

Copy and paste the following command into the command prompt window (if this does not work, you may need to manually type it in): >, enter "CMD.exe" w/o the quotation marks and then press Enter.Ģ. Short, high resolution log – 1 sec interval with thread counter, 250MB Restart the service or machine and verify result is Win32_SHARE_PROCESS when youĬonfigure Perfmon Collection using logman.exe methodĬapture 15 minutes while issue is occurring. When issue had been resolved or no longer needing the service broken out into its own svchost process, place it back into the shared svchost process by running following command from command prompt: To ensure status of service now reflects “own” indicating running in its own svchost process

Open command prompt with elevated privileges If you suspect the WMI (Windows Management Instrumentation) service, you can break it out following directions below. As such, I would suggest breaking it out first into its own, and monitor to see if it is the one driving up high memory usage in the shared svchost process. From my experience, it will be the WMI service more times than not but not always. If multiple services, it may become necessary to break each service out to run in its own svchost process to determine if it is the WMI service (winmgmt) that is causing the issue. From inside a command prompt you can type inĪnd look for the PID #, and identify if a single service is running in that svchost process or multiple services. If it is a svchost process showing high cpu usage, you can use Task Manager and add PID column, then identify which svchost process has the high memory usage. By default, WMI runs in the main shared networking svchost process with several other services. In the directions below, you may have already broken out Provider (wmiprvse.exe) is consuming high amounts of CPU. Windows Management Instrumentation Service First published on TECHNET on Aug 12, 2014
