WMI Providers are loaded and run by wmiprvse.exe. If they are not needed they then get unloaded. In the Services menu it shows that WMI starts with "C:\Windows\system32\svchost.exe -k netsvcs" I've used error detection and I see the module load event increase, but nothing else. And yes the wmi providers I am trying to debug have all been built with instrumentation.
↧