unsecapp.exe

Windows ProcessMicrosoft Corporation

Also called unsecapp, unsecured apartment, iwbemunsecuredapartment

WindowsSystem Component

WMI unsecured apartment. It is the sink process that receives asynchronous WMI callbacks for a client, not the provider host and not the performance adapter.

What you need to know

unsecapp is the unsecured apartment callback sink, not the provider host.

unsecapp.exe implements IWbemUnsecuredApartment so a client can receive async WMI events in a dedicated process. WmiPrvSE.exe loads CIM providers. WmiApSrv.exe exposes WMI data as performance counters. Ending the sink does not stop Winmgmt.

Safe?: Yes, in System32\wbem
Same as WmiPrvSE?: No. This is the callback sink
Should I end it?: The async consumer loses events

Feex says

If I see unsecapp next to a management tool, I look for the WMI consumer that opened the sink. I do not treat this filename as WmiPrvSE just because both say WMI.

What is unsecapp.exe?

unsecapp.exe is the unsecured apartment callback sink. A WMI client that wants async events asks WMI to host IWbemUnsecuredApartment here. It is not WmiPrvSE.exe, which loads provider DLLs, and it is not WmiApSrv.exe, which is the performance adapter.

What does it do?

It forwards IWbemObjectSink callbacks to the client so WMI can call back without taking over the client process. It does not answer CIM queries and it does not publish performance counters.

Why is it running?

An inventory tool, a script, or a vendor suite opened an asynchronous WMI subscription. A quiet PC can still show it after a one-shot event query. High CPU here is the consumer, not a second provider host.

Is it safe?

Usually safe

The Microsoft sink lives under System32\wbem. An unsecapp.exe in Downloads is not the unsecured apartment. The real file is a callback host, not WmiPrvSE.

A legitimate copy normally runs from:

C:\Windows\System32\wbem\unsecapp.exe

Expected publisher: Microsoft Corporation
Folder is System32\wbem, next to WMI binaries
Sibling jobs: WmiPrvSE (providers), WmiApSrv (perf adapter)

Can I end it?

Drops async events

Ending unsecapp.exe tears down that callback sink. The client stops receiving those WMI events until it opens another apartment. It does not unload CIM providers in WmiPrvSE.

Can I remove it?

Do not delete unsecapp.exe. Async WMI clients need this sink. Stop the consumer application if you want fewer callbacks. Leave the System32\wbem file alone.

Should it start with Windows?

WMI starts it when a client needs an unsecured apartment. It is not a Startup Apps checkbox.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Follows the event rate from the consumer
Memory: Small unless the sink queues a flood
Disk: Low
Network: Remote WMI callbacks if a remote client subscribed

File information

unsecapp.exe file information
Executable name	unsecapp.exe
Common legitimate path	C:\Windows\System32\wbem\unsecapp.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

People kill it thinking it is WmiPrvSE

Provider Host is a different image. This process only holds the async sink. The query storm, if any, still lives in the consumer or in WmiPrvSE.

Stuck after a monitoring suite uninstall

A leftover subscription can keep the apartment alive. Remove the suite completely, then reboot, before you touch WMI repair.

Troubleshooting

Diagnose before you change anything destructive.

Identify the WMI consumer first

Process Explorer: parent, command line, and who opened the COM sink. That app is the article. unsecapp is only the mailbox.

Do not reset the WMI repository because this filename appeared

A live unsecured apartment is expected during async queries. Repository reset is for corruption, not for a visible sink.

Technical details

unsecapp.exe technical details
Image name	unsecapp.exe
Role	IWbemUnsecuredApartment callback sink

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: IWbemUnsecuredApartment · Unsecapp.exe hosts the unsecured apartment sink
Microsoft Learn: async WMI sink process · WMI creates Unsecapp.exe for callbacks
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.