What is WmiPrvSE.exe and Why is it Running?
Wondering why WmiPrvSE.exe is running on your computer? This process runs right after booting up Windows 10, but it’s also found in Windows 7 and 8. Here’s the full story behind the process.
Have you come across WmiPRvSE.exe running in the Task Manager, and now you’d like to know what it is? You aren’t alone. This process runs right after booting up Windows 10, but it’s also found in Windows 7 and 8.
Microsoft created WmiPRvSE.exe and loads it as an integral part of Windows. A virus can sometimes hijack or imitate WmiPRvSE.exe, but those vulnerabilities haven’t been exploited on a mass scale in recent years.
What is WmiPrvSE?
WmiPrvSE is the acronym for Windows Management Instrumentation Provider Service. Or, as the description in Task Manager mentions, it is a WMI Provider Host.
A look through the process strings in Process Explorer reveals WmiPrvSE as part of Microsoft’s Web-Based Enterprise Management (WBEM) system and the Common Information Model (CIM) Microsoft Operations Manager (MOM, which is now known as SCOM [System Center Operations Manager.]) Of course, that doesn’t mean much unless you understand what these things mean.
What is SCOM, CIM, and WBEM?
First off, MOM (SCOM) is an event and analytics organizer and dispatcher. It handles security permissions, network reliability, diagnostics, data health, report writing, and performance monitoring.
CIM is a set of standards that allow for compliance between elements managed by an IT infrastructure.
WBEM is a system management technology protocol based on Internet standards that tie into the interface of how an application or operating system is managed. WMI is more or less Microsoft’s way of using WBEM.
In other words, without WmiPrvSE, applications in Windows would be tough to manage because the process is a host that allows all of the necessary management services to operate. Users and administrators would not likely receive notifications when errors occur. A look through Process Explorer shows WmiPrvSE as a child of svchost.exe.
In Windows Server, the process had a post-release problem that inflicted the operating server with overtaxed CPU utilization. But Microsoft patched the problem. Other instances where users have reported high CPU use involving this process were found as viruses that copied the name of this legitimate process.
Registry and System File Locations for WmiPrvSE
Relevant registry and system file locations for the process are:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\CompatibleHostProviders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\SecuredHostProviders
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{1F87137D-0E7C-44d5-8C73-4EFFB68962F2}\LocalServer32
C:\Windows\System32\wbem\WmiPrvSE.exeDon’t Worry, WmiPrvSE.exe is Safe
WmiPrvSE.exe is a safe process created by Microsoft and is needed for Windows to function properly. You should not shut it down or mess with it, but doing so won’t cause a catastrophic failure of the system.
Under normal conditions, WmiPrvSE has a small system footprint and only runs when you first launch Windows. If the process causes problems, it’s likely a virus with a copycat name.
25 Comments
Leave a Reply
Leave a Reply
Aldo Scattolon
September 30, 2013 at 9:06 am
This is the last time I ever buy a computer using Microsoft as an Operating Language. People who use Macintosh operating systems never have these kind of problems. So my next computer will be an Apple.
Nathan
October 14, 2013 at 10:52 pm
Good for you, I prefer a system that can actually run existing software.
Nesquik
October 29, 2015 at 6:20 pm
Magoo
shaun
April 25, 2015 at 10:30 pm
that didnt even make sense, seeing as this ISNT a problem, its an explanation of a specific process…. people using a “mac” lol macintosh, living in the 70s much? its an apple mac now, but yeah they also have a load of processes they dont understand, so its no different xD
Rygaard
May 4, 2017 at 12:39 am
Its funny how people always feel a need to state how bad Mac is – I have both mac and pc, pc for play time since i can run games that are not made for osx but anything professional i handle on my mac (if the program is made for it) – i sincerely doubt that all of thous who criticize mac, ever have taken the time to sit down and used a mac, and seen how much focus there are on making workflows easy.
Tony Graham
September 28, 2017 at 7:22 pm
I think she is trying to say that Apples (Macintosh), don’t get viruses. PC’s….? well, they are prone to a bunch! “Bunch” meaning me being conservatively facetious.
Chris
January 15, 2014 at 12:35 am
Should there be two of them? There are two in my task manager.
sohail
July 6, 2014 at 12:18 am
same for me should there be 2 of them and one is using up to 4% sometimes
Unknown
August 12, 2014 at 5:15 pm
I had 2 as well and one was trying to sync itself with another process but the legit process wouldn’t leave resulting in a conflict so I got rid of the sync process then the virus wouldn’t do anything
ROBERT DEL ROSSO
April 22, 2016 at 4:48 pm
Well, I only have ONE WmiPrvSE.exe and it’s only using 2,916 KB. And my CPU % is currently running at 16% to 45%, depending on how many windows I have open. Now, it’s 12 Websites and 6 MS Word Files, so 45% is good.
About a week ago, I had only about 3 Websites and 1 or 2 MS Word files open and CPU was at 100%! So I Googled “CPU at 100%” and the results pointed to “WmiPrvSE.exe”, whcih was using a lot of K or KB, about 40,000 K, I can’t remember the exact number.
I clicked to show all Processes and right clicked on it to end it, but it did not “end” but the amount of K it used dropped by about 90% and CPU % fell by about 50%.
Then I could not get back to the Performance Tab– Windows Task Manager was stuck on the “Processes” Tab and I had no Idea what my CPU % was!
I googled “how to show Performance Tab”? and was told to double click on the border of the processes Tab and I got back my Performance Tab to see CPU was back to normal!
Still, this is strange and Evil, the way that Virus writers try to mimic legitimate Programs. Like the Alien in the Movie “Mimic”!
frustrated
March 11, 2015 at 9:01 pm
If my computer is the only one at home why would I need my OS to be “Web-Based Enterprise Managed” ? I’ve tried killing the process, and every time a new one appears right away. At one point task manager showed I had 2 “terminated” and a new one appeared running. This is my home machine, I do not have an IT dept “managing” my machines at home. One more reason I need to switch to Linux and run Windows if I need it in a VM or with WINE.
Mike M
June 11, 2015 at 6:36 am
Ok I also don’t understand the explanation, I don’t have a network it’s a stand alone computer with a cable connection. This file is eating up cpu time, I have re-installed “Norton” per their instructions. This file just started causing problems a couple of months ago. I see a ton of crap as to what it is, but not why anti-virus can’t seem to see it when it is a virus, or how to check/get rid of.
Peter Rabbit
June 21, 2015 at 9:11 am
Mike me too, I am having the same issue. All I do is surf the net with a regular DSL router yet every time I boot up to the internet this thing shows up and knocks me right off line. It shows up along side “windows installer” and poof my internet connection is lost. It says it’s not a virus but it sure acts like one!
Surinder
July 28, 2015 at 11:16 pm
I have been using Windows OS right from win3.1 and always felt why not a OS be compact and install those files very essential to run the PC and then let the user pick additional services that he wants to have viz.. my lappy is stand alone, do I need to have network drivers installed by default? No. Same is the case with printer spooler svc. Unneeded services keep running without your notice, bring down the performance. Right from Win95 to Win7 I have not seen major change in functional OS but the space it occupies kept raising. IF I just required a mini CD to install Win95 now I require DVD over 7GB to install latest OS with SP1,2,3. If your OS has so many holes, why you announce the release to the world, force us to upgrade (for lack of service for older OS) and put an additional costs ?
Maurick3
October 31, 2016 at 1:13 pm
That program does exist. I think it’s called Ubuntu and runs on a linux-platform ^^ It’s user friendly and fully programmable/customizable
jack
September 4, 2015 at 6:18 am
please help me mine takes 57% of my cpu and i cant run shit
Kenny Smith
December 3, 2015 at 10:25 am
I am having this problem also and mine has 5 wpmprv or whatever thingys running and my computer performance is crap now , I have run anti-virus and re-configured everything I know how to do and can’t get rid of this computer problem ,its now up to eating 71%, Someone plz help me !!!!
mohamed nady
January 3, 2016 at 9:56 am
i use win 10 and it take 4% of my cpu and system tell my that their is a problem with file like this (HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/WBEM/CIMOM/CompatibleHostProviders) what shod i do please
mike o
February 9, 2016 at 1:29 pm
I have a desktop & a laptop that have this problem; 40+ % of CPU. Also get an occasional error message. It seems as if I started having this problem, as well as others, after updating to Windows 10.
Gary Overton
July 15, 2016 at 8:31 am
I don’t Know that is helpful I seem to have this same problem and my anti-virus program blocks this as well but is it really safe to run wbem I decided to delete the folder but not all files and the repository folder can be deleted because they are being used by other processes.will look for more info and post it here
Alex
July 24, 2016 at 7:42 am
I’m running into this issue too. Starting to think that the answer may be to upgrade to Ubuntu. I am so sick on Windows BS and Microsoft in general.
sean
August 10, 2016 at 4:52 am
i am at this post since i also noticed this wmi thing running recently, it does not seem to cause problems, sometimes i end the task other times it just disappears on it’s own, i’ve run w8 since 2012 up to end 2015 without a day’s problem and i hammer my machine then i connected to the net and problems started, as with previous poster i also wonder why there are so many processes running, are they ALL necessary? sometimes it’s like trying to get to God to get some answers and understand whats going on!
Unknown
August 29, 2016 at 2:52 pm
Sounds like big brother, aka USA is watching you all. Use windows key. In search type in services.msc , right click on it, and run as administrator. Scroll down till you see Windows Management Instrumentation and double click on it. Click stop, and yes if other processes are using it. Now under starttype: Select deactivated. Click apply and ok. Now restart your computer. Once restarted, update your antivirus and malware scanners. And run a full system scan with both. I recommend downloading spybot 2.4, update it, and do a full system scan with that. https://www.safer-networking.org/private/compare/ However although spybot is free to use, it don’t work well with antiviruses. If you already have an antivirus I sugest you use malwarebytes, less efficient but works same time with most antivirus software. Once you done a full system scan remove all infected files if any. Then restart your computer again. Now it should all work as intended. If you wish to keep having it disabled then simply do nothing. However your security center will be disabled along with network logging the government uses. To activate it again: simply go back into services.msc as you did previously, and under starttype: select automatic click apply, then ok, and restart your comp again. Best of luck.
Tak
January 22, 2018 at 11:34 am
Lets all look at the elephants in the room shall we…
1) Microsoft works directly with the NSA (and thus CIA and FBI), and runs software on your machine which has nothing to do with its performance and everything to do with gathering information about you for them and their company and third parties who they can sell your infromation to. The practice is illegal by our 4th ammendment and many privacy and intellectua property laws as well. It is also theft of real money in terms of our time and wasted CPU cycles on OUR machines.
2) Microsoft is an illegal monopoly by our anittrust laws.
3) Microsoft abuses the patent system by not patenting its its codes and hardware/software
manipulations, illegitimatel labeling them as “trade secretes” so it can keep them
indefinitely so they never go into the public domain, where they belonged decades
ago. As a result, it becomes has become a stagnant protectionist company
and makes processes which cripple rather than improve processing of your machine.
With all these elephants, do you think we should trust ANY process which is poorly documented
by M$ and does not have thorough 3rd party inspection from this company. I think no.
idk
June 2, 2021 at 2:24 am
yea btw the thing ewiprvse thing is taking 30 persent of my cpu and my cpu is going through the 100 usage prob so i want to fix it