WMI Provider Host taking up all of CPU

I didn't quite get you.

Thank you very much for your reply.

I will answer your questions from top to bottom first, of course in my mind you have become an engineer after this question!

1. I opened it with administrator privileges but it still reported “Access is denied” error. I re-tested and found that, in addition to this error, in fact, you also encountered “System error 5 has occurred”. There is also a request to “also stop services - Malwarebytes Service”.

I think there are two possibilities.

(1) Malwarebytes has bundled the WMI service invisibly to cause the problem, and the WMI service cannot be shut down without shutting down the Malwarebytes service.

This also corresponds to the use of Malwarebytes to detect malware as mentioned in your follow-up reply.

From a technical point of view I would suggest that you try to remove it, but to “cleanly remove” Malwarebytes you may need to borrow some other methods. Generally speaking, the usual uninstallation methods may not be able to uninstall it completely, because some antivirus programs can modify the registry and leave files or registry residues.

(2) In addition to this, there is also “System error 5 has occurred”, generally speaking, this error is reported that the user does not have the right to make changes, which is not because it is not run with administrator privileges. This is not because it was not run with administrator privileges, but because of the following possibilities:

 2.1 The blocking value has been tampered with by an application, e.g. Malwarebytes. 

 2.2 Some services are located in the system32 directory, and the current account is not the “Super Administrator account” (just a possibility). 

So I have a few suggestions to face this problem:

(1) Turn off the WMI service and Malwarebytes service at the same time. Unfortunately, since I personally do not have Malwarebytes on several test machines, I can't tell you the exact name of the service, so you can find it manually and turn it off.

Click “Windows Logo Key” to open the search bar -> type “Services” and open it with administrator privileges -> find all Malwarebytes related services in the list, change “Startup Type” to “Manual” and “Service Status” to “Stopped”.

(2) “Cleanly uninstall” Malwarebytes, please make sure to “cleanly uninstall” it!

(3) If you still can't execute the command to close WMI after closing Malwarebytes related services or clean uninstallation, please enable the Super Administrator account and log in.

Click “Windows Logo Key” to open the search bar -> Enter “cmd” in the search bar and open it with administrator privileges -> Please enter the following commands

net user administrator /active:yes

2. Thank you very much for the detailed information and video.

WMI is used by many applications for system monitoring, management and control, so it is indeed possible that the NVIDIA Container process you mentioned is the cause of the high WMI CPU activity.

Updating the BIOS works for the most part, but could potentially cause the problem to get worse.

However, in the current case, the fact that you removed the NVIDIA program but the problem still exists suggests that NVIDIA calls are not the only ones causing the problem, but there may be other applications or services that are constantly calling.

3. Clean Boot can be used both to identify third-party services or startup program conflicts and to locate them through dichotomization.

Generally you can do this:

(1) After running only half of the services to turn on the system, use the computer normally for a period of time to see if the WMI service is highly active

(2) If not, run the other half of the service.

Although clean boot uses only the smallest drivers and startup programs of Windows, it actually does not affect too much normal use. It is just possible that some applications are restricted or some external devices are restricted to avoid causing problems.

So you can open your poker session normally after clean start. Then just repeat the OK again.

For monitoring you can set up a new set of data collectors and log WMI and other metrics by using the Performance Monitor.

4. Downgrading to Windows 10 is indeed a practical approach from a testing point of view, and downgrading to Windows 11 will provide you with many fewer additional apps or features that may make playing poker easier and smoother.

Please note: In addition to backing up your data, downgrading from Windows 11 to Windows 10 may cause driver compatibility issues, which will require you to install the corresponding and compatible drivers.

I hope the information I've spent a lot of time testing will help you my friend without any problems :)

I look forward to hearing back from you. 

Best Regards

Arthur Sheng | Microsoft Community Support Specialist

Hey Arthur! Before I get to the points you've mentioned, just want to share an update - mentioning all things that I think could be of relevance.

I played a small session today and had my Task manager open at all times - WMI Activity was there sporadically but mostly topping off at 15%. Is there any % considered normal btw for WMI? Or it should just not take any CPU at all in a "normal" scenario?

At 15% - there's literally no lags in the PC barring sometimes just say if I'm typing, the text would appear in a second or so randomly in between.

Linking the video of the Event Viewer logs: https://gyazo.com/162e7526fe6907375cc4ba8acd1fa786

Things to note:

• The session was played between 7PM-1:30AM, as you can see in the end, there were no "errors" in the log for that time specifically. Is it possible for WMI to take up CPU even if there are no errors? Maybe because a lot of programs are "approaching" WMI (hence the CPU usage) but not getting errors prevents it from taking a bizarre number? Just my guesstimates.
• Early on 2:30PM or so, it shows some errors which I checked, again same culprits: Express VPN, ASUS Com Service and NVIDIA Container. Any way to tackle these as these programs have been the recurring theme?
• Maybe not very relevant but Windows update rolled up some updates for today and I did it.

.

1 - I would definitely do as you suggested for MalwareBytes but before that I still want you to know it's only been say 10-12 days since I installed the MB program. The WMI issue has been since the start. In fact, MalwareBytes was an attempt to remove malware which could be causing a problem.

I understand you're thinking of it as a threat/cause of the problem (my guesstimate was on the same lines) because it showed up as an "obstruction" when we tried stopping WMI through CMD. That is the thesis behind our decision to cleanly remove MB, right?

Also, just struck me when I was scrambling through YT finding a solution and I remember there was one solution which included CMD and typing these commands, probably these are WMI related processes:

I remember probably 3-4 of these didn't go through something similar to System Error 5 came up. This too was after installing MalwareBytes though - 2 days after.

Also, until and unless there are new solutions on the table to try based on the new info I gave; I should first - remove MB cleanly through your steps and THEN try recreating the problem and if it still persists we move to -> clean boot and then stress test in the same environment and last resort being the downgrading to Windows 10. Right?

Thank you for the additional information my friend.

1. The first thing is that the WMI is always around 15%. Actually the occupancy is still divided into points, because if there are multiple applications querying and calling WMI, there will be different occupancy. Personally though, it's still low, and probably around 6% at most when calling and querying as well.
2. In the event viewer you provided, I found the error event as:

WMI-Activity Event ID:5858 ResultCode:0x80041032

Since this involves a lot of highly technical jargon, I have personally summarized it to make it as understandable as possible for you.

Combining all our previous information, we can conclude that the cause of the problem is due to an application (WMI caller) calling and then retrieving the full result set and releasing it. But the client releases the termination link and then logs it once in the event viewer.

Such frequent logging indicates that there are unusual calls and their frequency is very high leading to similar problems. This also corresponds to what I illustrated in (1), that the more or more often an application calls and queries WMI, the higher the footprint.

I think we can start with this:

   (1) Go to Event Viewer and log “ClientProcessid = \*\*\*\*\*” in Error. 

   (2) “Ctrl + Shift + Esc” to open Task Manager, enter this PID and search for it to find out which service or application is running (should include Express VPN, ASUS Com Service and NVIDIA Container as you mentioned). 

  (3) Try right-clicking to disable it and wait a while to see if it still calls. (But considering that there is a VPN that you may need for your poker game, it is recommended that you just try it for now to find out why.) 

Actually, there is a solution to this problem, but I think it's a bit too technical and may not be particularly convenient.

The link is: WMI-Activity Event 5858 ResultCode 0x80041032 - Windows Client | Microsoft Learn.

3. Next, the CMD command. These commands are related to stopping and starting the WMI service, but several of them have the problem of “system error 5” when running. This should still be related to MalwareBytes, and after making sure we have administrator privileges, it can only be some third-party application blocking or service bundling that causes similar problems.
4. In fact, the clean start I proposed before is similar to disabling services that invoke WMI in 1. above, the clean start is based on disabling services to investigate and determine which services are causing the problem.

Clean start and clean uninstall MB is not the same program, clean uninstall MB is to prevent the third-party antivirus software has been uninstalled on the surface, but the registry and file residues still exist.

So I have these suggestions:

1. First execute according to the above 1. on the top
2. Execute the command to stop and start WMI after clean uninstalling MB.
3. Start it cleanly and find out which services it is by the dichotomy in the link. (Probably does the same thing as 1. but we can use it to be sure again)
4. If it can be solved without downgrading I think it may be more convenient, but if all other options do not work, I recommend you to try to downgrade to Windows 10 at the end of the day

I sincerely hope that the above solution will solve your problem.

I look forward to hearing back from you. 

Best Regards

Arthur Sheng | Microsoft Community Support Specialist