# unsecapp.exe

Windows Process: Microsoft Corporation

Also called unsecapp, unsecured apartment, iwbemunsecuredapartment

Windows, System Component

WMI unsecured apartment. It is the sink process that receives asynchronous WMI callbacks for a client, not the provider host and not the performance adapter.

## What you need to know

unsecapp is the unsecured apartment callback sink, not the provider host.

unsecapp.exe implements IWbemUnsecuredApartment so a client can receive async WMI events in a dedicated process. WmiPrvSE.exe loads CIM providers. WmiApSrv.exe exposes WMI data as performance counters. Ending the sink does not stop Winmgmt.

- **Safe?**: Yes, in System32\wbem

  **Same as WmiPrvSE?**: No. This is the callback sink

  **Should I end it?**: The async consumer loses events

Feex says

If I see unsecapp next to a management tool, I look for the WMI consumer that opened the sink. I do not treat this filename as WmiPrvSE just because both say WMI.

## What is unsecapp.exe?

unsecapp.exe is the unsecured apartment callback sink. A WMI client that wants async events asks WMI to host IWbemUnsecuredApartment here. It is not WmiPrvSE.exe, which loads provider DLLs, and it is not WmiApSrv.exe, which is the performance adapter.

## What does it do?

It forwards IWbemObjectSink callbacks to the client so WMI can call back without taking over the client process. It does not answer CIM queries and it does not publish performance counters.

## Why is it running?

An inventory tool, a script, or a vendor suite opened an asynchronous WMI subscription. A quiet PC can still show it after a one-shot event query. High CPU here is the consumer, not a second provider host.

## Is it safe?

Usually safe

The Microsoft sink lives under System32\wbem. An unsecapp.exe in Downloads is not the unsecured apartment. The real file is a callback host, not WmiPrvSE.

A legitimate copy normally runs from:

`C:\Windows\System32\wbem\unsecapp.exe`

- Expected publisher: Microsoft Corporation
- Folder is System32\wbem, next to WMI binaries
- Sibling jobs: WmiPrvSE (providers), WmiApSrv (perf adapter)

## Can I end it?

Drops async events

Ending unsecapp.exe tears down that callback sink. The client stops receiving those WMI events until it opens another apartment. It does not unload CIM providers in WmiPrvSE.

## Can I remove it?

No

Do not delete unsecapp.exe. Async WMI clients need this sink. Stop the consumer application if you want fewer callbacks. Leave the System32\wbem file alone.

## Should it start with Windows?

WMI starts it when a client needs an unsecured apartment. It is not a Startup Apps checkbox.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Follows the event rate from the consumer

  **Memory**: Small unless the sink queues a flood

  **Disk**: Low

  **Network**: Remote WMI callbacks if a remote client subscribed

## File information

| Executable name        | unsecapp.exe                          |
| ---------------------- | ------------------------------------- |
| Common legitimate path | C:\Windows\System32\wbem\unsecapp.exe |
| Publisher              | Microsoft Corporation                 |
| Signature expectation  | Signed by Microsoft Windows           |

## Common problems

### People kill it thinking it is WmiPrvSE

Provider Host is a different image. This process only holds the async sink. The query storm, if any, still lives in the consumer or in WmiPrvSE.

### Stuck after a monitoring suite uninstall

A leftover subscription can keep the apartment alive. Remove the suite completely, then reboot, before you touch WMI repair.

## Troubleshooting

Diagnose before you change anything destructive.

### Identify the WMI consumer first

Process Explorer: parent, command line, and who opened the COM sink. That app is the article. unsecapp is only the mailbox.

### Do not reset the WMI repository because this filename appeared

A live unsecured apartment is expected during async queries. Repository reset is for corruption, not for a visible sink.

## Technical details

Technical details

| Image name | unsecapp.exe                          |
| ---------- | ------------------------------------- |
| Role       | IWbemUnsecuredApartment callback sink |

## Related

These entities connect to this article. Type is shown on every link.

[WmiPrvSE.exe: Windows Process](https://feex.it/wiki/process/wmiprvse.exe)[WmiApSrv.exe: Windows Process](https://feex.it/wiki/process/wmiapsrv.exe)[Windows Management Instrumentation: Windows Service](https://feex.it/wiki/service/windows-management-instrumentation)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: IWbemUnsecuredApartment ](https://learn.microsoft.com/windows/win32/api/wbemcli/nn-wbemcli-iwbemunsecuredapartment)· Unsecapp.exe hosts the unsecured apartment sink
- [Microsoft Learn: async WMI sink process ](https://learn.microsoft.com/windows/win32/wmisdk/lowering-the-security-for-a-sink-in-a-separate-process)· WMI creates Unsecapp.exe for callbacks
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: unsecapp.exe

  **Typical path**: C:\Windows\System32\wbem\unsecapp.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

  **Related process**: [WmiPrvSE.exe](https://feex.it/wiki/process/wmiprvse.exe)

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/unsecapp.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)