WMI Provider Host taking up all of CPU

Hey Arthur! Again thanks for the extensive research and testing you have carried out for me. If there's any portal or avenue where I can pay you for your service thus far and for future replies, I would like to do so, or anything else really as a token of gratitude. :)

Couple of things I saw, one I don't know if it's related to this or not but my Boot time (IDK if that's exactly what it's called - the time from when I turn the CPU on and the screen shows up with Republic of Gamers and boots up) was one random time up to 4-5 mins. Like I switched on the CPU and thrice force shut it through long pressing the power button and 4th time it actually started after a 2-4 minute delay. I don't know if it's relevant. I don't know but don't think it's a hardware problem, there are no heating issues as well.

1 - Thank you for the explanation. I tried doing this:

It again said access denied to even stop the MB service.

Video: https://gyazo.com/1a0d50cf8668ded5fac46300f0aebd54

I enabled the super administrator command:

And tried after this, unfortunately the same error occurred.

That's what i was supposed to do to clean uninstall MB right? I couldn't find any more steps I could try.

2 - Glad to know clean boot won't interfere with the normal working. So does that also mean if the WMI problem doesn't occur I can just use the PC in clean boot mode itself? Also, I'm assuming our objective of doing a clean boot is to find what "programs/services" are creating this issue - haven't we already achieved that via the PID indexing and match them up to the processes?

3 - Even though as a poker player, I love problems and have a curious mind so I really don't wanna give up on this half way but more and more I dive deep into it, my threshold of understanding is getting hit and I may not efficiently follow instructions etc. I'm beginning to think rebooting and downgrading to Win 10 is the most convenient way to go about it. :|

Hi Gaurav,

Please try the clean boot procedure Arthur.SH - MSFT recommended earlier. A clean boot is the process of starting Windows without loading third-party apps and services. It's a safe procedure.

For more information, see this Microsoft article.

How to perform a clean boot in Windows - Microsoft Support:

https://support.microsoft.com/en-us/topic/how-to-perform-a-clean-boot-in-windows-da2f9573-6eec-00ad-2f8a-a97a1807f3dd

(Step 3 is very important. You need to first enable "Hide all Microsoft Services" before clicking "Disable all".)

Thank you for the additional information my friend.

1. The first thing is that the WMI is always around 15%. Actually the occupancy is still divided into points, because if there are multiple applications querying and calling WMI, there will be different occupancy. Personally though, it's still low, and probably around 6% at most when calling and querying as well.
2. In the event viewer you provided, I found the error event as:

WMI-Activity Event ID:5858 ResultCode:0x80041032

Since this involves a lot of highly technical jargon, I have personally summarized it to make it as understandable as possible for you.

Combining all our previous information, we can conclude that the cause of the problem is due to an application (WMI caller) calling and then retrieving the full result set and releasing it. But the client releases the termination link and then logs it once in the event viewer.

Such frequent logging indicates that there are unusual calls and their frequency is very high leading to similar problems. This also corresponds to what I illustrated in (1), that the more or more often an application calls and queries WMI, the higher the footprint.

I think we can start with this:

   (1) Go to Event Viewer and log “ClientProcessid = \*\*\*\*\*” in Error. 

   (2) “Ctrl + Shift + Esc” to open Task Manager, enter this PID and search for it to find out which service or application is running (should include Express VPN, ASUS Com Service and NVIDIA Container as you mentioned). 

  (3) Try right-clicking to disable it and wait a while to see if it still calls. (But considering that there is a VPN that you may need for your poker game, it is recommended that you just try it for now to find out why.) 

Actually, there is a solution to this problem, but I think it's a bit too technical and may not be particularly convenient.

The link is: WMI-Activity Event 5858 ResultCode 0x80041032 - Windows Client | Microsoft Learn.

3. Next, the CMD command. These commands are related to stopping and starting the WMI service, but several of them have the problem of “system error 5” when running. This should still be related to MalwareBytes, and after making sure we have administrator privileges, it can only be some third-party application blocking or service bundling that causes similar problems.
4. In fact, the clean start I proposed before is similar to disabling services that invoke WMI in 1. above, the clean start is based on disabling services to investigate and determine which services are causing the problem.

Clean start and clean uninstall MB is not the same program, clean uninstall MB is to prevent the third-party antivirus software has been uninstalled on the surface, but the registry and file residues still exist.

So I have these suggestions:

1. First execute according to the above 1. on the top
2. Execute the command to stop and start WMI after clean uninstalling MB.
3. Start it cleanly and find out which services it is by the dichotomy in the link. (Probably does the same thing as 1. but we can use it to be sure again)
4. If it can be solved without downgrading I think it may be more convenient, but if all other options do not work, I recommend you to try to downgrade to Windows 10 at the end of the day

I sincerely hope that the above solution will solve your problem.

I look forward to hearing back from you. 

Best Regards

Arthur Sheng | Microsoft Community Support Specialist

Hey Arthur! Before I get to the points you've mentioned, just want to share an update - mentioning all things that I think could be of relevance.

I played a small session today and had my Task manager open at all times - WMI Activity was there sporadically but mostly topping off at 15%. Is there any % considered normal btw for WMI? Or it should just not take any CPU at all in a "normal" scenario?

At 15% - there's literally no lags in the PC barring sometimes just say if I'm typing, the text would appear in a second or so randomly in between.

Linking the video of the Event Viewer logs: https://gyazo.com/162e7526fe6907375cc4ba8acd1fa786

Things to note:

• The session was played between 7PM-1:30AM, as you can see in the end, there were no "errors" in the log for that time specifically. Is it possible for WMI to take up CPU even if there are no errors? Maybe because a lot of programs are "approaching" WMI (hence the CPU usage) but not getting errors prevents it from taking a bizarre number? Just my guesstimates.
• Early on 2:30PM or so, it shows some errors which I checked, again same culprits: Express VPN, ASUS Com Service and NVIDIA Container. Any way to tackle these as these programs have been the recurring theme?
• Maybe not very relevant but Windows update rolled up some updates for today and I did it.

.

1 - I would definitely do as you suggested for MalwareBytes but before that I still want you to know it's only been say 10-12 days since I installed the MB program. The WMI issue has been since the start. In fact, MalwareBytes was an attempt to remove malware which could be causing a problem.

I understand you're thinking of it as a threat/cause of the problem (my guesstimate was on the same lines) because it showed up as an "obstruction" when we tried stopping WMI through CMD. That is the thesis behind our decision to cleanly remove MB, right?

Also, just struck me when I was scrambling through YT finding a solution and I remember there was one solution which included CMD and typing these commands, probably these are WMI related processes:

I remember probably 3-4 of these didn't go through something similar to System Error 5 came up. This too was after installing MalwareBytes though - 2 days after.

Also, until and unless there are new solutions on the table to try based on the new info I gave; I should first - remove MB cleanly through your steps and THEN try recreating the problem and if it still persists we move to -> clean boot and then stress test in the same environment and last resort being the downgrading to Windows 10. Right?