wmiprvse.exe pegging a CPU
Pretty much since the beginning I've noticed wmiprvse.exe hogging one of two cores in my test machine.
Seaching elsewhere I saw a suggestion to see what file handles were open by the process. I don't think this tells us very much:
C:\Windows\System32>handle c:|find "4160"
WmiPrvSE.exe pid: 4160 8: C:\Windows\System32
WmiPrvSE.exe pid: 4160 7C: C:\Windows\System32\en-US\user32.dll.mui
WmiPrvSE.exe pid: 4160 288: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f
I can kill the wmiprvse.exe process from Task Manager, but it tends to re-appear an hour later (+/- 30 min.).
I haven't tricked out Windows 8 very much... but due to the lack of any matches in these forums when searching for "wmiprvse.exe cpu" I am guessing my situation is not common. First thing I did was remove antivirus, but the problem continues.
I'm sure I can start a brand new clean install of Windows 8, and slowly add things back until the problem recurs but that's not exactly optimized troubleshooting.
Found a blog post about using netmon to diagnose this kind of problem, but the winmgmt svchost process has 0 network traffic during the time that wmiprvse.exe is consuming a core.
Suggestions?
- Edited by
Carl Houseman
Monday, October 15, 2012 11:25 PM
October 16th, 2012 2:24am
Carl,
I have been experiencing the same behavior. I am curious are you seeing this on a Win8 box joined to a domain? I seem to have only caught it doing it with boxes that are domain joined. We have also seen it on a "clean" windows
8 box that had no software.
Ryan
October 17th, 2012 6:06pm
Yes, it is joined to a domain. It's my only test subject so far.
October 17th, 2012 7:47pm
I do not have high CPU usage in the System process. That article is not helpful in any way.
October 22nd, 2012 5:41am
Try this:
http://blogs.technet.com/b/askperf/archive/2008/03/04/wmi-debug-logging.aspx
October 22nd, 2012 11:49am
OK, so I enabled logging by changing the registry (the GUI no longer provides the logging tab referenced in that Windows-XP-era article).
I noticed shortly after that the log files were created and a couple of things logged so the logging was working. Walked away from the computer for a few minutes.
When I came back, wmiprvse.exe was doing its CPU pegging thing. I killed the process and looked at the two log files (FrameWork.log and wmiprov.log) and they were exactly the same as they were before wmiprvse.exe misbehaved. Nothing new had been
added to identify the source this problem.
Next in line please.
October 22nd, 2012 8:29pm
Can't tell if that's supposed to be a joke or not. I thought so at first and LOL'd, but then I wondered if maybe you might be serious. The thing that's spinning the CPU is not malware.
October 23rd, 2012 3:01am
Use ProcessMonitor and look at the callstacks of WmiPrvSE.exe. Maybe you see some information.
October 23rd, 2012 9:18am
Yeah, and maybe I can reverse compile the code and fix the problem while I'm at it?
News flash, I'm not a sysinternals guru.
So I've done my duty by reporting the problem so that hopefully MS now has some idea that it exists. I have no time to put into "maybe" investigations that amount to looking for a needle in a haystack. I'm willing to run any automated
tool to provide diagnostic information, or if there's a patch that needs testing, I'm happy to do that.
Meanwhile, I won't recommend that anyone try to use Windows 8 in a domain environment until the problem magically stops happening on my test machine following installation of some update.
October 23rd, 2012 9:32am
In case it helps. The issue appears to be with combase.dll loaded by wmiprvse.exe
From Process explorer:
combase.dll!CRpc ThreadCache::RpcWorkerThreadEntry
October 31st, 2012 4:20pm
this is not useful. Which other Software do you run?
October 31st, 2012 9:50pm
Out of curiosity, were these systems on which the problem is being seen upgrades to Windows 7 or clean installs to a blank volume?
For upgrades, there seem to be a fair number of reports of interference by previously installed antivirus programs (e.g., Avast).
October 31st, 2012 10:45pm
Mine began with a clean install and the problem continues with no antivirus installed whatsoever (beyond the built-in Defender).
November 1st, 2012 1:04am
Which other software do you have installed?
November 1st, 2012 1:08am
stadler17 previously stated that the problem was observed on a clean install with no added software. I'll let him provide his list of software as it will contain fewer items to research.
For mine, I'm probably going to tear it down and do another clean install to test migration, so I'll install nothing but MS-provided updates and watch carefully to see whether the problem comes back in that condition, before and after joining
to the domain.
November 1st, 2012 1:22am
Testing has been on domain joined Windows 8 clean install. No software installed.
Seems to be linked to Folder redirection. When user GPO setting folder redirection is set the issues occurs. Does not seem to occur when no folder redirection GPO is applied.
- Marked as answer by
Leo HuangMicrosoft contingent staff, Moderator
Monday, November 05, 2012 9:28 AM
- Unmarked as answer by
Carl Houseman
Thursday, January 17, 2013 4:15 PM
November 1st, 2012 2:57am
Have confirmed that the wmiprvse.exe using a cpu core is caused by folder redirection. Confirmation was done by creating a new clean 2008R2 Domain controller. Creating a share on a 2008R2 file share. Putting the path to the share in the user's
home dir path in object, and finally redirecting user's "Documents" folder to %homeshare%%homepath%
Clearly this is a bug. Not sure how any enterprise deployment of Windows 8 using folder redirection can occur until this is fixed.
Nice job Beta Testers! :-/
November 6th, 2012 7:14pm
The worst of it is that right here, in this thread, we have a clear statement of a reproducible bug, and a precise derivation of specifically what causes it - yet as with so many other bona fide bugs reported here on Microsoft's own forums, Microsoft
does not see fit to write "thank you for the heads-up, we've entered it as a bug in our problem reporting system and hope we'll have a fix soon."
Does anyone important at Microsoft know about this, or care? We may never know.
November 6th, 2012 8:18pm
I found it came up when I ran Network Meter under gadgets. When I shut the meter down, the CPU settled down as well. Hope that helps.
January 2nd, 2013 1:37am
I want to thank you, stadler17, for your effort to determine a causative factor for this bug. However, a moderator tried to mark your explanation as the answer, and I unmarked it, because it does not solve the problem.
Not using folder redirection to avoid this bug is not an acceptable workaround nor solution. When someone writes that a hotfix has fixed the problem, I'll mark that as the answer.
- Edited by
Carl Houseman
Thursday, January 17, 2013 4:25 PM
January 17th, 2013 7:24pm
You should contact the support directly via Phone so that a hotfix is created for you.
January 17th, 2013 11:13pm
I don't require a hot fix created especially for me, I expect a hotfix to be created for everybody because this is an obvious flaw that will hamper deployment in businesses and elsewhere that use folder redirection.
By posting here I expect that someone at Microsoft has become aware of the problem, assuming they have any interest whatsoever in keeping track of what's been newly broken that needs fixing.
If that isn't good enough, I can offer contract terms for helping Microsoft fix their product so that it gains greater acceptance.
- Edited by
Carl Houseman
Thursday, January 17, 2013 8:25 PM
January 17th, 2013 11:23pm
no, creating a hotfix requires directly contact to the Support.
January 17th, 2013 11:41pm
Excuse me for playing fast and loose with terminology. Then I don't want a hotfix. I want a KB article with downloadable update that resolves the problem.
Or, if you consider a KB article with downloadable update and a hotfix the same thing, then I guess this bug will continue and product acceptance will stagnate until either Microsoft recognizes that it can fix problems on its own, or
somebody else contacts Support about it. As I've said, I've done my duty by calling attention the problem. My clients and I can keep using Windows 7 for quite some time, and I will certainly warn clients against using Windows 8
until such time that easily reproduced issues such as this are fixed.
- Edited by
Carl Houseman
Thursday, January 17, 2013 9:36 PM
January 18th, 2013 12:34am
nice to hear that the update fixes your issue :)
March 15th, 2013 9:22am
I tried downloading the hotfix on my Windows 8 machine, and says the update is not applicable to this computer.
It says it's only applicable to Windows 8 RTM? What the hell?
- Edited by
demetri90
Tuesday, May 21, 2013 3:40 PM
May 21st, 2013 6:37pm
I'm running Windows 8, and wmprvse.exe has suddenly started consuming 20-30% CPU. Looked in Program and Features and found Conduit Search Protect has been installed without me noticing it (I believe it came with a VLC installation). Removed
it and now back to less than 1%. Needless to say I hate these sneaky add-on programs installing themselves...
- Proposed as answer by
Vikingvid
Thursday, May 23, 2013 12:44 AM
- Edited by
Vikingvid
Thursday, May 23, 2013 12:46 AM
- Unproposed as answer by
Carl Houseman
Thursday, May 23, 2013 12:53 AM
May 23rd, 2013 3:43am
Thanks Carl for the follow up. It sounds like my problem too!
January 16th, 2014 6:06pm