WMI Provider Host High CPU Usage: How to Fix It on Windows 11 and 10

In most scenarios, the CPU is consumed by the WmiPrvse.exe process, and there are a few instances where svchost.exe hosting the WMI service (Winmgmt) is consuming high CPU usage, according to Microsoft’s WMI troubleshooting guide. Task Manager shows that process as WMI Provider Host (the WmiPrvse.exe process), and WMI Provider Host high CPU usage can start in another program: a client application performs abnormal, inefficient, or large queries heads Microsoft’s list of causes for Event ID 5612, the event Windows logs when it stops an overloaded WmiPrvse.exe.

The fix that lasts is finding the app sending those queries, so the steps below run from safest to most invasive, current as of October 2026. Microsoft’s method covers WMI high CPU usage issues on any Windows operating system, Windows 11 and Windows 10 included, with one change to know first: the WMIC utility has been removed from currently supported versions of Windows 11, with the removal included in the August 2026 preview update for Windows 11, versions 24H2 and 25H2, so older fixes built on wmic commands no longer run.

Key Takeaways

• Incoming queries are logged as operational events in the Microsoft-Windows-WMI-Activity/Operational log, and Event ID 5857 reports the provider that started, its wmiprvse.exe host process and its ProcessID.
• Microsoft’s worked example ends with the PID of a client process, 5484, that’s initiating a query to Win32_NTLogEvent, which is the program to fix.
• In Microsoft’s Event ID 5612 examples, Windows Management Instrumentation stopped WMIPRVSE.EXE when PrivatePageCount reached 538,353,664 against a maximum value of 536,870,912, and when HandleCount reached 4,099 against 4,096.
• The WMIC utility was deprecated in Windows Server 2012 in 2016, and its removal was included in the August 2026 preview update for Windows 11, versions 24H2 and 25H2.
• Windows 10 reached the end of support on October 14, 2025, and the consumer Extended Security Updates (ESU) program can protect a Windows 10 device till October 12, 2027.

What is WMI Provider Host (WmiPrvSE.exe)?

Windows Management Instrumentation (WMI) is the Microsoft implementation of Web-Based Enterprise Management (WBEM), and WMI Provider Host is the worker process behind it. WmiPrvse.exe is a process in the Windows operating system (OS) that can host one or more WMI providers. It is managed by the WMI service, per Microsoft Learn.

To avoid stopping all the services when a provider fails, providers are loaded into a separate host process named Wmiprvse.exe. Winmgmt is the WMI service within the SVCHOST process running under the LocalSystem account, and each WMI provider primarily contains the WMI provider DLL file and the WMI provider MOF file. The split mirrors the Host Process for Windows Tasks: one host name, many jobs inside it.

Why are there two or more WMI Provider Host processes?

Several copies are normal. More than one process with this name can be running. Each can run under a different account with varying security, and the shared host can run under LocalSystem, NetworkService or LocalService. Count alone means nothing, as with the Windows Shell Experience Host; one copy holding the CPU for minutes does.

What causes WMI Provider Host high CPU usage?

Event ID 5612 means one of the WMI provider processes (WmiPrvse.exe) has exceeded its predefined resource value and that the WMI service has explicitly stopped it from running as a process, according to Microsoft Learn. The query handled by the stopped WmiPrvse.exe process and the application that initiates the process will fail.

Microsoft lists 3 scenarios behind that event:

• A client application performs abnormal, inefficient, or large queries.
• The WmiPrvse.exe process doesn’t release resources as expected while processing a WMI query, which leads to a memory leak.
• The scale of the machine or environmental setup is large.

Windows Management Instrumentation has stopped WMIPRVSE.EXE because a quota reached a warning value in each of Microsoft’s published examples, and the numbers show where the limits sit.

Source: Microsoft Learn, Troubleshoot WmiPrvse.exe quota exceeded issues, 2026

Security tools can be part of the load too: you may notice binaries from software such as antivirus software, monitoring software, and threat protection software in a busy host, and although these software applications benefit the environment, they may sometimes interrupt and cause such issues.

Step 1: Find the WmiPrvSE.exe Process Using the CPU

Go to Task Manager > Details, then sort by Name and locate the WmiPrvse.exe process that’s consuming high CPU usage. Make a note of the process ID (PID), Microsoft’s guide says. You may have to manually add the PID column to view the process ID of all the processes in Task Manager.

Before you start: You use the built-in Administrator account or an account in the Administrators group running with elevated rights to start the WMI service. Sign in as an administrator first, because several commands below need an elevated prompt.

Work through these 4 checks in order:

1. Open Task Manager and select the Details tab.
2. Sort by Name and find every WmiPrvSE.exe row.
3. Add the PID column if it is missing.
4. Write down the PID of the copy that holds the CPU.

Note when, how, and the frequency of the CPU consumption. Check if there’s any activity, such as running specific tasks or services active, running monitoring applications, or running scripts, because it may also occur during a specific activity like user sign in or sign out.

When svchost.exe Is the Busy Process

If you observe that a svchost.exe process hosting the WMI service is causing high CPU usage and suspect that WMI is contributing to the issue, you can confirm if the PID of the svchost.exe process is hosting the WMI service with this command:

tasklist /svc /fi "Services eq Winmgmt"

If the svchost.exe process contains multiple services, you can break apart the WMI service into its own svchost.exe process from an elevated prompt, then restart the WMI service:

sc config Winmgmt type= own

After resolving the issue, you can place it back into the shared svchost.exe process with this command and one more restart:

sc config Winmgmt type= share

Watch One Instance Live in Performance Monitor

Open an elevated command prompt, and enter Perfmon. Then expand Process, select ID Process and all the WmiPrvse# instances, and then select Add > OK. For the ID Process counter, the Last, Average, Minimum, and Maximum all represent the PID of the respective WmiPrvse.exe process, so the matching instance is easy to spot. Then select %Processor Time for the WmiPrvse# matching the PID consuming high CPU usage, and then select Add > OK to graph it.

Step 2: Find the App Behind the Load in Event Viewer

The incoming queries are logged as operational events in the Microsoft-Windows-WMI-Activity/Operational log, and that log is where Microsoft’s guide finds the program behind a busy WMI Provider Host. It sits under Event Viewer > Applications and Services Logs > Microsoft > Windows > WMI-Activity.

1. Open Event Viewer.
2. Go to Applications and Services Logs > Microsoft > Windows > WMI-Activity and select Operational.
3. Open recent events and read the ClientProcessId field.
4. Match that number against the PID column in Task Manager.

In Microsoft’s sample, a logged query carries Operation = Start IWbemServices::ExecQuery – root\cimv2: select * from Win32_Product and ClientProcessId = 5484. Once you have narrowed down the client PIDs, use one of the following tools to find the process name: Task Manager, Process Explorer or Process Monitor.

Event ID 5857 records lines such as MS_NT_EVENTLOG_PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 556, which ties a provider to a host PID. That matters because the WmiPrvse.exe causing the issue may be terminated over time. When the issue occurs again, it may be the same provider(s) in a new WmiPrvse.exe instance.

Turn On the WMI Trace for More Detail

By default, WMI events are not traced. In Event Viewer, select View > Show Analytic and Debug Logs to enable the Debug and Trace for WMI-Activity, then right-click the Trace log, select Log Properties and click the Enable Logging check box to start the WMI event tracing. Turn the trace off again once you have your answer, so the log stays small.

To see which provider is doing the work, run Process Explorer as an administrator. Locate the identified WmiPrvse.exe PID, go to its properties, and select the WMI Providers tab. Each tool answers a different question:

Source: Microsoft Learn, Troubleshoot WMI high CPU usage issues, 2026

Step 3: Stop or Remove the App Making the Queries

Once you finalize the suspect, you may consider temporarily disabling its service or uninstalling the application associated with it and checking if the high CPU usage issue gets solved, Microsoft Learn advises. Disable first and confirm the CPU drops before you uninstall anything. Microsoft’s examples of suspects:

• Monitoring applications and services.
• System center configuration manager (SCCM) (policyhost.exe or Monitoringhost.exe).
• Powershell.exe running scripts containing WMI queries.
• Any third-party application.

Review and understand why the application performs this query and if it’s necessary. If it’s unnecessary in your environment, remove the application or stop it from performing the query. When the app is one you need, you can address this behavior with the application vendor. On a home PC, start with the monitoring and tuning utilities you installed yourself, and give background updaters such as jusched.exe, the Java update scheduler, the same scrutiny.

For security software, you can temporarily uninstall them and check for the issue. If removing the identified non-Microsoft product helps fix the issue, you can address this behavior of the product with the product vendor.

Step 4: Restart the Windows Management Instrumentation Service

Windows Management Instrumentation (WMI) runs as a service with the display name Windows Management Instrumentation and the service name winmgmt, per Microsoft Learn. A restart is the quickest reset after Step 3, with one catch: several other services depend on the WMI service, based on the operating system version that the system is running.

Run these from an elevated Command Prompt:

net stop winmgmt
net start winmgmt

Other services that are dependent on the WMI service also halt, such as SMS Agent Host or Windows Firewall, when you stop it, and other services that are dependent on the WMI service, such as SMS Agent Host or Windows Firewall, don’t automatically restart when you start it again. Restart the PC afterward if you are unsure what else stopped; a reboot brings every dependent service back.

Is it safe to end WMI Provider Host in Task Manager?

Ending it stops the current work, and the load can come straight back. The query handled by the stopped WmiPrvse.exe process and the application that initiates the process will fail, and when the issue occurs again, it may be the same provider(s) in a new WmiPrvse.exe instance. Treat it as a quick test only.

Should you disable WMI Provider Host?

No. WMI runs automatically at system startup under the LocalSystem account. If WMI isn’t running, it automatically starts when the first management application or script requests connection to a WMI namespace.

Stopping it for good also means that other services that are dependent on the WMI service also halt, such as SMS Agent Host or Windows Firewall. That trades a CPU symptom for a firewall gap.

Step 5: Check the WMI Repository Before You Touch It

Under any circumstances, do not delete the WMI repository as a first action because deleting the repository can cause damage to the system or to installed applications, Microsoft Learn warns. Check it with the winmgmt tool instead, which is located in the Windows System32 wbem directory.

winmgmt /verifyrepository
winmgmt /salvagerepository

• The /verifyrepository switch performs a consistency check on the WMI repository.
• The /salvagerepository switch performs a consistency check on the WMI repository, and if an inconsistency is detected, rebuilds the repository. The content of the inconsistent repository is merged into the rebuilt repository, if it can be read.
• With /resetrepository, the repository is reset to the initial state when the operating system is first installed, so keep it as the last resort.

Never delete the Repository folder: Deleting the repository can cause damage to the system or to installed applications. Older guides that rename or delete it skip the salvage step Microsoft built for this job.

What is the WMI repository?

The WMI repository, also known as the CIM repository, is a collection of files within the Repository folder that work together as a database. WMI uses the Common Information Model (CIM) industry standard to represent systems, applications, networks, devices, and other managed components.

How to Check That WMI Provider Host Is Not Malware

Microsoft’s Event ID 5857 example shows HostProcess = wmiprvse.exe running provider ntevt.dll from the system32 wbem folder under the system root, and the winmgmt tool is located in the Windows System32 wbem directory. A genuine WmiPrvSE.exe lives in C:\Windows\System32\wbem, and 64-bit Windows also runs a genuine 32-bit copy from C:\Windows\SysWOW64\wbem; a copy elsewhere deserves a scan.

1. In Task Manager, right-click the busy WmiPrvSE.exe on the Details tab and choose Open file location.
2. Confirm the folder is one of these two wbem folders:

C:\Windows\System32\wbem
C:\Windows\SysWOW64\wbem

1. If the path differs, or you are unsure, run an offline scan.

Even though Windows Security is turned on and scans your device automatically, you can perform an additional scan whenever you want.

Microsoft Defender Antivirus (offline scan) uses the latest definitions to scan your device for the latest threats. This happens after a restart, without loading Windows, so any persistent malware has a more difficult time hiding or defending itself. Microsoft Defender Offline will load and perform a quick scan of your PC in the Windows Recovery Environment. When the scan completes, your PC automatically restarts.

Is WMI a security risk?

Because LocalSystem is a privileged account, it is recommended that you set HostingModel to NetworkServiceHost when a provider is running in a Wmiprvse.exe process, Microsoft tells provider developers. The risk sits with the software calling WMI or a file posing as WmiPrvSE.exe, and an unfamiliar name proves nothing on its own, as the Vulkan Runtime Libraries entry shows.

WMIC Is Gone From Windows 11: What Replaced It

The WMIC utility has been removed from currently supported versions of Windows 11. The removal was included in the August 2026 preview update for Windows 11, versions 24H2 and 25H2, and in the September 2026 preview update for Windows 11, version 26H1, according to Microsoft Support. WMI is not being removed. Only the WMIC command-line tool is being removed.

The WMIC utility was deprecated in Windows Server 2012 in 2016 and has been removed from currently supported versions of Windows 11 in 2026, which is why older guides that start with a wmic command now fail. Microsoft’s replacement is PowerShell: replace the WMIC query wmic path win32_process get Name with the PowerShell command Get-CimInstance Win32_Process | Select-Object Name.

Get-CimInstance Win32_Process | Select-Object Name

If you still think in Command Prompt terms, our PowerShell vs CMD comparison covers the switch.

What replaced WMI?

Nothing replaced WMI itself. The next-generation of WMI, known as the Windows Management Infrastructure (MI), is currently available. MI is fully compatible with previous versions of WMI, and the WMIC deprecation applies to only the command-line management utility. WMI itself isn’t affected.

On Windows 10, Windows 10 has reached the end of support on October 14, 2025, so security fixes now depend on the ESU program.

Conclusion

In most scenarios, the CPU is consumed by the WmiPrvse.exe process, yet that process runs work that other programs request. Read the ClientProcessId in the WMI-Activity log, deal with that app, and keep service restarts and repository checks as the fallback; never disable the service or delete the repository to flatten a graph. Once the CPU settles, the broader Windows performance tweaks are worth a pass.

The WMIC utility has been removed from currently supported versions of Windows 11, with the removal included in the August 2026 preview update for Windows 11, versions 24H2 and 25H2, so PowerShell is now the command line for WMI queries on Windows 11, and the one worth learning.