# wmiadap.exe

Windows Process: Microsoft Corporation

Also called wmiadap, wmi reverse adapter, adap

Windows, System Component

WMI reverse adapter. It refreshes AutoDiscovery / AutoSync of performance libraries into WMI. It is not WmiPrvSE.exe serving live queries.

## What you need to know

wmiadap syncs PerfLib into WMI. It is not WmiPrvSE serving queries.

wmiadap.exe is the reverse adapter WMI runs to refresh performance-library objects into the CIM repository. WmiPrvSE.exe is the provider host that answers Get-CimInstance. WmiApSrv.exe is the other direction: WMI data as counters. A short wmiadap run after a counter install is expected.

- **Safe?**: Yes, in System32\wbem

  **Does it answer queries?**: No. WmiPrvSE does

  **Why did it run?**: WMI asked it to sync PerfLib

Feex says

If I see wmiadap flash after I installed a performance counter, I let the sync finish. I do not end WmiPrvSE to "stop ADAP."

## What is wmiadap.exe?

wmiadap.exe syncs PerfLib into WMI. It is the reverse adapter, not WmiPrvSE.exe serving queries. WMI starts it to refresh Win32_Perf\* classes after counters change.

## What does it do?

It parses performance libraries and updates WMI class state. It does not sit around answering scripts. WmiPrvSE.exe loads providers for those queries. WmiApSrv.exe publishes WMI as PDH counters.

## Why is it running?

Winmgmt scheduled a reverse-adapter pass, a counter installer ran, or someone invoked wmiadap /f. A copy that never exits after hours is stuck sync, not a query storm.

## Is it safe?

Usually safe

System32\wbem\wmiadap.exe is Microsoft. A wmiadap.exe in Temp is not. This file still does not replace WmiPrvSE as the query host.

A legitimate copy normally runs from:

`C:\Windows\System32\wbem\wmiadap.exe`

- Reverse adapter / ADAP refresh
- Often started by WMI, not by you
- Query host remains WmiPrvSE.exe

## Can I end it?

The PerfLib sync stops

Ending wmiadap.exe aborts that refresh. CIM queries through WmiPrvSE can continue with stale counter classes. Do not end Provider Host to stop ADAP.

## Can I remove it?

No

Do not delete wmiadap.exe. WMI needs the reverse adapter after counter changes. Disabling Winmgmt is a different, wider decision.

## Should it start with Windows?

WMI starts it on demand. It should not be a Startup Apps checkbox.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: A burst while it parses libraries

  **Memory**: Small

  **Disk**: Repository and PerfLib reads

  **Network**: None for a local refresh

## File information

| Executable name        | wmiadap.exe                          |
| ---------------------- | ------------------------------------ |
| Common legitimate path | C:\Windows\System32\wbem\wmiadap.exe |
| Publisher              | Microsoft Corporation                |
| Signature expectation  | Signed by Microsoft Windows          |

## Common problems

### People kill WmiPrvSE when ADAP runs

That drops live queries. wmiadap is a one-shot sync. Let it finish, then look at the consumer if CPU stays high.

### Missing Win32_Perf classes after a counter install

A failed wmiadap pass is the usual story. Re-run the documented refresh. Do not replace WmiPrvSE.

## Troubleshooting

Diagnose before you change anything destructive.

### Wait for the reverse adapter, then re-query

If you just installed counters, give wmiadap a minute. wbemtest against Win32_Perf\* is the check. WmiPrvSE load is a later step.

### Do not reset the repository because wmiadap appeared

A scheduled ADAP run is normal. Repository reset is for corruption, and it still is not a substitute for this exe.

## Technical details

Technical details

| Image name | wmiadap.exe                            |
| ---------- | -------------------------------------- |
| Role       | WMI reverse adapter (PerfLib into WMI) |

## Related

These entities connect to this article. Type is shown on every link.

[WmiPrvSE.exe: Windows Process](https://feex.it/wiki/process/wmiprvse.exe)[WmiApSrv.exe: Windows Process](https://feex.it/wiki/process/wmiapsrv.exe)[Windows Management Instrumentation: Windows Service](https://feex.it/wiki/service/windows-management-instrumentation)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Performance Libraries and WMI ](https://learn.microsoft.com/windows/win32/wmisdk/performance-libraries-and-wmi)· ADAP / reverse adapter moves PerfLib into WMI
- [Microsoft Learn: WMI start page ](https://learn.microsoft.com/windows/win32/wmisdk/wmi-start-page)· Live CIM queries are provider hosts, not wmiadap
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: wmiadap.exe

  **Typical path**: C:\Windows\System32\wbem\wmiadap.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

  **Related process**: [WmiPrvSE.exe](https://feex.it/wiki/process/wmiprvse.exe)

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/wmiadap.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)