Why do I need the WMI Provider Host process, and why it loads the computer

If you delve into the structure of the operation of any operating system and see how many different processes are performed constantly, then the comparison of the work of computer components and the human brain does not seem so ridiculous. For an ordinary user, such an abundance may seem meaningless and extremely incomprehensible, since most of them simply do not directly affect the speed of the computer, and therefore is not an important aspect for its owner. But sometimes some processes can have a certain negative impact on the speed of the computer, and when the user opens the favorite “Task Manager” and sees that the CPU is loaded at 90%, many questions arise about why it is, who is to blame, and how fix it. This article will discuss one of the representatives of the mentioned processes called “WMI Provider Host”, as well as what is the point of its work and how to avoid the hang of the operating system.

Eliminating the WMI Provider Host process.

What is it and for what

So, the “WMI Provider Host” is a process launched by the executable file “WmiPrvSE.exe”, designed to centrally control the connected external equipment. It is present in all versions of Windows, has almost the same name and is an essential component for the correct functioning of the computer, and, therefore, its completion or deletion is highly undesirable and can lead to negative consequences. During normal / normal operation, the WMI Provider Host operating system does not have any effect on the system performance, and sometimes for a short period of time it can be activated for certain requests, but its effect on the CPU is equal to or near zero.

Therefore, if the “WMI Provider Host” has been “hanging in the leaders” for a long time by the “CPU” load, it already indicates the occurrence of malfunctions in the normal operation of the Windows operating system, which need to be solved to minimize the hangs. And taking into account the meaning of the existence and operation of the “WMI Provider Host”, we can single out the following “innocuous” causes of the problem:

  • connected new device / equipment;
  • the process of automatic installation or updating of drivers of the software of the connected device is activated;
  • simultaneous installation of software related to the operation of any device;
  • hidden operating system update;
  • excessive load on the video adapter as a result of activation of various visual effects.

Searching of decisions

Based on the above possible reasons, the initial range of actions should be defined, which imply the identification and elimination of sources of a hang:

  1. In the Task Manager, identify other processes that also have a significant impact on the CPU, since it is their appeal to WMI that can cause the problems in question. For analysis, perform the following manipulations:
    • Using the key combination "WIN + R" and the command "Eventvwr.msc" open the "Event Viewer" section;

    • then go through the “Application and Service Logs” - “Microsoft” - “Windows” - “WMI Activity” - “Operational” and pay attention to the last recorded errors;
    • Click on one of them and on the “General” tab, pay attention to the “ClientProcessID” parameter, where a specific process identifier will be indicated, which is the cause of a single error.

      It should be borne in mind that only the latest error records should be viewed, since the system automatically changes identifiers, and many of them will simply be irrelevant at the time of verification.
    • open the “Task Manager”, go to the “Details” tab, sort the list by the “ID” column and find the “culprit” whose number is indicated in the above-mentioned line “ClientProcessID”;
    • Further actions will depend on what was discovered, it can be the closing of the program, and its restart.
    • if the problem occurred after connecting any device or after any deliberate manipulation of the system files, turn them off, temporarily suspend all active actions and check the CPU load;
  2. Reboot the Windows Management Toolkit to do this:
    • press the key combination "WIN + R" and execute the command "services.msc";

    • in the “Services” window that opens, find the line “Windows Management Instrumentation” in the list, select it by clicking and click on the “Restart” button.

It is also worth noting that it would not be superfluous to check the correctness of the operating system performance in “Safe Mode”.


Unfortunately, quite often under the "WMI Provider Host" viral software is masked, and, despite the simplicity of identifying "fake", not every user responds promptly and correctly to the problem in question. Signs of action of viral software include:

  • Location - the system files are located in the appropriate folders - "Windows", "System", "System32", and most of the "ordinary viruses" can not access them;
  • To confirm this theory, open the “Properties” of the “WMI Provider Host” process and go to the “Details” tab, where you should pay attention to the signature in the “Authorship” line.

In addition, an indirect sign on the effect of viruses can be called the constancy of the load, which varies in the region of 85 - 90% relative to the "CPU". If the candidate being checked did not pass these checks, use any antivirus software, and also clean the registry in any convenient way.


In conclusion, it is worth noting that the above steps are also suitable for many other similar problems with system processes, and the usefulness of periodically checking the operating system for viral activity has long been known. In fact, the best solution would be to analyze all connected devices, including those on external data carriers, since they can also be carriers of virus software.

And the last thing to say is the senselessness of attempts to forcibly terminate WMI, since even after successful closure, which is far from always, it will be automatically restarted anyway.