I recently ran the McAfee profiler tool on a server of mine which was experiencing high CPU and RAM. What I found was wmiprvse.exe was reading tzres.dll.mui upwards of 27k times in 10 minutes. In the brief amount of searching I've done, I'm not able to find out a reason for this.
Any help with this would be awesome.
tzres.dll and tzres.dll.mui are tied to "Windows System Resource Manager"; for troubleshooting try restarting "Windows Management Instrumentation" in the Services panel - "WmiPrvSE.exe" and all of the dependent services will automatically get restarted if you use the "Restart" option.
Yes, stopping WMI stops this issue, but we have products (Microsoft SCCM, VMware vRealize Operations) that require WMI to be functioning so stopping the entire service isn't really a solution.
We're seeing this issue on Win7 and there doesn't seem to be a way to uninstall Windows System Resource Manager on the Win7 OS. I don't believe this is actually a McAfee issue as much as a Windows/WMI issue, we just haven't been able to find a fix yet.
Are these tools Microsoft SCCM, VMware vRealize Operations used for monitoring - if so, that would make sense why WMI is being called so many times. Perhaps a Short term fix would be to add tzres.dll and tzres.dll.mui to the exclusion list.
Yeah, we've got the files added to the exclusion list which reduced our CPU usage, which is why i'm not blaming McAfee since we know its WMI as the culprit. We're still seeing a ton of IO being generated from WMIPRVSE because its still creating the files continuously even though McAfee isnt scanning them anymore.
We had simmilar issue's with MA5.0.2 and with incorrect installation sequences of ma5.0.4 and VSEp8. Apart from the articles above and the suggestion to exclude *.mui from OAS we never got much further in troubleshooting this issue. best fix for us was reinstalling the McAfee components in the correct sequence.