diff --git a/qemu/tests/balloon_check.py b/qemu/tests/balloon_check.py
index c9155305c1..19f52cb219 100644
--- a/qemu/tests/balloon_check.py
+++ b/qemu/tests/balloon_check.py
@@ -501,6 +501,46 @@ def get_disk_vol(self, session):
         except Exception:
             self.test.error("Could not get virtio-win disk vol!")
 
+    def assert_no_wmi_error_5858(self, session):
+        """
+        Ensure there are no WMI-Activity Event ID 5858 entries emitted by the
+        balloon service since it started.
+        This checks the 'Microsoft-Windows-WMI-Activity/Operational' log.
+        """
+        if self.params.get("os_type") != "windows":
+            return
+        log_name = "Microsoft-Windows-WMI-Activity/Operational"
+        error_context.context(
+            "Verify no WMI 5858 events since blnsvr.exe start (log: %s)" % log_name,
+            self.test.log.info,
+        )
+        ps_cmd = self.params.get("wmi_5858_check_cmd")
+        if not ps_cmd:
+            self.test.fail("Missing wmi_5858_check_cmd in cfg; WMI 5858 check not run.")
+        status, output = session.cmd_status_output(ps_cmd)
+        self.test.log.info(
+            "WMI 5858 check result: %s (status %s)",
+            output.strip(),
+            status,
+        )
+        if status == 0:
+            self.test.log.info(
+                "No WMI-Activity Event ID 5858 found since blnsvr.exe start."
+            )
+        elif status == 1:
+            self.test.fail(
+                "Detected WMI-Activity Event ID 5858 since blnsvr.exe start."
+            )
+        elif status == 2:
+            self.test.log.info(
+                "Balloon service process not running; skipping WMI 5858 check."
+            )
+        else:
+            self.test.fail(
+                "WMI 5858 check returned unexpected status %s. Output: %s"
+                % (status, output)
+            )
+
     @error_context.context_aware
     def operate_balloon_service(self, session, operation):
         """
diff --git a/qemu/tests/balloon_service.py b/qemu/tests/balloon_service.py
index f45e5d889c..730f386612 100644
--- a/qemu/tests/balloon_service.py
+++ b/qemu/tests/balloon_service.py
@@ -89,12 +89,19 @@ def balloon_memory(vm, mem_check, min_sz, max_sz):
         mem_stat_working = False
         for bln_oper in blnsrv_operation:
             error_context.context("%s balloon service" % bln_oper, test.log.info)
+            windows_run = params.get("os_type") == "windows" and bln_oper == "run"
             balloon_test.operate_balloon_service(session, bln_oper)
 
             error_context.context(
                 "Balloon vm memory after %s balloon service" % bln_oper, test.log.info
             )
             balloon_memory(vm, mem_check, min_sz, max_sz)
+            if windows_run:
+                error_context.context(
+                    "Check Windows Event Log for WMI 5858 after service restart",
+                    test.log.info,
+                )
+                balloon_test.assert_no_wmi_error_5858(session)
             mem_stat_working = True
         # for windows guest, disable/uninstall driver to get memory leak based on
         # driver verifier is enabled
diff --git a/qemu/tests/cfg/balloon_service.cfg b/qemu/tests/cfg/balloon_service.cfg
index d38af9927b..8a52d5f5e3 100644
--- a/qemu/tests/cfg/balloon_service.cfg
+++ b/qemu/tests/cfg/balloon_service.cfg
@@ -69,6 +69,7 @@
             only Windows
             repeat_times = 1
             blnsrv_operation = "stop run"
+            wmi_5858_check_cmd = "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command \"$ErrorActionPreference='SilentlyContinue'; $log='Microsoft-Windows-WMI-Activity/Operational'; $p=(Get-Process -Name blnsvr -ErrorAction SilentlyContinue | Select-Object -First 1); if (-not $p) { Write-Output 'NO_PID'; exit 2 }; $blnPid=$p.Id; $start=$p.StartTime.ToUniversalTime(); $events = Get-WinEvent -FilterHashtable @{LogName=$log; Id=5858; StartTime=$start} -MaxEvents 50 -ErrorAction SilentlyContinue | Where-Object { $_.Level -eq 2 -and $_.Message -match ('ClientProcessId = ' + $blnPid) }; $e = $events | Select-Object -First 1; if ($null -ne $e) { Write-Output 'HIT'; ($e | Format-List -Property TimeCreated,Id,Message | Out-String).Trim() | Write-Output; exit 1 } else { Write-Output 'NONE'; exit 0 };\""
         - sc_interrogate:
             type = balloon_sc_interrogate
             only Windows