37 views

Symptoms


After running discovery on a Windows device (VM or not), the target device is left with a running process call "wsmprovhost.exe". This process consumes high amount of cpu resources. 

If discovery is ran again on that device, another instance of that process is created and that one also consumes high cpu resources. 

Eventually it will cause that target device to crash. 

The only way you have been able to remove those processes is to restart the host server. 

Release


Any

Environment


Windows Servers

Cause


This usually happens because of powershell running to establish a remote session between the MID server and the target windows server. 

This will happen if the .NET version and Powershell version on the target server are not compatible. 

You can test this my logging into the target server and running the following command:

C:\Users\admin>powershell.exe --help 

If it returns something like this then you have this problem:


Windows PowerShell terminated with the following error: 
The type initializer for 'System.Management.Automation.Tracing.PSEtwLog' threw 
an exception. 

Resolution


You will need to patch your windows servers so that the Powershell and .NET versions on that are compatible.

 

Article Information

Last Updated:2018-09-11 13:35:40
Published:2018-09-11