy free, but to no avail in resolving wmi provider host process running high CPU.
Ran malwarebytes, eek toolkit and windows defender to scan for viruses, trojans etc, but found nothing.
If I stop the Windows Management Instrumentation service, then I CPU utilization drops to 7%-20%.
What follows are the event viewer errors for some clientprocessid of unknow entity:
---------------------------
Log Name: Microsoft-Windows-WMI-Activity/Operational
Source: Microsoft-Windows-WMI-Activity
Date: 23/12/2019 8:28:29 AM
Event ID: 5858
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: pc-1
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = PC-1; User = pc-1\alfred; ClientProcessId = 13716; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_OperatingSystem; ResultCode = 0x80041032; PossibleCause
= Unknown
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}" />
<EventID>5858</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2019-12-22T21:28:29.934282600Z" />
<EventRecordID>19962</EventRecordID>
<Correlation />
<Execution ProcessID="3960" ThreadID="10584" />
<Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
<Computer>pc-1</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Operation_ClientFailure xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
<Id>{00000000-0000-0000-0000-000000000000}</Id>
<ClientMachine>PC-1</ClientMachine>
<User>pc-1\alfred</User>
<ClientProcessId>13716</ClientProcessId>
<Component>Unknown</Component>
<Operation>Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_OperatingSystem</Operation>
<ResultCode>0x80041032</ResultCode>
<PossibleCause>Unknown</PossibleCause>
</Operation_ClientFailure>
</UserData>
</Event>
-------------------------
Log Name: Microsoft-Windows-WMI-Activity/Operational
Source: Microsoft-Windows-WMI-Activity
Date: 23/12/2019 8:28:15 AM
Event ID: 5858
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: pc-1
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = PC-1; User = pc-1\alfred; ClientProcessId = 1452; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory WHERE Tag='Physical Memory 0'; ResultCode
= 0x80041032; PossibleCause = Unknown
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}" />
<EventID>5858</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2019-12-22T21:28:15.411334200Z" />
<EventRecordID>19960</EventRecordID>
<Correlation />
<Execution ProcessID="3960" ThreadID="12120" />
<Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
<Computer>pc-1</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Operation_ClientFailure xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
<Id>{00000000-0000-0000-0000-000000000000}</Id>
<ClientMachine>PC-1</ClientMachine>
<User>pc-1\alfred</User>
<ClientProcessId>1452</ClientProcessId>
<Component>Unknown</Component>
<Operation>Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory WHERE Tag='Physical Memory 0'</Operation>
<ResultCode>0x80041032</ResultCode>
<PossibleCause>Unknown</PossibleCause>
</Operation_ClientFailure>
</UserData>
</Event>
-------------------------
Log Name: Microsoft-Windows-WMI-Activity/Operational
Source: Microsoft-Windows-WMI-Activity
Date: 23/12/2019 8:19:26 AM
Event ID: 5858
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: pc-1
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = PC-1; User = pc-1\alfred; ClientProcessId = 15640; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory WHERE Tag='Physical Memory 0';
ResultCode = 0x80041032; PossibleCause = Unknown
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}" />
<EventID>5858</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2019-12-22T21:19:26.939370100Z" />
<EventRecordID>19950</EventRecordID>
<Correlation />
<Execution ProcessID="3960" ThreadID="4000" />
<Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
<Computer>pc-1</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Operation_ClientFailure xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
<Id>{00000000-0000-0000-0000-000000000000}</Id>
<ClientMachine>PC-1</ClientMachine>
<User>pc-1\alfred</User>
<ClientProcessId>15640</ClientProcessId>
<Component>Unknown</Component>
<Operation>Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory WHERE Tag='Physical Memory 0'</Operation>
<ResultCode>0x80041032</ResultCode>
<PossibleCause>Unknown</PossibleCause>
</Operation_ClientFailure>
</UserData>
</Event>
-------------------------
I wish that someone can help me solve this problem once for all.
Thank you in advance.
Alfred56
