FortiClient VPN causes high WmiPrvSE.exe CPU usage when connected to SSL VPN

VPN
1

Update 11 June 2024: FortiClient 7.4.0 has been made generally available and appears to fix the issue. FortiClient 7.0.13 is available through support and may also fix the issue in that release train.

I started noticing high CPU usage from WmiPrvSE.exe recently. Looks like it’s maxing out one core causing my CPU to heat up and battery to drain. In the screenshot below I set the affinity for the process to one core and then switched it over to another.

727×530 31.5 KB

A good way to tell this is happening is by adding the CPU Time column in Task Manager, and sorting by it. If WmiPrvSE.exe is with the top consumers, you’re likely having a similar issue.


WMIMon allowed me to attribute it to NetworkAdapter WMI queries by FortiTray.exe. It only happens when the VPN is connected. And I suspect it started occurring after I upgraded to 7.2.4.

1065×423 25.9 KB

Anyone else experiencing high CPU usage from WmiPrvSE.exe in conjunction with FortiClient VPN, or specifically not seeing the issue? Interested in hearing your situation!

2

I discovered this issue about 2-3 weeks ago, but didn´t have time to find out the problem, I just got to this.

Our situation:
I specifically have Lenovo TP Yoga X1 gen 8 notebook. i am on version 7.2.4, with win 11 (all up to date), and I installed it as new, no garbage programs, etc.
We have about 20-30 forticlients for testing purposes (for a year now -_- very bad decision, there is always a problem), EMS,…All 7.2.4 clients have this problem. not spotted with older ones.
We used to use ZTNA, and many more features (testing), but right now, there should be only VPN and vulnerability scan activated. I say activated, because i can´t tell for sure, if something is installed and not enabled. And trust me, not installed and not enabled isn´t the same thing here (really, great product in theory, but is implemented by bunch of incompetent people, every version there is one major bug fixed and 3 more arise!)

Problem:
When connected to SSLVPN, there is high CPU usage and the FC system tray is unclickable - seems like halted. When I right click it, it shows up a minute later at the actual position of the mouse and the menu is still not clickable. When I need to disconnect the VPN, I have to restart FC system tray in task manager or the FC can be opened manually with shortcut.
I also traced it down to query Win32_NetworkAdapter with WMI provider host. When i try this query with wbemtest.exe, it is accessible, so the FC is the one having problem providing the right query, or getting the message back, or something like that.

I guess people reacting with the “same problem” at older versions is just a coincidence, not actually the same problem with WMI.

u/faac is there any update? where did you find out it´s gonna be fixed in 7.2.5?

EDIT: sorry, i just downgraded to 7.0.12 and even 7.0.11, both the same result - high CPU usage for WMI provider host
7.2 clients are connected to different EMS server than 7.0 clients, but connecting to the same fortigate VPN

how is this possible? I can’t believe we didn’t notice this earlier in our company.

3

So I’ve done some more testing. I do see the issue occurring on other systems and different versions of FortiClient. It also happens on FortiClient 7.0.10 for instance so it’s not specific to the 7.2 train. I don’t think it’s necessarily maxing out 1 CPU core after all, but it’s definitely a continuous raised consumption (=drain on battery and increased temps).

It would be wonderful if someone can identify the issue who can raise it with FortiNet support!

4

I had been experiencing massive slow downs on my system with 7.2.2 and 7.2.3. It was driving me and a few colleagues nuts, but I didn’t suspect it was FortiClient. Upgrading to 7.2.4 solved it for us go figure…

5

I am experiencing high VPU on certain Dell machines. I will check if its WmiPrvSE.exe. Im on 7.2.4

6

Same problem here on some Dell laptops, on any 7.0.x version we’ve tested.

7

Are you perhaps using ZTNA tags?
I could imagine the WMI service on the PC is doing some posture checks (like checking registry entries and/or certificates)…

8

We had several users reporting the same issue with WINPRVSE.exe. I narrowed it down by looking into the trace log for WMI. Its the fortitray.exe that seems to be the problem. When i close it, the CPU gets back to normal. I will try and report it to the support. So it seems like the forticlient sends a lot of WMI querys, but i haven’t found out why, yet…

I see lots of these:
CorrelationId = {CBEF6381-FEB6-4B29-B175-082995F6728A}; GroupOperationId = 358604; OperationId = 358605; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_NetworkAdapter; ClientMachine = Batcave-laptop2; User = Batman\Robin; ClientProcessId = 23724; NamespaceName = 133603410870989832

9

Also had this issue with Forticlient 7.2.4 VPN only. I did an upgrade to the recently released Forticlient 7.4.0.1658 and the problem seems to be solved, no more spikes in CPU at the moment!

10

Hi, from Fortinet Support you can get an interim Forticlient with version 7.0.13 in which the mentioned problem is solved. It is a known bug.

11

Asked TAC and they told me it will be fixed in 7.2.5. ETA for 7.2.5 is 2024-07-18.

12

I am seeing the same behavior on 7.2.4, maybe I will raise a ticket next week. Currently to busy with other things.

13

Thanks for your input!

14

Interesting, thanks.

15

Agreed. Going by that it’s maxing 1 CPU core, maybe it’s just querying in a loop as often as it can.

16

If I just straight up run the WMI query from PowerShell, it takes my system around a quarter of a second to execute. So four queries per second max.

1..30 | %{ Measure-Command { Get-CimInstance -Class Win32_NetworkAdapter } | Select -Exp Milliseconds } | Measure-Object -Average | Select -ExpandProperty Average

249,666666666667

At the same time, the WmiPrvSE.exe process goes a little higher in CPU usage, so I’ll conclude it’s not being blasted continuously. There’s some delay in there between the queries.

If I run multiple continuous queries next to each other, the CPU usage for the same WmiPrvSE.exe process climbs even higher (25% total usage on 12 cores).

17

It’s a barebones SSL VPN setup, nothing special. Note it’s on the FortiClient SSL VPN (free) client.

18

As you mentioned, FortiClient 7.4.0.1658 is Generally Available from the Fortinet website.

Just installed it and so far it looks like the issue is gone! Thanks everyone for your help.

19

7.2.5 is out and fixed the WmiPrvSE.exe CPU usage bug.

20

Thanks. Keep us posted if you do. :slight_smile: