Increase WMI memory to support large volume of queries

Since I started expanding my Zabbix scripts and templates for monitoring Windows Server instances – AD, IIS and SQL Server – I found WMI was failing more and more. WMI stopped working: WmiPrvse.exe would just crash after hitting some memory limit of 512 MB. If you run into the same issue with Windows Management Instrumentation, here is how you can increase WMI Provider Service’s memory quota. Doing so resolved these issues.

Windows Server logs WMI messages in Microsoft-Windows-WMI-Activity/Operational. Monitor this log in Zabbix if you want to 🙂 .

First, to increase WMI memory (and in my case: handles) quota, execute the following in an elevated PowerShell session:

$oWMI=get-wmiobject -Namespace root -Class __ProviderHostQuotaConfiguration
$oWMI.MemoryPerHost = 1024*1024*1024
$oWMI.MemoryAllHosts = 2048*1024*1024
$oWMI.HandlesPerHost = 6144
$oWMI.put()

This increases MemoryPerHost to 1024*1024*1024 MB (1 GB) and MemoryAllHosts to 2 GB.

• MemoryPerHost: Defines the amount of private memory that can be held by each host
• MemoryAllHosts: Defines the combined amount of private memory (in bytes) that can be held by all hosts

Using WMI in Group Policy? WMI Filters for Group Policy to manage Windows Server versions

These settings can be found in WBEMTEST by following these steps:

1. Run “wbemtest” on your PowerShell or cmd.exe prompt
2. Connect to the “root” namespace (not “root\default” or “root\cimv2”, just “root”)
3. Select Open Instance, and specify “__ProviderHostQuotaConfiguration=@“
4. Check “Local Only” for easier readability, and you will see the threshold values
5. Change the WMI properties you want to optimize (MemoryPerHost, ThreadsPerHost) value to something greater
6. Save Property
7. Save Object
8. Exit

I chose to also increase the HandlesPerHost quota limit, from its default 4096 (as shown above) to 6144. You need to increase ThreadsPerHost if you see the following error message

Windows Management Instrumentation has stopped WMIPRVSE.EXE because a quota reached a warning value. Quota: ThreadCount  Value: 260 Maximum value: 256 WMIPRVSE PID: 368892 Providers hosted in this process:
%windir%\system32\wbem\servercompprov.dll, %systemroot%\system32\wbem\cimwin32.dll

Next, you can move the process to run in the COM Infrastructure group, so it starts closely after RPCSS:

Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Winmgmt -Name 'Group' -Value 'COM Infrastructure'

And last (but not least) move the Winmgmt service to a standalone Svchost process. Default level 4 (RPC_C_AUTHN_LEVEL_PKT):

winmgmt /standalonehost

Reboot or restart the Windows Management Instrumentation service and you’ll notice a more reliable WMI.

The source for this information, where I found it, is in cluberti.com’s post Make WMI more robust to large volumes of queries (Wayback Machine archived link). There is more on WMI @ Microsoft’s Tech Community.