I manage several different clients who are having some client workstations that hit 100% CPU utilization constantly. I've checked Process Explorer and noticed that wmiprvse is taking about 40% of the CPU, and one of the svchost processes is taking 10% or so. When I suspend svchost, usage drops down to 1% or so.
The wmipsrvse process has several (15 or so) kernel32.dll threads running.
C:\windows\system32\wbem\logs\wbemess.log is filled with:
(Sun Jul 13 19:13:26 2008.180565279) : Aborting polling query 'select * from Win32_Service' because the quota for memory used by polling is exceeded
(Sun Jul 13 19:13:26 2008.180565329) : Polling query 'select * from Win32_Service' failed with error code 0x8004106C. Will retry at next polling interval
The query is being given 5-10 times each second.
When I disable the Windows Management Instrumentation service, CPU usage drops to 1% or so.
Is there any way to see from where that WMI query is coming? Has anybody seen this behavior before?
We have some management software (Level Platforms Managed Workplace) that I suspect, but the behavior continues when I disable it, so I'm not sure.