My Microsoft WSUS Update Services Issues/Event Viewer Service Issues

Hello,
So yesterday I began investigating why my PC's that were pointed to the WSUS weren't recieveing patches for their particular group. I checked to make sure it was approved and the client was in my client group. When I went to continue my troubleshooting today
Update Services within the WSUS role gives me an Error: Connection Error. My Clients when I force them to check for updates also fail. I went to review my Event Viewer logs and it tells me to start the Event Viewer services. When I try to start the
services it tells me Error 5 Access Is Denied. I've verfied that the policies allow my domain admin account access to the modify services and I've also rebooted it, still no joy.
Any help anyone can offer with these series of issues would be greatly appreciated!
-Russ Engelman
P.S. I'm not very coinfident with registry edits so if you suggest I try to modify the registry, please make it barney style. Thanks.

It seems these are two different problems, with Event viewer and with WSUS.
1. Did this system worked recently (correctly) or it is new one?
2. Make sure that you are logged as domain administrator (or better as buil-in AD administrator with highest priviledges.)
3. Generally services can depend on another processes (services). If these processes do no run, then you would not start process that is depending on these services.
4. WSUS: Clients could not receive (on demand) updates, when there was no initial synchronization.
5. WSUS: Make sure that GPO and computer group are set correctly
6. WSUS: Detect and reconnect clients with wuauclt
7. WSUS: Share your configuration here as well as reports.
Regards
Milos

Similar Messages

Windows update KB2964444 broke Event Logging Service and SQL Agent Service on Windows Server 2008 R2

I got the following problem:
I discovered that on my Windows Server 2008R2 machine the event logging stopped working on 04/May/2014 at 03:15.
Also, SQL Agent Service won't run
The only change that day was security
update KB2964444 - Security
Update for Internet Explorer 11 for Windows Server 2008 R2for x64-based Systems, that was installed exactly 04/May/2014 at 03:00. Apparently, that's what broke my machine...
When I try to start Windows Event Log via net
start eventlog or via Services
panel, I get an error:
C:\Users\Administrator>net start eventlog
The Windows Event Log service is starting.
The Windows Event Log service could not be started.
A system error has occurred.
System error 2 has occurred.
The system cannot find the file specified.
I tried:
restarted the OS (virtual on the host's VMWare).
re-checked the settings in services menu -they are like in the link.
checked the identity in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog -
the identity is NT
AUTHORITY\LocalService
gave all Authenticated Users full access to C:\Windows\System32\winevt\Logs
ran fc /scannow - Windows Resource Protection did not find any integrity violations.
went to the file %windir%\logs\cbs\cbs.log -
all clean, [SR] Repairing 0 components
EDIT: Uninstalled the recent system updates and rebooted - didn't help
EDIT: Sysinternals Process Monitor results when running start service from services panel (procmon in elevated mode):
filters:
process name is svchost.exe : include
operation contains TCP : exclude
the events captured are:
21:50:33.8105780 svchost.exe 772 Thread Create SUCCESS Thread ID: 6088
21:50:33.8108848 svchost.exe 772 RegOpenKey HKLM SUCCESS Desired Access: Maximum Allowed, Granted Access: Read
21:50:33.8109134 svchost.exe 772 RegQueryKey HKLM SUCCESS Query: HandleTags, HandleTags: 0x0
21:50:33.8109302 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\Services REPARSE Desired Access: Read
21:50:33.8109497 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\Services SUCCESS Desired Access: Read
21:50:33.8110051 svchost.exe 772 RegCloseKey HKLM SUCCESS
21:50:33.8110423 svchost.exe 772 RegQueryKey HKLM\System\CurrentControlSet\services SUCCESS Query: HandleTags, HandleTags: 0x0
21:50:33.8110705 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\services\eventlog SUCCESS Desired Access: Read
21:50:33.8110923 svchost.exe 772 RegQueryKey HKLM\System\CurrentControlSet\services\eventlog SUCCESS Query: HandleTags, HandleTags: 0x0
21:50:33.8111257 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\services\eventlog\Parameters SUCCESS Desired Access: Read
21:50:33.8111547 svchost.exe 772 RegCloseKey HKLM\System\CurrentControlSet\services SUCCESS
21:50:33.8111752 svchost.exe 772 RegCloseKey HKLM\System\CurrentControlSet\services\eventlog SUCCESS
21:50:33.8111901 svchost.exe 772 RegQueryValue HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll SUCCESS Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\wevtsvc.dll
21:50:33.8112148 svchost.exe 772 RegCloseKey HKLM\System\CurrentControlSet\services\eventlog\Parameters SUCCESS
21:50:33.8116552 svchost.exe 772 Thread Exit SUCCESS Thread ID: 6088, User Time: 0.0000000, Kernel Time: 0.0000000
NOTE: previoulsy, for
21:46:31.6130476 svchost.exe 772 RegQueryValue HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll SUCCESS Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\wevtsvc.dll
I also got NAME
NOT FOUND error ,so I created the new string value for the Parameters with
the name ServiceDll and
data %SystemRoot%\System32\wevtsvc.dll (copied
from the upper HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog key)
and this event now is
21:46:31.6130476 svchost.exe 772 RegQueryValue HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll SUCCESS Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\wevtsvc.dll
I also checked for the presence of wevtsvc.dll in
the place and it's there.
Also, I tried to capture all events with path containing 'event' and
got following events firing every several seconds:
21:38:38.9185226 services.exe 492 RegQueryValue HKLM\System\CurrentControlSet\services\EventSystem\Tag NAME NOT FOUND Length: 16
21:38:38.9185513 services.exe 492 RegQueryValue HKLM\System\CurrentControlSet\services\EventSystem\DependOnGroup NAME NOT FOUND Length: 268
21:38:38.9185938 services.exe 492 RegQueryValue HKLM\System\CurrentControlSet\services\EventSystem\Group NAME NOT FOUND Length: 268
Also, I tried to capture all the events containing 'file',
excluding w3wp.exe,
chrome.exe, wmiprvse.exe, wmtoolsd.exe, System and it shows NO attempts to access any file ih the time I try to start
the event logger (if run from cmd - there are several hits by net executable,
not present if run from the panel).
What can be done?

Hi,
I don’t found the similar issue, if you have the IE 11 please try to update system automatic or install the MS14-029 update.
The related KB:
MS14-029: Security update for Internet Explorer 11 for systems that do not have update 2919355 (for Windows 8.1 or Windows Server 2012 R2) or update 2929437 (for Windows 7
SP1 or Windows Server 2008 R2 SP1) installed: May 13, 2014
http://support.microsoft.com/kb/2961851/en-us
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Windows update error in event viewer

Wanna ask, recently some of our clients are experiencing slowness on their laptop. When I check, the patch update is successfully installed on the user machine. Then I check the event viewer and is saw a lot of below error. I cant seem to find the error
code 80240438 that relates to the WindowsUpdateFailure2 event name.
Just wondering if below error has anything to do with my current patch deployment update being deployed from SCCM?
Fault bucket 90717074036, type 5
Event Name: WindowsUpdateFailure2
Response: Not available
Cab Id: 0
Problem signature:
P1: 7.9.9600.17404
P2: 80240438
P3: 00000000-0000-0000-0000-000000000000
P4: Scan
P5: 101
P6: Managed {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
P7: 0
P8:
P9:
P10:

Can you provide some information like event ID, Operating System on which this issue is coming, service pack level, which patch cycle you deploying, etc.

Log Entries for Terminal Services in Event Viewer?

Hello
I wasn't sure exactly where to post this. Answers.microsoft.com directed me here for an answer.
I'm running Windows 7 Professional 32 bit. It's a standalone PC, not joined to a domain, never configured as a server. I'm puzzled. When I review entries in the Event Viewer, all logon and logoff entries are located in Event Viewer/Applications and Services
Logs/Microsoft/ Windows/Terminal Server/Local Session Manager/Operational. Every logon/logoff event is recorded here, although I have always had Remote Desktop Services disabled in Services. I would think that logon/logoff events would be recorded in
Applications and Services Logs/Microsoft/Windows/Winlogon. That makes more sense to me. Some of these user entries have Address: LOCAL and some are blank. No major hardware or software changes that might have caused this. The Event Viewer only goes back
6 months (1 Mb) and then it's overwritten. Can anyone explain this to me? Thanks for your help.

Hi,
The path of Event Viewer/Applications and Services Logs/Microsoft/ Windows/Terminal Server/Local Session Manager is used to record Remote Desktop Services activity even through it's disabled.
Windows logon and logoff activity is recorded in another path: Windows Logs/Security.
Karen Hu
TechNet Community Support

Error in starting nidevldu and nipxirmu services (windows event viewer)

A computer running Windows XP SP1 and a Visual basic (V6.0) application that I've developped had crashed several times. I've seen lots of errors in the Windows event viewer saying that the nidevldu and nipxirmu services were trying to start (exact french message : Le service nidevldu est en attente de démarrage et Le service nipxirmu est en attente de démarrage). These messages are real errors (not warning or informations).
I use a 6034E PCI card, Visual basic V6.0 and NI-DAQ 7.4.
The crashes I've seen may be linked with this problem.
Is there a solution?

Hi,
I think that you are not going to be starting and stopping the devldu service in normal circumstances... due to crashes !
The firsts steps you have to focus on is to optimize your program in order to avoid crashes, which is not a normal way of work I guess. Then you will be able to avoid these messages!
Regards,
David D. - Application Engineer - NI

Disable event viewer service in windows 7

Reference : http://msdn.microsoft.com/en-us/library/windows/desktop/ms681957%28v=vs.85%29.aspx
Quote="During system boot, the SCM starts all auto-start services and the services on which they depend. For example, if an auto-start service depends on a demand-start service, the demand-start service is also started automatically. "
Now, Task scheduler services are "automatic" services. and this service is dependent on "windows event log" service. so does that mean that we cannot disable "windows event log" service??

Hi,
Task Scheduler service is depended on Windows event log service, so as you mentioned, Windows event log service can not be stopped if Task Scheduler service is started.
Here's an way stop Task Schedule serivce, launch registry editor, then navigate to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Schedule
and locate Start registry key, double click on
Start and edit
the value, change it to 4, then press F5 to refresh the registry, after restart PC, the Task Scheduler serivces will be automatically stoped.
Yolanda Zhu
TechNet Community Support

Premiere Elements 12.1 Update and Known Expert View Styles Issue

The other day Adobe released the Premiere Elements 12.1 Update and encourgaged its use by all. However, little was cited for what the 12.1 Update was supposed to be fixing in Premiere Elements 12, other than "stability and performance" matters.
This morning I was working with Styles in the Expert workspace of Premiere Elements 12.1 and did not run into any problem creating the titles with text and Styles.
Before the 12.1 Update, editing Styles ran into problems in the Expert workspace that forced the user to toggle between Expert and Quick to get the text Style re-editing done.
Please check this out and let us know if you found the same.
If possible, in this thread perhaps each might contribute positive differences, if any, found in updating Premiere Elements 12 to 12.1.
So far, looking good for text with Styles, opening and closing the Tilter in the Expert workspace as well as saving closing reopening the project to the Expert workspace and editing the text Styles.
ATR

Peru Bob
Not so.
You apparently have not opened the link to read it. If you had, you would have seen mention of Premiere Elements 12.1 as well.
So, just in case the Adobe link was not opening for you to read it in part or entirely, here is a copy/paste of the relevant information
Photoshop Elements 12.1 update
The 12.1 update for Adobe Photoshop Elements includes the following enhancements and fixes:
Revel workflow improvements:
Improved Raw/PSD file upload experience. In version 12.0, Elements creates a JPEG proxy image in the user's catalog for any Raw/PSD files uploaded to Revel. In 12.1, this JPEG proxy file is hidden from the user. Elements creates this proxy file silently on the disk and deletes the file once it is uploaded to Revel. As earlier, the uploaded proxy file is mapped with the Raw/PSD file in Elements. This enhancement ensures that you don't come across duplicate media in the Elements catalog.
Ability to hide a library in your Elements catalog. This functionality comes handy when you want to selectively hide/show media from a friend’s library or one of your own libraries.
In earlier versions of Elements, any file deleted from Revel was automatically deleted from the Elements catalog. You now have additional options to manage such deleted files. You can now opt to delete the media from Revel, but keep it intact in the Elements catalog. You can also choose to delete the media from the Elements catalog as well as the hard disk.
Fixes for some Revel integration issues in version 12.0. Improved performance and integration stability.
Optimized Revel integration first-launch experience.
Addressed the delay observed in version 12.0 while downloading files to the Elements catalog.
Addressed an issue related to the pressure sensitivity sensor in N-Trig pens included with Sony laptop computers.
Addressed an issue that caused slideshow previews to appear blank in Photoshop Elements 11 and 12.
Numerous performance and stability improvements.
Adobe Premiere Elements
The 12.1 update for Adobe Premiere Elements includes the following enhancements and fixes:
Revel workflow improvements mentioned in the Photoshop Elements section above
Addressed an issue related to iPhone 5s slow-motion video upload to Revel
Addressed an issue that caused some music score to end abruptly
ATR

Cluster resource 'Analysis Services' of type 'Generic Service' in clustered role 'SQL Server' failed.

Windows Server 2012 R2
SQL Server 2012
After a recent cluster failover from node 1 to node 2, the Analysis Services role is in a failed state, with the service stopped. When attempting to start the service, there are two error messages captured in Failover Cluster Manager:
Log Name:      System
Source:        Microsoft-Windows-FailoverClustering
Date:          4/10/2014 11:48:49 AM
Event ID:      1042
Task Category: Generic Service Resource
Level:         Error
Keywords:
User:          SYSTEM
Computer:      HQ-HASQL-1.sbgnet.int
Description:
Generic service 'Analysis Services (HASQL)' failed with error '1067'. Please examine the application event log.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-FailoverClustering" Guid="{BAF908EA-3421-4CA9-9B84-6689B8C6F85F}" />
    <EventID>1042</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>16</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-10T15:48:49.752168200Z" />
    <EventRecordID>26212</EventRecordID>
    <Correlation />
    <Execution ProcessID="9036" ThreadID="14748" />
    <Channel>System</Channel>
    <Computer>HQ-HASQL-1.sbgnet.int</Computer>
    <Security UserID="S-1-5-18" />
</System>
<EventData>
    <Data Name="ResourceName">Analysis Services (HASQL)</Data>
    <Data Name="Status">1067</Data>
</EventData>
</Event>
Log Name:      System
Source:        Microsoft-Windows-FailoverClustering
Date:          4/10/2014 11:48:49 AM
Event ID:      1069
Task Category: Resource Control Manager
Level:         Error
Keywords:
User:          SYSTEM
Computer:      HQ-HASQL-1.sbgnet.int
Description:
Cluster resource 'Analysis Services (HASQL)' of type 'Generic Service' in clustered role 'SQL Server (HASQL)' failed.
Based on the failure policies for the resource and role, the cluster service may try to bring the resource online on this node or move the group to another node of the cluster and then restart it. Check the resource and group state using Failover Cluster
Manager or the Get-ClusterResource Windows PowerShell cmdlet.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-FailoverClustering" Guid="{BAF908EA-3421-4CA9-9B84-6689B8C6F85F}" />
    <EventID>1069</EventID>
    <Version>1</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-10T15:48:49.752168200Z" />
    <EventRecordID>26213</EventRecordID>
    <Correlation />
    <Execution ProcessID="6464" ThreadID="9076" />
    <Channel>System</Channel>
    <Computer>HQ-HASQL-1.sbgnet.int</Computer>
    <Security UserID="S-1-5-18" />
</System>
<EventData>
    <Data Name="ResourceName">Analysis Services (HASQL)</Data>
    <Data Name="ResourceGroup">SQL Server (HASQL)</Data>
    <Data Name="ResTypeDll">Generic Service</Data>
</EventData>
</Event>
With just these generic error messages being present, this has been difficult to diagnose. Some research has yielded possible resolutions of the Event Viewer log being full, .NET corruption, missing registry entries, but none of those seem to be the issue
(Event Viewer logs cleared, Analysis services is working on the same physical servers in a different cluster, and the registry entries was only a supported issue for SQL Server 2008 and 2008 R2).
Any help would be greatly appreciated.

Bring up Configuration Manager, look at binary path for SSAS. Make sure BOTH folders exist. Sometimes with failovers mappings get screwed up.

Problems with Microsoft Server Update Service (WSUS)

Hi,
Anyone experienced similar?
The Microsoft Server Update Service (http://www.microsoft.com/windowsserversystem/updateservices/default.mspx) can be set up to use an ordinary proxy server.
But it cannot connect through Web Proxy Server 4.0.2. If I shift to a Squid Proxy Server everything is just fine and patches are downloaded right away!
Seems like a Sun Proxy problem?
Regards,
Kasper L�vschall
BTW: Any news on the release date of version 4.0.3?

Thanks! Looking forward to the release...
Regards
Kasper

Unable to refresh the schema of FIM MA.Getting an error in Event viewer ""the current version of database is not compatible with the one expected by Forefront Identity Manager service. The current version of database is : 1116. The expected version is :1"

Hi,
We have installed FIM MA with an account that have all the sufficient rights.It got created successfully and worked for Full Import and Full Sync. But, due to some version incompatabilities, we have installed a patch.PFB link for the patch.
http://support.microsoft.com/en-us/kb/2969673/en-us
Now, we are trying to refresh the schema of FIM MA. While doing that we are facing an error "Failed to connect to database". The user account with which we are connecting has read and write permissions on DB.In the event viewer some errors are
logged like "the current version of database is not compatible with the one expected by Forefront Identity Manager service. The current version of database is : 1116. The expected version is :1122" with event ID 3. PFB images for more detailed
view.
Please advice how to fix the issue.
Thanks
Prasanthi.

Hello,
seems to me that you maybe only updated the syncengine but not portal/webservice.
I had that error once after an recovery from scratch and forgot one of the hotfixes to apply to all services.
-Peter
Peter Stapf - ExpertCircle GmbH - My blog:
JustIDM.wordpress.com

Windows 7 event viewer error after 9.1 update

*Log Name: Application*
*Source: Bonjour Service*
*Date: 4/11/2010 8:06:33 PM*
*Event ID: 100*
*Task Category: None*
*Level: Error*
*Keywords: Classic*
*User: N/A*
*Computer: CHEVYSALES*
Description:
*288: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)*
*Event Xml:*
*<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">*
<System>
*<Provider Name="Bonjour Service" />*
*<EventID Qualifiers="0">100</EventID>*
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
*<TimeCreated SystemTime="2010-04-12T00:06:33.000000000Z" />*
<EventRecordID>6692</EventRecordID>
<Channel>Application</Channel>
<Computer>CHEVYSALES</Computer>
*<Security />*
</System>
<EventData>
*<Data>288: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)</Data>*
</EventData>
</Event>
above message in my event viewer since i updated to this lousy release....
have had bnjour messages before but back with vista last year...new machine running solid and steadt windows 7 64 bit with a reliabilty rating from administrative tools of 10 for past months prior to this update...anyone seeing this and if so is there a fix?
first few backups took for ever on my iphone 3gs..... most go quickly again now.
don't sync too many things other than videos.
tia

Unfortunately there have been multiple issues with the new version of Bonjour which was distributed with iTunes 9.1. Apple knows & is apparently working on a fix but for now you have a few options which might help.
1) If you don't need the Bonjour service (i.e. for Apple TV) go into system services (run msconfig from a run command & navigate to the 'services' tab), uncheck Bonjour & reboot. That should disable Bonjour & allow iTunes to run properly.
If you need Bonjour then either
1) Disable Bonjour as above, delete it & then download a copy of Bonjour 1.x from the web (you'll have to google for it, last time I posted the link, Apple removed my post). Install that one & all should be well.
2) Uninstall iTunes 9.1 & Bonjour, get a copy of iTunes 9.0.3 and install that one. That will give you the previous version of Bonjour as well. One warning, if you've opened iTunes since upgrading to 9.1, 9.0.x won't be able to open your library since 9.1 updated the library structure. Check in the iTunes folder for one called "Old libraries" or previous library or something similar & you'll have to open that to get your collection to load.
Good luck,
Lil

Error in Event viewer - COM Server application security Issue

Dear All,
I am installing one software on windows cluster environment. But while installing I am getting continuous error in System in Event Viewer as 'The application-specific permission settings do not grant Local Activation permission for the COM Server application
with CLSID {xxxxxxxxxxxxx} and APPID {xxxxxxxxxxxxx} to the user NT SERVICE\SQL Server Distributed Replay Client SID (S-1-5-80-3249811479-4343554-65656-65665) from address LocalHost (Using LRPC). The security permission can be modified using the Component
Services administrative tool.'
I have seen in component services, that app ID I am getting for DReplayController service. On security tab if I want to give permission to that particular user then to which user I want to add in 'Launch and Activate permissions'. I am not getting 'SQL Server
Distributed Replay Controller' user in list.
So, please help me.
Thanks in advance.

Hi,
Please try to add this account: NT AUTHORITY\SYSTEM.
More information for you:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 2012
https://social.technet.microsoft.com/forums/systemcenter/en-US/cd8a2c95-70db-4df6-b7f5-eedcc5d898c7/the-applicationspecific-permission-settings-do-not-grant-local-activation-permission-for-the-com
Event ID 10016 issue in SQL Cluster Server
https://social.technet.microsoft.com/Forums/sqlserver/en-US/c5a27692-05c0-4ee4-b97f-1ea438b4e5f7/event-id-10016-issue-in-sql-cluster-server?forum=sqldisasterrecovery
In addition, if there are any further requirements regarding SQL, here are some SQL forums below for you:
https://social.technet.microsoft.com/Forums/sqlserver/en-US/home?category=sqlserver&filter=alltypes&sort=lastpostdesc
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Event Viewer cannot open the event Log or Custom view. Verify that the Event log service is running or query is too long. The instance name passed was not recognized as valid by a WMI data provider(4201).

"Event Viewer cannot open the event Log or Custom view. Verify that the Event log service is running or query is too long. The instance name passed was not recognized as valid by a WMI data provider(4201)"
This error keeps cropping up now and again on most of our domain controllers (OS-2008 AND 2008R2)...Usually a restart fixes the issue however the issue repeats and security logs don't generate.
Any advice on how to fix this issue permanently would be greatly appreciated.

Please see this: https://social.technet.microsoft.com/Forums/windows/en-US/95987ca3-a1b2-4da6-95b7-d825d06cdac7/error-code-4201-the-instance-name-passed-was-not-recognized-as-valid-by-a-wmi-data-provider?forum=w7itprosecurity
You can also try rebuilding the WMI repository: http://blogs.technet.com/b/askperf/archive/2009/04/13/wmi-rebuilding-the-wmi-repository.aspx
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Performance point service errors in share point wfe servers event viewer

HI
i am facing a problem in performance point service , i seen two errors in event viewer of a sharepoint wfe server
An exception occurred while the width of the Web. Diagnostic information that may help determine the cause of the following in this issue:
Microsoft.PerformancePoint.Scorecards.BpmException: There is a problem in the preparation of a Web Part for display.
Error code "Services PerformancePoint" is 20700.
2 error)
Log Name:      Application
Source:        Microsoft-SharePoint Products-PerformancePoint Service
Date:          02/09/35 01:11:41 م
Event ID:      39
Task Category: PerformancePoint Services
Level:         Error
Keywords:
User:          NT AUTHORITY\IUSR
Computer:      XYZWFE02.XYZportal.com
Description:
A PerformancePoint service application call was aborted by the caller. This may indicate the HttpRuntime executionTimeout for the Web Application is configured to
a value smaller than the DataSourceQueryTimeout for the PerformancePoint Service Application.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-SharePoint Products-PerformancePoint Service" Guid="{A7CD5295-CBBA-4DCA-8B67-D5BE061B6FAE}" />
    <EventID>39</EventID>
    <Version>14</Version>
    <Level>2</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-29T10:11:41.385108100Z" />
    <EventRecordID>1422377</EventRecordID>
    <Correlation ActivityID="{D707EAF7-6A6A-45FA-AF83-77DC3231B658}" />
    <Execution ProcessID="18236" ThreadID="19172" />
    <Channel>Application</Channel>
    <Computer>XYZWFE02.XYZportal.com</Computer>
    <Security UserID="S-1-5-17" />
</System>
<EventData>
</EventData>
</Event>
adil

Hi
also below error is coming in eventy viewer of wfe servers
Log Name:      Application
Source:        Microsoft-SharePoint Products-PerformancePoint Service
Date:          03/09/35 02:25:26
م
Event ID:      39
Task Category: PerformancePoint Services
Level:         Error
Keywords:
User:          NT AUTHORITY\IUSR
Computer:      XYZWFE02.XYZportal.com
Description:
A PerformancePoint service application call was aborted by the caller. This may indicate the HttpRuntime executionTimeout for the Web Application is configured to a value smaller than the DataSourceQueryTimeout for the PerformancePoint Service Application.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-SharePoint Products-PerformancePoint Service" Guid="{A7CD5295-CBBA-4DCA-8B67-D5BE061B6FAE}" />
    <EventID>39</EventID>
    <Version>14</Version>
    <Level>2</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-30T11:25:26.997772700Z" />
    <EventRecordID>1425270</EventRecordID>
    <Correlation ActivityID="{EB0C99EA-5B6A-4001-9D9B-C91FF779CD4B}" />
    <Execution ProcessID="6736" ThreadID="15788" />
    <Channel>Application</Channel>
    <Computer>XYZWFE02.XYZportal.com</Computer>
    <Security UserID="S-1-5-17" />
</System>
<EventData>
</EventData>
</Event>
adil

The event logging service encountered an error while processing an incoming event published from Microsoft-Windows-Security-Auditing.

Last night, some of our systems installed updates released on 11/13/2014.
KB3021674
KB2901983
KB3023266
KB3014029
KB3022777
KB3020388
KB890830
Today, all of the servers running Windows Server 2008 R2 started logging the following error in the Security log over and over:
Log Name:      Security
Source:        Microsoft-Windows-Eventlog
Date:          1/15/2015 11:12:39 AM
Event ID:      1108
Task Category: Event processing
Level:         Error
Keywords:      Audit Success
User:          N/A
Description:
The event logging service encountered an error while processing an incoming event published from Microsoft-Windows-Security-Auditing.
Servers running Windows Server 2008 that also installed the updates are not experiencing the problem. It looks like one of the updates may have introduced this problem with Server 2008 R2.

...Did you for sure confirm that:
https://technet.microsoft.com/library/security/MS15-001
is the cause?
I did. I had a VM that was not experiencing the problem. I took a snapshot and tested the patches one by one. Installing only KB3023266 immediately caused the issue to occur (after reboot). A similar process was used to confirm that
installing KB2675611 resolved the problem.
Note that I found the installation of KB2675611 is usually quick, but it took several hours hours to install on some of our systems. We had installed this patch a few months ago on a couple of servers and it was always quick to install. But,
it seems like installing it on a symptomatic system can cause it to take a long time.

My Microsoft WSUS Update Services Issues/Event Viewer Service Issues

Similar Messages

Maybe you are looking for