I have looked at a number of questions related to wmiprvse cpu usage, but none of the situations fit exactly. I have no error codes. The cpu for wmiprvse stays in the range of 10-20%. As far as I can see, there is no inordinate memory usage (about 20% of 8gb).
If I suspend "svchost.exe (RPCSS)" in the Resource Monitor, cpu for wmiprvse.exe drops to nothing.
As far as I can tell there's nothing special about this machine (running Windows Professional 64-bit) and two other Windows 7 machines, one running 64-bit Professional, the 64-bit Premium.
When I try to trace events for "WMI-Activity" I get a message when I start the trace:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
In the trace I get a pattern similar to:
GroupOperationId = 362; OperationId = 258119; Operation = Start IWbemServices::ExecQuery - select * from Win32_Process; ClientMachine = Local; User = .\SYSTEM; ClientProcessId = 0; NamespaceName = \\.\root\CIMV2
ProviderInfo for GroupOperationId = 362; Operation = Provider::CreateInstanceEnum - Win32_Process; ProviderName = CIMWin32; ProviderGuid = {d63a5850-8f16-11cf-9f47-00aa00bf345c}; Path = %systemroot%\system32\wbem\cimwin32.dll
Stop OperationId = 258119
N.B. the ClientProcessId=0.
Tracing while RPCSS is suspended yields no entries in the log.
{d63a5850-8f16-11cf-9f47-00aa00bf345c} is the 'WBEM Framework Instance Provider", which is probably not the real cause.
Where do I go next?
