Event ID - 5612

Event Id	5612
Source	Microsoft-Windows-WMI
Description	WMI has stopped WMIPRVSE.EXE because a quota reached a warning value. Quota: %1 Value: %2 Maximum value: %3 WMIPRVSE PID: %4
Event Information	According to Microsoft : Cause : This event is logged when WMI has stopped WMIPRVSE.EXE. Resolution : Specify providers usage WMI Provider hosts have the following hard-coded limits: Handle count < 0x1000 Thread count < 0x1000 Private page count < 0x10000000 When a quota has been exceeded, there is no specific action required other than reducing the scope or number of operations requested of the provider hosted in the WMIPRVSE process. Event ID 5612 lists the PID of the WMIPRVSE process that hosted the provider that exceeded the quota. A provider hosted in WMIPRVSE is implemented as a DLL. You can determine the list of DLLs hosted by WMIPRVSE by typing tasklist /m /fi "IMAGENAME eq wmiprvse.exe" at an elevated command prompt. You can determine which DLL is actually a WMI provider by running WMIDIAG CorrelateClassAndProvider and find matching DLLs from the two lists. Knowing this information will help you to isolate the provider subject to the quota violation and so the operations requested causing this issue. For computers running on the Vista operating system, you can also use the WMI ETW (Event Tracing for Windows) to trace requests and providers handling these requests. The correlation of these traces with the timestamp of this message should give you the name of the provider subject to the quota violation. Verify : Ensure that the WMI providers in question stay within the following limits for quota parameters: Handle count < 0x1000 Thread count < 0x1000 Private page count < 0x10000000
Reference Links	Event ID 5612 from Source Microsoft-Windows-WMI

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught