WmiApSrv.exe

Windows ProcessMicrosoft Corporation

Also called wmiapsrv, wmi performance adapter, wmi performance reverse adapter

WindowsSystem Component

WMI Performance Adapter service (wmiApSrv). It exposes WMI data as performance counters for PDH clients. It is not the CIM provider host.

What you need to know

WmiApSrv is the performance adapter, not the provider host.

WmiApSrv.exe is the WMI Performance Adapter. PerfMon and other PDH callers can read WMI-backed counters through this service. WmiPrvSE.exe still loads CIM providers for scripts and wbemtest. Ending the adapter does not stop Winmgmt queries.

Safe?: Yes, in System32\wbem
Same as WmiPrvSE?: No. This is the performance adapter
Why did it start?: Something asked for those counters

Feex says

If I see WmiApSrv appear when a monitor tool opens, I treat that as counters, not as a second WmiPrvSE. I look at who called Performance Data Helper.

What is WmiApSrv.exe?

WmiApSrv.exe is the WMI Performance Adapter. The service name is wmiApSrv. It publishes WMI data in the performance-counter shape PDH expects. It is not WmiPrvSE.exe, the CIM provider host.

What does it do?

It answers performance-library calls that map onto WMI. It does not load arbitrary CIM providers for Get-CimInstance. wmiadap.exe is the reverse adapter that refreshes PerfLib into WMI, a different direction.

Why is it running?

PerfMon, a vendor dashboard, or another PDH client asked for WMI-backed counters. The service is often Manual and starts only for that call.

Is it safe?

Usually safe

The adapter in System32\wbem is Microsoft. A WmiApSrv.exe in Temp is not. Seeing this file is not proof that WmiPrvSE is "the same process."

A legitimate copy normally runs from:

C:\Windows\System32\wbem\WmiApSrv.exe

Service name: wmiApSrv
Starts when Performance Data Helper needs WMI counters
Not WmiPrvSE.exe

Can I end it?

Those counters go dark

Ending WmiApSrv.exe drops PDH callers that were using the adapter. CIM queries through WmiPrvSE can continue. The service may start again on the next counter read.

Can I remove it?

Do not delete WmiApSrv.exe. Disable the WMI Performance Adapter service only if you accept missing WMI-backed counters. That is not a WmiPrvSE uninstall.

Should it start with Windows?

wmiApSrv is typically Manual. A PDH client starts it. It should not sit in Startup Apps.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Rises while a tool polls those counters
Memory: Small
Disk: Low
Network: Remote performance clients if something queries this PC

File information

WmiApSrv.exe file information
Executable name	WmiApSrv.exe
Common legitimate path	C:\Windows\System32\wbem\WmiApSrv.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Event log spam that the adapter started and stopped

Manual start plus a chatty monitor will do that. Set the service Automatic only if you want fewer start events, not because WmiPrvSE is busy.

Empty counters, WMI scripts still work

That split is the clue. Scripts use providers in WmiPrvSE. This process is the performance adapter path.

Troubleshooting

Diagnose before you change anything destructive.

Find the PDH client

PerfMon, Resource Monitor, or a vendor "health" tray. Close that tool as a test. If WmiApSrv exits, you found the caller.

Do not repair Winmgmt because this service flickered

A Manual adapter starting on a counter read is documented. Repository reset is a different problem.

Technical details

WmiApSrv.exe technical details
Image name	WmiApSrv.exe
Service	wmiApSrv

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Performance Libraries and WMI · WMI and performance counter bridging
Microsoft Learn: WMI start page · CIM providers run in WmiPrvSE, not this adapter
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.