Pretty much since the beginning I've noticed wmiprvse.exe hogging one of two cores in my test machine.

Seaching elsewhere I saw a suggestion to see what file handles were open by the process.  I don't think this tells us very much:

C:\Windows\System32>handle c:|find "4160"
WmiPrvSE.exe       pid: 4160      8: C:\Windows\System32
WmiPrvSE.exe       pid: 4160     7C: C:\Windows\System32\en-US\user32.dll.mui
WmiPrvSE.exe       pid: 4160    288: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f

I can kill the wmiprvse.exe process from Task Manager, but it tends to re-appear an hour later (+/- 30 min.).

I haven't tricked out Windows 8 very much... but due to the lack of any matches in these forums when searching for "wmiprvse.exe cpu" I am guessing my situation is not common.   First thing I did was remove antivirus, but the problem continues.

I'm sure I can start a brand new clean install of Windows 8, and slowly add things back until the problem recurs but that's not exactly optimized troubleshooting.

Found a blog post about using netmon to diagnose this kind of problem, but the winmgmt svchost process has 0 network traffic during the time that wmiprvse.exe is consuming a core.

Suggestions?

• Edited by Carl Houseman Monday, October 15, 2012 11:25 PM

Carl,

I have been experiencing the same behavior.  I am curious are you seeing this on a Win8 box joined to a domain?  I seem to have only caught it doing it with boxes that are domain joined.  We have also seen it on a "clean" windows 8 box that had no software.

Ryan

Yes, it is joined to a domain.  It's my only test subject so far.

Hi,

I suggest to use Process Explorer and KernRate to troubleshoot the high usage of CPU.

Detail steps you can refer this blog:

http://blogs.technet.com/b/markrussinovich/archive/2008/04/07/3031251.aspx

It could help you to determine which device or driver cause the issue.

Regards,

Leo   Huang

I do not have high CPU usage in the System process.  That article is not helpful in any way.

Try this:

http://blogs.technet.com/b/askperf/archive/2008/03/04/wmi-debug-logging.aspx

OK, so I enabled logging by changing the registry (the GUI no longer provides the logging tab referenced in that Windows-XP-era article).

I noticed shortly after that the log files were created and a couple of things logged so the logging was working.  Walked away from the computer for a few minutes.

When I came back, wmiprvse.exe was doing its CPU pegging thing.  I killed the process and looked at the two log files (FrameWork.log and wmiprov.log) and they were exactly the same as they were before wmiprvse.exe misbehaved.  Nothing new had been added to identify the source this problem.

Next in line please.

Can't tell if that's supposed to be a joke or not.   I thought so at first and LOL'd, but then I wondered if maybe you might be serious.   The thing that's spinning the CPU is not malware. 

Use ProcessMonitor and look at the callstacks of WmiPrvSE.exe. Maybe you see some information.

Yeah, and maybe I can reverse compile the code and fix the problem while I'm at it?

News flash, I'm not a sysinternals guru.

So I've done my duty by reporting the problem so that hopefully MS now has some idea that it exists.  I have no time to put into "maybe" investigations that amount to looking for a needle in a haystack.  I'm willing to run any automated tool to provide diagnostic information, or if there's a patch that needs testing, I'm happy to do that. 

Meanwhile, I won't recommend that anyone try to use Windows 8 in a domain environment until the problem magically stops happening on my test machine following installation of some update.

In case it helps.  The issue appears to be with combase.dll loaded by wmiprvse.exe

From Process explorer:

combase.dll!CRpc ThreadCache::RpcWorkerThreadEntry

this is not useful. Which other Software do you run?

Out of curiosity, were these systems on which the problem is being seen upgrades to Windows 7 or clean installs to a blank volume?

For upgrades, there seem to be a fair number of reports of interference by previously installed antivirus programs (e.g., Avast).

 

Mine began with a clean install and the problem continues with no antivirus installed whatsoever (beyond the built-in Defender). 

Which other software do you have installed?

stadler17 previously stated that the problem was observed on a clean install with no added software.  I'll let him provide his list of software as it will contain fewer items to research.  

For mine, I'm probably going to tear it down and do another clean install to test migration, so I'll install nothing but MS-provided updates and watch carefully to see whether the problem comes back in that condition, before and after joining to the domain.

Testing has been on domain joined Windows 8 clean install.  No software installed.

Seems to be linked to Folder redirection.  When user GPO setting folder redirection is set the issues occurs.  Does not seem to occur when no folder redirection GPO is applied.

• Marked as answer by Leo HuangMicrosoft contingent staff, Moderator Monday, November 05, 2012 9:28 AM
• Unmarked as answer by Carl Houseman Thursday, January 17, 2013 4:15 PM

Have confirmed that the wmiprvse.exe using a cpu core is caused by folder redirection.  Confirmation was done by creating a new clean 2008R2 Domain controller. Creating a share on a 2008R2 file share.  Putting the path to the share in the user's home dir path in object, and finally redirecting user's "Documents" folder to %homeshare%%homepath%

Clearly this is a bug.  Not sure how any enterprise deployment of Windows 8 using folder redirection can occur until this is fixed.

Nice job Beta Testers! :-/

The worst of it is that right here, in this thread, we have a clear statement of a reproducible bug, and a precise derivation of specifically what causes it - yet as with so many other bona fide bugs reported here on Microsoft's own forums, Microsoft does not see fit to write "thank you for the heads-up, we've entered it as a bug in our problem reporting system and hope we'll have a fix soon."

Does anyone important at Microsoft know about this, or care?  We may never know.

 

I found it came up when I ran Network Meter under gadgets. When I shut the meter down, the CPU settled down as well. Hope that helps.

I want to thank you, stadler17, for your effort to determine a causative factor for this bug.   However, a moderator tried to mark your explanation as the answer, and I unmarked it, because it does not solve the problem.   Not using folder redirection to avoid this bug is not an acceptable workaround nor solution.   When someone writes that a hotfix has fixed the problem, I'll mark that as the answer.

• Edited by Carl Houseman Thursday, January 17, 2013 4:25 PM

Although you've already pin-point the cause, I wonder if this the procedure, described in this thread: Why does WMI Provider Host (WmiPrvSE.exe) keep spiking my CPU? could've been helpful?

You should contact the support directly via Phone so that a hotfix is created for you.

I don't require a hot fix created especially for me, I expect a hotfix to be created for everybody because this is an obvious flaw that will hamper deployment in businesses and elsewhere that use folder redirection.

By posting here I expect that someone at Microsoft has become aware of the problem, assuming they have any interest whatsoever in keeping track of what's been newly broken that needs fixing.

If that isn't good enough, I can offer contract terms for helping Microsoft fix their product so that it gains greater acceptance.

• Edited by Carl Houseman Thursday, January 17, 2013 8:25 PM

no, creating a hotfix requires directly contact to the Support.

Excuse me for playing fast and loose with terminology.  Then I don't want a hotfix.  I want a KB article with downloadable update that resolves the problem.

Or, if you consider a KB article with downloadable update and a hotfix the same thing, then I guess this bug will continue and product acceptance will stagnate until either Microsoft recognizes that it can fix problems on its own, or somebody else contacts Support about it.   As I've said, I've done my duty by calling attention the problem.   My clients and I can keep using Windows 7 for quite some time, and I will certainly warn clients against using Windows 8 until such time that easily reproduced issues such as this are fixed.

• Edited by Carl Houseman Thursday, January 17, 2013 9:36 PM

Looks like they finally got around to this... downloading now, fingers crossed!

http://support.microsoft.com/kb/2810203/en-us?sd=rss&spid=16796

1 hour later - no pegged CPU.  I like this answer.

• Edited by Carl Houseman Thursday, March 14, 2013 10:38 PM
• Marked as answer by Carl Houseman Thursday, March 14, 2013 10:39 PM

nice to hear that the update fixes your issue :)

I tried downloading the hotfix on my Windows 8 machine, and says the update is not applicable to this computer.

It says it's only applicable to Windows 8 RTM? What the hell?

• Edited by demetri90 Tuesday, May 21, 2013 3:40 PM

I'm running Windows 8, and wmprvse.exe has suddenly started consuming 20-30% CPU.  Looked in Program and Features and found Conduit Search Protect has been installed without me noticing it (I believe it came with a VLC installation).  Removed it and now back to less than  1%.  Needless to say I hate these sneaky add-on programs installing themselves...

• Proposed as answer by Vikingvid Thursday, May 23, 2013 12:44 AM
• Edited by Vikingvid Thursday, May 23, 2013 12:46 AM
• Unproposed as answer by Carl Houseman Thursday, May 23, 2013 12:53 AM

Thanks Carl for the follow up.  It sounds like my problem too!