wmiadap.exe

Windows ProcessMicrosoft Corporation

Also called wmiadap, wmi reverse adapter, adap

WindowsSystem Component

WMI reverse adapter. It refreshes AutoDiscovery / AutoSync of performance libraries into WMI. It is not WmiPrvSE.exe serving live queries.

What you need to know

wmiadap syncs PerfLib into WMI. It is not WmiPrvSE serving queries.

wmiadap.exe is the reverse adapter WMI runs to refresh performance-library objects into the CIM repository. WmiPrvSE.exe is the provider host that answers Get-CimInstance. WmiApSrv.exe is the other direction: WMI data as counters. A short wmiadap run after a counter install is expected.

Safe?: Yes, in System32\wbem
Does it answer queries?: No. WmiPrvSE does
Why did it run?: WMI asked it to sync PerfLib

Feex says

If I see wmiadap flash after I installed a performance counter, I let the sync finish. I do not end WmiPrvSE to "stop ADAP."

What is wmiadap.exe?

wmiadap.exe syncs PerfLib into WMI. It is the reverse adapter, not WmiPrvSE.exe serving queries. WMI starts it to refresh Win32_Perf* classes after counters change.

What does it do?

It parses performance libraries and updates WMI class state. It does not sit around answering scripts. WmiPrvSE.exe loads providers for those queries. WmiApSrv.exe publishes WMI as PDH counters.

Why is it running?

Winmgmt scheduled a reverse-adapter pass, a counter installer ran, or someone invoked wmiadap /f. A copy that never exits after hours is stuck sync, not a query storm.

Is it safe?

Usually safe

System32\wbem\wmiadap.exe is Microsoft. A wmiadap.exe in Temp is not. This file still does not replace WmiPrvSE as the query host.

A legitimate copy normally runs from:

C:\Windows\System32\wbem\wmiadap.exe

Reverse adapter / ADAP refresh
Often started by WMI, not by you
Query host remains WmiPrvSE.exe

Can I end it?

The PerfLib sync stops

Ending wmiadap.exe aborts that refresh. CIM queries through WmiPrvSE can continue with stale counter classes. Do not end Provider Host to stop ADAP.

Can I remove it?

Do not delete wmiadap.exe. WMI needs the reverse adapter after counter changes. Disabling Winmgmt is a different, wider decision.

Should it start with Windows?

WMI starts it on demand. It should not be a Startup Apps checkbox.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: A burst while it parses libraries
Memory: Small
Disk: Repository and PerfLib reads
Network: None for a local refresh

File information

wmiadap.exe file information
Executable name	wmiadap.exe
Common legitimate path	C:\Windows\System32\wbem\wmiadap.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

People kill WmiPrvSE when ADAP runs

That drops live queries. wmiadap is a one-shot sync. Let it finish, then look at the consumer if CPU stays high.

Missing Win32_Perf classes after a counter install

A failed wmiadap pass is the usual story. Re-run the documented refresh. Do not replace WmiPrvSE.

Troubleshooting

Diagnose before you change anything destructive.

Wait for the reverse adapter, then re-query

If you just installed counters, give wmiadap a minute. wbemtest against Win32_Perf* is the check. WmiPrvSE load is a later step.

Do not reset the repository because wmiadap appeared

A scheduled ADAP run is normal. Repository reset is for corruption, and it still is not a substitute for this exe.

Technical details

wmiadap.exe technical details
Image name	wmiadap.exe
Role	WMI reverse adapter (PerfLib into WMI)

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Performance Libraries and WMI · ADAP / reverse adapter moves PerfLib into WMI
Microsoft Learn: WMI start page · Live CIM queries are provider hosts, not wmiadap
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.