Consider the following scenario:

• You set up a Windows Management Instrumentation (WMI) notification query to monitor event log changes on a Windows Server 2008-based or Windows Vista-based computer.
• Some events are added that trigger the WMI notification query.

In this scenario, the memory usage of one instance of the wmiprvse.exe process increases quickly until the memory is exhausted.

You log on to a Windows Vista-based or Windows Server 2008-based computer by using an administrator account. When you run a Windows Management Instrumentation (WMI) query against the CIM_DataFile class, the WMI query returns incomplete results.

This problem occurs if you run the WMI query by using the Run as administrator option (Elevated Permission).

For example, when you run the following query by using the Run as administrator option, the query returns incomplete results.

Select * from CIM_DataFile where filename = filename and extension = extension_name

This issue does not occur if you run the query without the Run as administrator option.