WmiPrvSE.exe running in background at system start-up after 4 minutes?

Hello, I started noticing that in recent days that whenever I turn on my computer and launch Task Manager. After approximately 4 minutes WmiPrvSE.exe starts running in the background as a SYSTEM username. I have done this experiment with multiple restarts and it always starts running after 4 minutes.

This is without me actually launching any programs at all. Now 2 years ago I did notice this happening but at least the diagnosis was related to Google Chrome.

Now in recent days I have started noticing this running in background after 4 minutes and will only end after 15 minutes and 57 seconds. So around the 16 minute mark it would disappear.

I did a system restore from last months date on October just for the benefit of the doubt and I am still noticing the same behaviour! No errors are showing in Event Viewer log and no integrity violations with SFC /Scannow.

Is there a way to find out what is triggering this to start after 4 minutes on Windows start up? This was never happening before!!! Now all of a sudden I started noticing this weird behaviour. It is not using much memory or CPU usage and no network activity.

I checked the exe file and it hasn't been tampered. My Windows 10 Pro version is 1903 (OS Build 18362.720).

I am not even launching any programs. My start-up programs are set to disabled.

I'd appreciate if someone can shed some light into this.

- - - Updated - - -


Ok, so I noticed that after 4 minutes and 30 seconds of system boot WMIADAP.exe (WMI Reverse Performance Adapter Maintenance Utility) will launch in the background, triggering WmiPrvSE.exe to run and it will remain there for 16 minutes before it goes away.

Seriously what is going on!! This has never been the case before. I am not being paranoid. This behaviour is not something I have noticed before ever in the last 2 years since running Windows 10. Something recent has occurred and system restore to an earlier date will not help either.

I have 4 of these all in legitimate locations. Anyway to find out what is triggering them to start after 4 minutes at system startup???

See if this help you get to the bottom of it: What Is the WMI Provider Host (WmiPrvSE.exe), and Why Is It Using So Much CPU?

I have some related errors in my Event Viewer like they mentioned in the article, but no excessive CPU or anything.

@steve108 Yes, I read that. It does say "The WMI Provider Host process is an important part of Windows, and often runs in the background. It allows other applications on your computer to request information about your system."

The problem is why the hell is WMIADAP.exe and WmiPrvSE.exe launching at system boot 4 minutes and 30th second as SYSTEM processes?! No one is able to tell me that. This suggests, this behaviour is not normal!!

I use Windows 10 Pro last 2 years. I open my Task Manager regularly to have a look. This is the first time I have witnessed this weird behaviour. In fact I have never seen WMIADAP.exe run in the background on my Windows 10 system last 2 years!

Something has happened these past few days. Not only that, it is randomly launching every half an hour/1 hour in the background! I return back from dinner/breakfast. Open Task Manager and I see this WmiPrvSE.exe running as a SYSTEM process when nothing else and no programs were opened/ nor running in the background.

Although it is indeed using only 0% CPU and less than 1MB RAM. I am finding this extremely bizarre. I have uninstalled Opera GX, CCleaner. Reset WMI, did multiple system restores to dates when I did not experience this at all and none of this helps.

System restore should've solved it. Unless this is some sort of malware.

Is there a way to find out what is triggering this at the 4th minute and 30 seconds on system boot? This is a schedule of some sort. But I want to know what is triggering WMIADAP.exe because that is what then triggers WmiPrvSE.exe and they launch as SYSTEM processes, not as NETWORK.

Even in Safe Mode with only Drivers loaded is making this run.

I scanned my computer with Malwarebytes. Sadly no threats are detected after 4 hours.

I was hoping for it to be a virus then at least if it was removed then the issue would've been solved. Unfortunately even then WMIADAP.exe still runs after 4 minutes and 30 seconds on my Windows 10 system.

Interestingly enough, I tested on my mum's Windows 7 machine and the exact same behaviour is occurring. But on my dad's Windows 8.1 system WMIADAP.exe does not get triggered nor WMIPrvSE.exe!

At this stage I'm pretty lost. Maybe my next attempt is to update Windows 10 to latest version and if that doesn't fix it then I may have to reformat Windows and reinstall from scratch. It's extremely disappointing to see that neither system restore worked, nor virus can can detect any threats! SFC /Scannow can't detect violations either and no one is able to tell me here on these forums their experiences either.

I done yesterday a 3 hours Windows 10 update from 1903 to 20H2. Sadly this made things even worse! Not only doesn't it not solve the issue. Temporarily it stopped triggering WMIAdap at restart but then it magically came back.

Now I also have 2x WmiPRvSE.exe running at system startup! I am completely lost!

Before this never happened. What is triggering a second NETWORK SERVICE of this to start? This is after Windows 10 update 20H2. Before that I was using 1903 and this wasn't happening.

I also got new WMI Errors. Event ID. Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-22C5PHI; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1444; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : Select * from NvWmiBrightness; ResultCode = 0x8004100C; PossibleCause = Unknown

This seems to be related to NVDisplay.Container.exe Is this benign? I updated graphics card drivers but it still triggers this WMI Activity error.
Also going back to WmiPRvSE.exe the Network Service disappears. But the WmiPRvSE.exe SYSTEM SERVICE is now always running in the background. Doesn't leave even after 16 minutes like before. I seriously regret updating Windows to 20H2. If I knew I would've stayed on 1903. But I guess I have to live with these issues...

Yes, I too have seen 2x WmiPrvSE.exe before as SYSTEM and NETWORK. But now I have this problem where the one with SYSTEM hasn't disappeared from running in the background.

For 3 hours and 50 minutes my PC is on and this thing is still running in the background and not disappeared.

In Windows 10 1903 I was using it for 2 years without updating windows as I use Windows Update Blocker tool! Recently a problem occurred where I will get WMIADAP.exe to run in the background after 4 minutes triggering WmiPRvSE.exe. Normally WmiPrvSE.exe would disappear after 16 minutes.

Prior to that for 2 years this issue never ever happened! I never needed to troubleshoot or ask on the forum for help regarding this.

I updated Windows 10 to 20H2 although not a fresh install but an upgrade. I thought this will solve the WMIADAP running after 4 minutes and now the situation has been made worse!

The NETWORK one on startup disappears after a couple of minutes but the SYSTEM process now remains forever. I checked the WMI Activity folder in Event Viewer and I get this new error related to NvWmiBrightness; ResultCode = 0x8004100C; PossibleCause = Unknown. I believe this is what's causing it, but I don't know how to fix this.

So after nearly 4 months since re-installing Windows 10 the issue with WMIADAP.exe and WmiPrvSE.exe is back!!!

But guess what?! This time I have diagnosed the cause of the issue, it is related to the Daylight saving time zone clock change. The clock went 1 hour up as of last night at 1am UK time!

I turned on my computer earlier today and despite the clock being updated. WMIADAP.exe and WmiPrvSE.exe came back after 4 minutes and 26 seconds. WMI-Activity presented with 5 new Errors never seen before!

Error: Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-TJVRPR9; User = NT AUTHORITY\SYSTEM; ClientProcessId = 180; Component = Unknown; Operation = Start I WbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\Windows\\System32\\drivers\\en-US\\processr.sys.mui[PROCESSORWMI]"; ResultCode = 0x80041032; PossibleCause = Unknown

Error: Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-TJVRPR9; User = NT AUTHORITY\SYSTEM; ClientProcessId = 180; Component = Unknown; Operation = Start I WbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\Windows\\System32\\drivers\\en-US\\mssmbios.sys.mui[MofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown

Error: Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-TJVRPR9; User = NT AUTHORITY\SYSTEM; ClientProcessId = 180; Component = Unknown; Operation = Start I WbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\Windows\\System32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]"; ResultCode = 0x80041032; PossibleCause = Unknown

Error: Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-TJVRPR9; User = NT AUTHORITY\SYSTEM; ClientProcessId = 180; Component = Unknown; Operation = Start I WbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\Windows\\system32\\en-US\\kernelbase.dll.mui[MofResourceName]"; ResultCode = 0x80041032; PossibleCause = Unknown

Error: Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-TJVRPR9; User = NT AUTHORITY\SYSTEM; ClientProcessId = 180; Component = Unknown; Operation = Start I WbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\Windows\\System32\\drivers\\ACPI.sys[ACPIMOFResource]"; ResultCode = 0x80041032; PossibleCause = Unknown

Anyway, WmiPrvSE.exe kept running for 30 minutes in task manager before it disappeared. I restarted the PC one more time and it returned again after just over 4 minutes.

This time those errors didn't repeat but WMI-Activity shows Information: WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4620; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll

This time it disappeared after 15 minutes and 50 seconds. So it is clear that the Day Time Zone changes trigger this behaviour!!!

Last time October 31st 2021 was the last clock change and I came across the same problem, but never quite managed to diagnose the behaviour trigger.

Now this time the clock went 1 hour ahead and Windows 10 is triggering this behaviour again. Maybe it's related to me disabling Windows 10 Update through group policy editor. Windows 10 identifies the clock change but maybe thinks it's not right or something?

if you go into services, is yours set to automatic like mine, or delayed start (like the lower box on the image)?

It is set to Automatic. And it starts as a SYSTEM process. Nothing has changed on my end, setting-wise aside from the clock.

WMI-Activity log shows. WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3724; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll 28/03/2022 15:35:21

Around 5 hours later just now it started again. WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3696; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll 28/03/2022 20:30:38

The two processes WMIADAP.exe and WmiPrvSE.exe just appeared as I returned back to the PC.

No settings have changed on my end. I have been observing Task Manager every day at system start up like obsessed for the last 4 months!

The moment this bloody Daylight Saving Time Zone Change occurred as of 1am on the 27th of March, this triggered these two processes to start up again the following day!

When I reformatted Windows 10, 4 months ago to fix this issue I didn't know what it was. But In October 30 2021 there was another Time Zone Change and that also triggered them to start, I suspected it to be the culprit but still wasn't sure. I thought it was a virus or something. Because this behaviour doesn't look normal at all.

But now it seems that it appears that every 5-6 months when there is a Daylight Saving Zone Time change, it triggers WMI Adapter to start after 4 minutes and 30 seconds! This is why system restore doesn't work because the clock that needs to be corrected will continue to trigger this behaviour.

After a few minutes indeed, they disappear. But they will randomly return again.

I re-enabled Windows 10 update again to see if this will help. There's very little information on this. Some say this will disappear by itself. But in my case it persisted for 2 months previously before I gave up and reformatted Windows 10.

Though I admit even when I did do a fresh re-install in December 4th 2021 4 months ago first few days it did appear and then it disappeared altogether until yesterday's return following Daylight Saving when clock went an hour ahead.