WMI does not release message DLLs and program files

The Windows Management Instrumentation (WMI) Windows NT Event Log provider does not release message dynamic-link libraries (DLLs) and program files (.exe files) that are used for mapping event messages to instances of Win32_NTLogEvent. This can prevent these message resources from being updated while the Winmgmt service is running.

Message DLLs and .exe files are cached by the Windows NT Event Log provider to improve the overall performance of the provider. If these resources were released, they would have to be reloaded every time a corresponding Windows NT Log event occurred. Instead, these cached resources are released only when the Windows NT Event Log provider is unloaded.

The WMI Windows NT Event Log provider must be unloaded to update an event message resource that has been locked. The quickest way to unload the provider is to stop the Winmgmt service. To stop the service, type net stop winmgmt.

This behavior is by design.