WMI Provider Host (wmiprvse.exe) using high CPU because of check_mk_agent: Reset WMI Performance Counters

Are you encountering high CPU usage on Windows Management Instumentation Provider Host (wmiprvse.exe). We encountered this problem after power failure on a Windows 2012 R2 server. After the reboot the server showed very high CPU, sometimes even 100%.

We tracked don’t the cause of the problem to our monitoring tool check_mk. It seemed that stopping the check_mk_agent service stopped the spiking of the CPU usage. And it started again sometime after starting the service. Anyway the solution had nothing to do with the check_mk monitoring, but was actually symptom of corrupted WMI performance counters.

Solution

You need to reset the WMI performance counters. This happens by running the following commands in Windows Command Prompt in elevated mode.

1. Enter the Command Prompt by typing cmd.exe to the search box or after opening Start menu. Right-clicking the icon and choose Run as administrator.
2. Type in to the Command Prompt: cd c:\windows\system32
3. Type in: lodctr /R
4. Type in: cd c:\windows\sysWOW64
5. Type in: lodctr /R
6. Type in: winmgmt.exe /resyncperf

After this either reboot the machine or restart the services (Performance Logs and Alerts, Windows Management Instrumentation, check_mk_agent). After the reboot the CPU usage problem was gone and the monitoring worked as before.