WmiPrvSE.exe processes is peaking at around 45-50% of CPU from 2019 DC server

Question

Based from the Event Logs it shows below. Any recommendation please Start IWbemServices::ExecQuery - root\cimv2 : SELECT EventCode,InsertionStrings,RecordNumber FROM Win32_NTLogEvent WHERE Logfile = 'Security' AND EventType=4 AND (EventCode=540 OR EventCode=672 OR EventCode=4624 OR EventCode=4768) AND RecordNumber > 2268885114

Server has been rebooted and Updated but same issue persist. Seeing a lot of Errors in WMI Activity in Even Log.

Any sugggestions please.

Thanks

Answer 1

Hello

Thank you for posting in Microsoft Community forum!

The high CPU usage by WmiPrvSE.exe is usually a sign that another application is requesting data through WMI. Here are some steps you can take to troubleshoot this issue:

Identify the Problem: Review the Task Manager’s Processes pane or Details pane to identify the exact process. Identify if the process is WmiPrvSE.exe or svchost.exe (hosting the WMI service Winmgmt), and identify the process ID.

Understand the CPU Consumption: Observe the overall CPU consumption and the PID identified. It’s important to note when, how, and the frequency of the CPU consumption.

Check for Errors in WMI Activity in Event Log: Use Event Viewer to find recent “Error” events and locate the process ID number. You can enable WMI event tracing and locate WMI events in Event Viewer.

Restart Windows Management Instrumentation Service: You can try restarting the Windows Management Instrumentation Service.

Scan for Corrupted System Files: Corrupted system files can cause high CPU usage. Use System File Checker tool to repair missing or corrupted system files.

Perform a Clean Boot: A clean boot helps eliminate software conflicts that occur when you install a program or an update or when you run a program in Windows.

Answer 2

Hello Wei,

Thank you for your response. I've reviewed and implemented all the recommended suggestions, but the issue still persists.

Additionally, when examining the process ID and details, it appears to be associated with svchost.exe.

Best regards,

Answer 3

You can try to use the Performance Monitor (Perfmon) tool to identify the exact instance of WmiPrvse.exe by the PID that you determine. You can also get a graphical view of the CPU consumption of any process (WmiPrvse.exe or svchost.exe hosting the WMI service).

Troubleshoot WMI high CPU usage issues - Windows Server | Microsoft LearnTroubleshoot WMI high CPU usage issues - Windows Server | Microsoft Learn