Re: WMIdiag, what have I learned

What's that .NET crap running for?

Event Source: WinMgmt
Event ID: 4

http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows%20Operating%20System&ProdVer=5.2&EvtID=4&EvtSrc=WinMgmt&LCID=1033

Event Source: WinMgmt
Event ID: 64
From a newsgroup post: "Right-click "My Computer" and choose "Manage" to
open the Computer Management tool. Click on "Services" in the list in the
left-hand pane and then select "Windows Management Instrumentation" from the
list in the right-hand pane. There are two entries for "Windows Management
Instrumentation". You need to select the main one, not the "Driver
Extensions" entry. With the correct Service highlighted, click on the "Stop"
link which will appear to halt the Service. With the Service halted, use "My
Computer" to locate the folders \Windows\System32\Wbern\Repository and
\Windows\System32\Wbern\Repository\FS. Delete all files in those folders.
Reboot to allow the service to be restarted and the necessary files
recreated".
http://www.eventid.net/display.asp?eventid=64&eventno=6486&source=WinMgmt&phase=1

Event Source: WinMgmt
Event ID: 43
http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows%20Operating%20System&ProdVer=5.0&EvtID=43&EvtSrc=WinMgmt&LCID=1033

WMI Event 43 Generated After Changing System Default Locale
http://support.microsoft.com/kb/268881

WinMgmt Error Message 43 in the Event Log in Simplified Chinese Windows 2000
http://support.microsoft.com/kb/259568

Event Source: WinMgmt
Event ID: 60
http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows%20Operating%20System&ProdVer=5.2&EvtID=60&EvtSrc=WinMgmt&LCID=1033

Code 0x80041001 means: WBEM_E_FAILED (The call failed.)

As per one user: "Fixed it myself by running sfc /scannow after using the
winmgmt /resyncperf -p processID and winmgmt /clearadap commands at command
prompt.". We had reports that this suggestion did not always fix the
problem.

From a newsgroup post: "To stop them go to Control Panel - Administrative
Tols - > Services. After you stop the WMI services put them also to Manual
startup - so that next time you restart your computer the services are not
run again. Consequences? If you don't know what WMI is then none."
http://www.eventid.net/display.asp?eventid=60&eventno=491&source=WinMgmt&phase=1

Event Source: PerfDisk
Event ID: 2001
http://www.eventid.net/display.asp?eventid=2001&eventno=730&source=Perfdisk&phase=1

No need to subscribe to EventID.Net...

M253251 is
Using Diskperf in Windows 2000
http://support.microsoft.com/kb/253251

M296187 is
Application Log Events Generated When You Start Performance Counter Query
http://support.microsoft.com/kb/296187

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:vxHDh.37$1X5.4@xxxxxxxxxxxx,
J Lunis <jay.lunis@xxxxxxxxx> hunted and pecked:
And the following Application errors
-------
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Description:
Failed to load MOF
C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V1.1.4322\ASPNET.MOF while recovering
repository file.
---------------
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Description:
Failed to load MOF
C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET.MOF while
recovering repository file.
--------------------
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 64
Description:
The named section Global\Wmi Provider Sub System Counters, was created
with insufficient size, this could constitute a Denial of Service attack.
----------------
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 43
Description:
WMI ADAP failed to connect to namespace \\.\root\cimv2 with the
following error: 0x80040154
--------------------
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 60
Description:
WMI ADAP was unable to process the performance libraries: 0x80041001
-------------------
Event Type: Error
Event Source: PerfDisk
Event Category: None
Event ID: 2001
Description:
Unable to read the disk performance information from the system. Disk
performance counters must be enabled for at least one physical disk or
logical volume in order for these counters to appear. Disk performance
counters can be enabled by using the Hardware Device Manager property
pages. Status code returned is data DWORD 0.
----------------------
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 64
Description:
The named section Global\Wmi Provider Sub System Counters, was created
with insufficient size, this could constitute a Denial of Service attack.
---------------------
--------------------

Wesley Vogel wrote:
Repairing and re-registering the WMI
http://windowsxp.mvps.org/repairwmi.htm

Skip down to: Rebuilding the WMI Repository

.

Relevant Pages

  • RE: BSOD apparently caused by ntkrpamp.exe
    ... Event Type: Error ... SPTD Driver detected an internal error in its data structures ... Event Source: System Error ... WinMgmt could not initialize the core parts. ...
    (microsoft.public.windowsxp.help_and_support)
  • WMI Problem - It seems to be missing!
    ... Event Type: Error ... Event Source: MSExchangeSA ... The MAD Monitoring thread was unable to connect to WMI, ... WinMgmt could not initialize the core parts. ...
    (microsoft.public.windows.server.sbs)
  • WinMgmt error
    ... appears to be an out fo memory condition. ... Event Type: Error ... Event Source: WinMgmt ...
    (microsoft.public.windows.server.general)
  • Failed to CoGetClassObject for provider "CIMWin32". Error code 0x8
    ... Event Source: WinMgmt ... Failed to CoGetClassObject for provider "CIMWin32". ...
    (microsoft.public.win2000.general)
  • RE: Error: "error creating window"
    ... no longer able to open new windows, ... Event Type: Error ... Event Source: Service Control Manager ... Computer: JASON ...
    (microsoft.public.windowsxp.general)
Loading