Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
Windows VM CPU spike to 100% because of WMI provider host
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 34%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAA%3C/text%3E%3C/svg%3E)
Azure Admin
0
Reputation points
Azure Virtual Machines
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 8%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHS%3C/text%3E%3C/svg%3E)
Himanshu Shekhar 255 Reputation points Microsoft External Staff Moderator2025-08-26T23:18:45.5233333+00:00 Hello Azure Admin
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
The Windows VM is experiencing a CPU spike to 100% due to the WMI Provider Host (WmiPrvSE.exe) process, which typically means a service, application, or script is continually querying WMI data
Identify the Process Behind High WMI Usage
Use Task Manager to confirm WmiPrvSE.exe is the culprit, then note its Process ID (PID).
- Open Event Viewer: Go to Applications and Services Logs > Microsoft > Windows > WMI-Activity > Operational
Look for recent errors and use the ClientProcessId in the logs to match the PID.
This reveals which process or application is causing high CPU utilization via WMI.
Restart the Windows Management Instrumentation Service
- Open Services (services.msc).
- Locate "Windows Management Instrumentation", right-click, and select Restart. Alternatively, in an elevated Command Prompt:
net stop Winmgmtnet start Winmgmt
Please refer the Microsoft documentation to troubleshoot WMI high CPU usage issues: https://learn.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/troubleshoot-wmi-high-cpu-issues?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#diagnose-wmiprvseexe
-
Azure Admin 0 Reputation points
2025-08-27T17:38:26.14+00:00 Hi Himanshu
Thanks for the guidance and the article. I had already restarted the Windows Management Instrumentation (winmgmt) service on the VM and that brought the WMI Provider Host (WmiPrvSE.exe) CPU back to normal. Since then, overall CPU utilization has been stable.
However, this VM is a session host for Azure Virtual Desktop, and we’re still seeing user-impacting issues: the published applications intermittently become unresponsive/freeze and show slowness, sometimes after a few minutes of idle time. We initially thought the high CPU was the root cause, but even with CPU normal the behavior returns.
Could you check whether there are any recent updates (Windows Updates, AVD Agent/Boot Loader, or the Windows App/AVD client) that might align with these symptoms? If there are known issues or mitigations, please let us know.
I can collect any diagnostics you need (AVD agent versions, Event Viewer logs, Perf counters, Azure Monitor metrics) to help you investigate.
Thanks!
-
Azure Admin 0 Reputation points
2025-08-27T17:40:04.4566667+00:00 Hi Himanshu
Thanks for the guidance and the article. I had already restarted the Windows Management Instrumentation (winmgmt) service on the VM and that brought the WMI Provider Host (WmiPrvSE.exe) CPU back to normal. Since then, overall CPU utilization has been stable.
However, this VM is a session host for Azure Virtual Desktop, and we’re still seeing user-impacting issues: the published applications intermittently become unresponsive/freeze and show slowness, sometimes after a few minutes of idle time. We initially thought the high CPU was the root cause, but even with CPU normal the behavior returns.
Could you check whether there are any recent updates (Windows Updates, AVD Agent/Boot Loader, or the Windows App/AVD client) that might align with these symptoms? If there are known issues or mitigations, please let us know.
I can collect any diagnostics you need (AVD agent versions, Event Viewer logs, Perf counters, Azure Monitor metrics) to help you investigate.
Thanks!
-
Himanshu Shekhar 255 Reputation points Microsoft External Staff Moderator
2025-08-29T00:07:36.6533333+00:00 Hello Azure Admin
Certain Windows Updates have caused issues with WMI Provider Host CPU spikes and session host instability. A known issue was linked to a problematic side-by-side (SxS) stack version (220817300) causing Remote Apps to freeze; an updated SxS version (350) fixed this. please refer the supportive documentation for more details here : https://techcommunity.microsoft.com/discussions/azurevirtualdesktopforum/remote-apps-stops-responding--users-feed-becomes-an-unresponsive-full-desktop-/3677594
Windows updates occasionally impact WMI stability, leads to CPU high usage and system freezing. Restarting the WMI service temporarily normalizes CPU. Ref article https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/troubleshoot-high-cpu-issues-azure-windows-vm
AVD agent or boot loader version outdated components may also cause session host instability and unresponsive published applications. So, reinstalling or updating the AVD agent and boot loader is recommended.
High CPU usage by the WMI Provider Host can result from a corrupted WMI repository, issues with third-party WMI providers, or malware.
Running sfc /scannow and reviewing WMI-Activity logs in Event Viewer are important diagnostic steps.
Gather Windows Event Logs for WMI and Application Errors
- Open Event Viewer (
eventvwr.msc) on each session host. - Navigate to Applications and Services Logs → Microsoft → Windows → WMI-Activity → Operational log to review WMI-related events.
- Check Application and System logs for errors, warnings, or critical events correlating with freeze timestamps.
Event Viewer logs and Azure Monitor performance counters can help determine if WMI errors or CPU spikes align with the times when freezes occur.
To capture Azure Monitor Metrics During Freezes:
In the Azure Portal, go to the resource group containing your AVD session host VMs.
- Open the Azure Monitor service and add performance metrics for each VM: CPU percentage, Available memory, Disk read/write operations etc.
Please ensure AVD agents on session hosts are up to date and properly connected to AVD services; reinstall and reboot the VM if necessary. Also, use the AVD management portal or PowerShell modules to see session host agent versions across hosts and check whether updated or not.
- Open Event Viewer (
Sign in to comment
Sign in to answer