How to Find What Makes WMI Provider Host Use High CPU
WMI Provider Host in Task Manager is WmiPrvSE.exe, the Windows process that answers questions programs ask about the system: which disks exist, how full the battery is, which services run. It rarely uses CPU for its own reasons. When it sits at 10 to 30 percent for a long time, some other program is asking it something too often, or asking something expensive, so the fix is to find that program rather than the provider host itself.
What it is doing
Windows Management Instrumentation (WMI) is how scripts, monitoring tools, drivers' companion apps and Windows itself read system information. The requests are served by providers, and providers run inside one or more WmiPrvSE.exe processes, which is why Task Manager can show several WMI Provider Host rows at once. Microsoft's WMI high CPU troubleshooting guide says the same: the provider host's CPU reflects the queries clients send, and the work is to identify which client and which provider.
| What you see | Likely cause |
|---|---|
| A short spike at sign-in, then quiet | Startup apps and Windows reading inventory once |
| Steady load every few seconds, all day | A tool polling WMI in a loop: a monitor, a vendor utility, a game overlay |
| High CPU after installing one app | That app's service or its WMI provider |
| Several WMI Provider Host rows, one busy | One provider is slow; the others are fine |
Find the program that is asking
Open Event Viewer (type eventvwr in Start) and go to Applications and Services Logs › Microsoft › Windows › WMI-Activity › Operational. Errors with event ID 5858 name the query that failed and the ClientProcessId that sent it. Event ID 5857 records which provider was loaded and the process ID of the WmiPrvSE.exe hosting it.
Then open Task Manager with Ctrl + Shift + Esc, go to the Details tab and sort by PID. Match the ClientProcessId to a name, and match the busy WMI Provider Host's PID to the provider from 5857. If one client shows up in hundreds of events within a few minutes, that is the program to deal with.
If the log is quiet, the queries are not failing, they are just arriving too often. In that case, quit candidate apps one at a time, starting with hardware monitors, RGB and fan utilities, vendor update helpers and anything installed just before the problem began, and watch whether the provider host settles within a minute.
Fix it at the source
- Update or uninstall the app that polls. Many monitoring tools have a refresh interval setting; once a second is common and rarely needed.
- If the busy provider belongs to a hardware vendor's software, update that software or its driver package; old versions of some of these are known for heavy WMI use.
- Restart once after removing the cause. The provider host processes start again on demand, so there is nothing to clean up by hand.
What not to do
- Do not end WMI Provider Host repeatedly. Windows starts it again the moment the next query arrives, and the program that asked gets an error it may retry even more often.
- Do not disable the Windows Management Instrumentation service. Settings pages, Windows Update, Defender and many drivers' tools depend on it.
- Do not reset or rebuild the WMI repository (
winmgmt /resetrepository) because of high CPU. It is a repair for a damaged repository, and it can remove providers that apps registered; Microsoft treats it as a last step for a different problem.
Where Mole fits
On the Status page, Mole for Windows shows each WMI Provider Host row with its CPU, memory and I/O. Choosing Why is this running? from a row's menu shows the program file in C:\Windows\System32\wbem and which process started it, and because it runs from the Windows folder, Mole does not offer Terminate for it. Mole is itself a WMI client in two places: while the laptop is charging, Status asks for the battery's time to full charge at most once a minute, and Doctor reads disk health when you run it. Neither runs in a loop. For other busy names, see Windows processes explained, and for CPU in general, High CPU usage on Windows.
FAQ
Is WMI Provider Host a virus?
The genuine WmiPrvSE.exe lives in C:\Windows\System32\wbem. A file with that name anywhere else should be scanned with Windows Security.
Why is WMI Provider Host using high CPU?
Another program is querying WMI too often or asking for expensive data. The WMI-Activity Operational log in Event Viewer names the client process ID behind failing queries.
Can I end or disable WMI Provider Host?
Ending it only helps for seconds, because Windows restarts it on the next query. Disabling the WMI service breaks settings, updates and drivers' tools.
Why are there several WMI Provider Host processes?
Providers run in separate host processes, so a slow provider does not hold up the rest. Usually only one of them is busy.