# WmiApSrv.exe

Windows Process: Microsoft Corporation

Also called wmiapsrv, wmi performance adapter, wmi performance reverse adapter

Windows, System Component

WMI Performance Adapter service (wmiApSrv). It exposes WMI data as performance counters for PDH clients. It is not the CIM provider host.

## What you need to know

WmiApSrv is the performance adapter, not the provider host.

WmiApSrv.exe is the WMI Performance Adapter. PerfMon and other PDH callers can read WMI-backed counters through this service. WmiPrvSE.exe still loads CIM providers for scripts and wbemtest. Ending the adapter does not stop Winmgmt queries.

- **Safe?**: Yes, in System32\wbem

  **Same as WmiPrvSE?**: No. This is the performance adapter

  **Why did it start?**: Something asked for those counters

Feex says

If I see WmiApSrv appear when a monitor tool opens, I treat that as counters, not as a second WmiPrvSE. I look at who called Performance Data Helper.

## What is WmiApSrv.exe?

WmiApSrv.exe is the WMI Performance Adapter. The service name is wmiApSrv. It publishes WMI data in the performance-counter shape PDH expects. It is not WmiPrvSE.exe, the CIM provider host.

## What does it do?

It answers performance-library calls that map onto WMI. It does not load arbitrary CIM providers for Get-CimInstance. wmiadap.exe is the reverse adapter that refreshes PerfLib into WMI, a different direction.

## Why is it running?

PerfMon, a vendor dashboard, or another PDH client asked for WMI-backed counters. The service is often Manual and starts only for that call.

## Is it safe?

Usually safe

The adapter in System32\wbem is Microsoft. A WmiApSrv.exe in Temp is not. Seeing this file is not proof that WmiPrvSE is "the same process."

A legitimate copy normally runs from:

`C:\Windows\System32\wbem\WmiApSrv.exe`

- Service name: wmiApSrv
- Starts when Performance Data Helper needs WMI counters
- Not WmiPrvSE.exe

## Can I end it?

Those counters go dark

Ending WmiApSrv.exe drops PDH callers that were using the adapter. CIM queries through WmiPrvSE can continue. The service may start again on the next counter read.

## Can I remove it?

No

Do not delete WmiApSrv.exe. Disable the WMI Performance Adapter service only if you accept missing WMI-backed counters. That is not a WmiPrvSE uninstall.

## Should it start with Windows?

wmiApSrv is typically Manual. A PDH client starts it. It should not sit in Startup Apps.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Rises while a tool polls those counters

  **Memory**: Small

  **Disk**: Low

  **Network**: Remote performance clients if something queries this PC

## File information

| Executable name        | WmiApSrv.exe                          |
| ---------------------- | ------------------------------------- |
| Common legitimate path | C:\Windows\System32\wbem\WmiApSrv.exe |
| Publisher              | Microsoft Corporation                 |
| Signature expectation  | Signed by Microsoft Windows           |

## Common problems

### Event log spam that the adapter started and stopped

Manual start plus a chatty monitor will do that. Set the service Automatic only if you want fewer start events, not because WmiPrvSE is busy.

### Empty counters, WMI scripts still work

That split is the clue. Scripts use providers in WmiPrvSE. This process is the performance adapter path.

## Troubleshooting

Diagnose before you change anything destructive.

### Find the PDH client

PerfMon, Resource Monitor, or a vendor "health" tray. Close that tool as a test. If WmiApSrv exits, you found the caller.

### Do not repair Winmgmt because this service flickered

A Manual adapter starting on a counter read is documented. Repository reset is a different problem.

## Technical details

Technical details

| Image name | WmiApSrv.exe |
| ---------- | ------------ |
| Service    | wmiApSrv     |

## Related

These entities connect to this article. Type is shown on every link.

[WmiPrvSE.exe: Windows Process](https://feex.it/wiki/process/wmiprvse.exe)[wmiadap.exe: Windows Process](https://feex.it/wiki/process/wmiadap.exe)[Windows Management Instrumentation: Windows Service](https://feex.it/wiki/service/windows-management-instrumentation)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Performance Libraries and WMI ](https://learn.microsoft.com/windows/win32/wmisdk/performance-libraries-and-wmi)· WMI and performance counter bridging
- [Microsoft Learn: WMI start page ](https://learn.microsoft.com/windows/win32/wmisdk/wmi-start-page)· CIM providers run in WmiPrvSE, not this adapter
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: WmiApSrv.exe

  **Typical path**: C:\Windows\System32\wbem\WmiApSrv.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

  **Related service**: wmiApSrv

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/wmiapsrv.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)