windows - What's the link between a WMI using application and the WMIPrvSE.exe process?

Good morning,

This is already my third question on this site concerning WMI, hereby the links to my first question and my second question.
One of my customers is experiencing a problem, related to WMI (some queries are not working).
In Windows event log, some errors are shown (event ID 5858, explaining which query went wrong and why). Furthermore, we have seen warnings (event ID 5612), indicating that a quotum was breached, leading to the WMIPrvSE.exe process to be restarted:

Windows Management Instrumentation has stopped WMIPRVSE.EXE because a quota reached a warning value. Quota: PrivatePageCount Value: 548720640 Maximum value: 536870912

In order to verify general WMI behaviour, I've written a batchfile, launching a simple WMI query, every second. This batchfile is working fine, even when the WMI errors are occuring.

This is the problem:

1. My application launches WMI queries, going wrong.


2. Another application launches WMI queries, also going wrong.


3. When yet a third application (my batchfile) launches WMI queries, those are not going wrong.

When looking to my own system while launching WMI queries, I see that sometimes a new WMIPrvSE.exe process is created.

So my question is: what is the relation between an application, launching a WMI query, and the starting of a WMIPrvSE.exe process? (Sometimes this is done, sometimes not) Is there any rule/condition/... for that?

Also, when looking at my task manager, I see different usernames for the different WMIPrvSE.exe processes: in task manager, I see SYSTEM, NETWORK SERVICE and LOCAL SERVICE, but the query wmic process where name="WmiPrvSE.exe" get CSName only gives my own username.

Can anybody shed a light on this?