WMIPRVSE.EXE (WMI) warning alerts in Event Logs

Hi To all. I have one major problem one of my supported Window Server 2008 R2 SP2. I see that  in event logs randomly appears warning message :"Windows Management Instrumentation has stopped WMIPRVSE.EXE because a quota reached a warning
value. Quota: HandleCount  Value: 4099 Maximum value: 4096 WMIPRVSE PID: 4268"
Looked for this topics and KB :
http://support.microsoft.com/default.aspx?scid=kb;EN-US;958124
http://support.microsoft.com/default.aspx?scid=kb;EN-US;954563
With no result. Any ideas about how to resolve this issue.
Thanks!

Hi Olegmg,
When a quota has been exceeded, there is no specific action required other than reducing the scope or number of operations requested of the provider hosted in the WMIPRVSE process. Event ID 5612 lists the PID of the WMIPRVSE
process that hosted the provider that exceeded the quota.
http://technet.microsoft.com/en-us/library/dd363619(v=ws.10).aspx
Regards.
Vivian Wang

Similar Messages

  • On Windows 2012,WMIPRVSE.EXE WMI service leaks memory when registering SMO to SQL Server events

    Hi, 
    I have written an application which registers to events using SMO API. 
    I have noticed that after some time, suddenly event flow from SQL Server stops. and I can't event shut down my application properly, as StopEvents() method of SMO hangs the shutdown.
    After further investigation, I have found out that a spawned process (probably by SQL Server) WMIPRVSE.EXE memory grows rapidly. 
    As soon as this process reaches about 482MB ~ 500MB memory consumption. I didn't notice any particular CPU peak for this process. 
    As I manually kill this process, I'm able to shutdown my application properly and even re-register it to events.
    I may add that this issue doesn't happen on an regularly updated Windows 2008. 
    I managed to find this hotfix (the only one for 2012) but it won't install!!! http://support2.microsoft.com/kb/2790831/en-us?lc=1033
    In an act of frustration , I decided to bypass your process, and write a heuristic mechanism to find WMIPRVSE.EXE which is related to my application, and kill it whenever it reaches the mentioned sizes. 
    But it's not the answer. 
    Please provide a proper hotfix for 2012, as you did with Windows 2008, or an answer regarding what is wrong?
    simple search reveals that this process was very problematic in 2008...
    Regards,
    Adi

    Hi Adi,
    à
    I managed to find this hotfix (the only one for 2012) but it won't install!!! http://support2.microsoft.com/kb/2790831/en-us?lc=1033
    Would you please let me know detailed edition information of this server 2012? Was it Windows Server 2012 Standard
    or
    Essentials or any other?
    Based on your description, I understand that
    KB2790831 can’t be installed in that problematic Windows Server 2012. Would you please let me know the error message that you can get when failed to install the Hotfix? Please perform a
    clean boot and check if still can’t install this Hotfix.
    Meanwhile, please check if
    KB2934016 was installed on your Windows Server 2012? If didn’t install, please install this update rollup and check if this issue still exists.
    If any update, please feel free to let me know.
    Hope this helps.
    Best regards,
    Justin Gu

  • On Windows 2012,WMIPRVSE.EXE WMI service leaks memory

    Hello all,
    In my Windows 2012 9700 server,I have installed LSI provider and I am running associator queries to LSI Provider which further interacts with WMI service which acts as a CIM Object Manager(CIMOM).When I run these queries,I am seeing huge memory
    usage increase in the WMIPRVSE.EXE service.
    I was browsing through some of the articles and came to know this is a known issue.But Microsoft has not applied this issue to Windows 2012 server.Below are my findings,
    Maximum memory usage by the particular host:536870912 Bytes.After which it would crash and a new wmiprvse.exe would come up.I did not change this memory limit because it's not the procedure to resolve this issue.
    Can anyone who has already experienced this issue,could guide me?
    Thanks in advance.
    Regards,
    Ravi

    Hi,
    Thanks for posting.
    Firstly, I recommend you to use Network Monitor to check the source of the high CPU in WMIprvse.exe:
    Using Netmon to figure out the source of high CPU in WMIprvse.exe
    In addition, maybe you can enable WMI logging to find more detailed information:
    WMI Debug Logging
    Best regards,
    Susie

  • SSCM Reporting/Alerting Functions - Event Logs?

    Good Evening:
    I am trying to get some clarification on some functionality of SCCM in regards to alerting and what the client can do and or scrape on the client.
    For example, I want to be able to generate an alert based on an event in the system logs of a client OS, if a particular log item has been generated.  Should I be using queries to achieve this (if possible)?  If so can someone guide me to some documentation.
    Also I found some information on determining USB detection, which is great.  I would like to use this as well, and generate these items via an email or report with subscription.  Should I be using the asset intelligence for this piece?
    Sorry for the vague questions, I really found no concrete information via 4 hours of google searching :(
    Any help would be great.

    For example, I want to be able to generate an alert based on an event in the system logs of a client OS, if a particular log item has been generated.  Should I be using queries to achieve this (if possible)?  If so can someone guide me to some
    documentation.
    This sounds more like an OpsMgr task.
    USB detection? ConfigMgr can detect USB devices using hardware inventory, but that's about it.
    Torsten Meringer | http://www.mssccmfaq.de

  • The event logging service encountered an error (res=5) ...

    Hi,
    I have promoted a new server to be a third DC.
    All seems ok, replication, dns, etc are working properly but after the boot in the system event log I see those errors:
    Log Name: System
    Source: Microsoft-Windows-Eventlog
    Date: 25.5.2012 14:32:15
    Event ID: 23
    Task Category: Service startup
    Level: Error
    Keywords: Service availability
    User: LOCAL SERVICE
    Computer: dc3.x.x
    Description:
    The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-API-Tracing/Operational.
    and then for about 40 Microsoft channels:
    The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-AppID/Operational.
    The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-AppLocker/EXE and DLL.
    The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-AppLocker/MSI and Script.
    The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-Audio/CaptureMonitor.
    The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-Security-Configuration-Wizard/Operational.
    etc...
    There is no error event before those event id 23
    Any idea?
    Thank you

    Have you checked the path of the System event log? Something similar happened to me once, turned out the log file was corrupted. I updated the path and created a new evt which solved the issue for me.
    Hopefully this helps:
    http://technet.microsoft.com/en-us/library/dd315662(v=ws.10).aspx

  • Operations Manager Failed to Access the Windows Event Log and management server is showing warning state

    Hi,
    I am monitoring AD server from SCOM 2012 R2. My management server goes into waning state. When i run Health explorer then it come back in the healthy state but after some time it again goes into warning state. After seeing alert i found that a alert is coming
    again and again i.e.  Operations Manager Failed to Access the Windows Event Log.The description of alert is mention below
    The Windows Event Log Provider is still unable to open the DhcpAdminEvents event log on computer 'nc2vws12ad5.corp.nathcorp.com'.
    The Provider has been unable to open the DhcpAdminEvents event log for 64080 seconds.
    Most recent error details: The RPC server is unavailable.
    Please suggest me how to resolve this so that my management server will again come back in healthy state.
    Thanks
    Abhishek

    Hi Abhishek,
    As i mentioned earlier the Alert resolution says the same points.
    Can you give details on the below ?
    Is there really a log named "Dhcpadminevents" in the MS's Event viewer ?
    Did you recently configure any new alert where you mentioned "Dhcpadminevents"
    as a event log location ?
    If yes then what is the target you selected for the rule / monitor there ?
    Can you post the results for analysis ?
    Gautam.75801

  • ESE - Event Log Warning: 906 - A significant portion of the database buffer cache has been written out to the system paging file...

    Hello -
    We have 3 x EX2010 SP3 RU5 nodes in a cross-site DAG.
    Multi-role servers with 18 GB RAM [increased from 16 GB in an attempt to clear this warning without success].
    We run nightly backups on both nodes at the Primary Site.
    Node 1 backup covers all mailbox databases [active & passive].
    Node 2 backup covers the Public Folders database.
    The backups for each database are timed so they do not overlap.
    During each backup we get several of these event log warnings:
     Log Name:      Application
     Source:        ESE
     Date:          23/04/2014 00:47:22
     Event ID:      906
     Task Category: Performance
     Level:         Warning
     Keywords:      Classic
     User:          N/A
     Computer:      EX1.xxx.com
     Description:
     Information Store (5012) A significant portion of the database buffer cache has been written out to the system paging file.  This may result  in severe performance degradation.
     See help link for complete details of possible causes.
     Resident cache has fallen by 42523 buffers (or 27%) in the last 903 seconds.
     Current Total Percent Resident: 26% (110122 of 421303 buffers)
    We've rescheduled the backups and the warning message occurences just move with the backup schedules.
    We're not aware of perceived end-user performance degradation, overnight backups in this time zone coincide with the business day for mailbox users in SEA.
    I raised a call with the Microsoft Enterprise Support folks, they had a look at BPA output and from their diagnostics tool. We have enough RAM and no major issues detected.
    They suggested McAfee AV could be the root of our problems, but we have v8.8 with EX2010 exceptions configured.
    Backup software is Asigra V12.2 with latest hotfixes.
    We're trying to clear up these warnings as they're throwing SCOM alerts and making a mess of availability reporting.
    Any suggestions please?
    Thanks in advance

    Having said all that, a colleague has suggested we just limit the amount of RAM available for the EX2010 DB cache
    Then it won't have to start releasing RAM when the backup runs, and won't throw SCOM alerts
    This attribute should do it...
    msExchESEParamCacheSizeMax
    http://technet.microsoft.com/en-us/library/ee832793.aspx
    Give me a shout if this is a bad idea
    Thanks

  • Warning on Event Log of Aironet 1300 Bridge

    I've been getting warning messages from the event log of a 1300 series bridge, which is set as an Access Point in the network, states: 'Packet to client (mac address) reached max retries, removing the client';  I'm not sure why the client is removed.  Does 'reached max retries' mean that the client has tried to many times to connect to the AP/Bridge?  What are other possible reasons why? 

    It means the AP has attempted to send a packet to the client and has not received an ack from it. The AP assumes the client is no longer in range of it and disconnects it.
    Sent from Cisco Technical Support iPad App

  • Event Viewer cannot open the event Log or Custom view. Verify that the Event log service is running or query is too long. The instance name passed was not recognized as valid by a WMI data provider(4201).

    "Event Viewer cannot open the event Log or Custom view. Verify that the Event log service is running or query is too long. The instance name passed was not recognized as valid by a WMI data provider(4201)"
    This error keeps cropping up now and again on most of our domain controllers (OS-2008 AND 2008R2)...Usually a restart fixes the issue however the issue repeats and security logs don't generate.
    Any advice on how to fix this issue permanently would be greatly appreciated.

    Please see this: https://social.technet.microsoft.com/Forums/windows/en-US/95987ca3-a1b2-4da6-95b7-d825d06cdac7/error-code-4201-the-instance-name-passed-was-not-recognized-as-valid-by-a-wmi-data-provider?forum=w7itprosecurity
    You can also try rebuilding the WMI repository: http://blogs.technet.com/b/askperf/archive/2009/04/13/wmi-rebuilding-the-wmi-repository.aspx
    This posting is provided AS IS with no warranties or guarantees , and confers no rights.
    Ahmed MALEK
    My Website Link
    My Linkedin Profile
    My MVP Profile

  • Methods for Remote Event Log Collection (WMI vs RPC vs WinRM)

    Hi,
    I'm currently evaluating several 3rd party tools (SIEMs) to help me with log management in a large (mostly) Windows domain environment. Each tool uses a different approach to collecting the event log from remote systems, and I'd like help understanding the
    pros and cons of each approach. I've dropped this in the scripting forum as the tools are essentially running different scripts and it's this part I would like to understand.
    WMI: An agent installed on a windows server connects to each monitored box and grabs their event logs via WMI. Our legacy SIEM already collects from over 2000 servers using this method.
    RPC: As above, but using RPC. No changes required on the remote machines.
    WinRM: An appliance integrates with AD and collects event logs remotely using WinRM. This is reasonably new to me (i'm a security guy, not a sys admin) but I seem to have to enable an additional remote management tool, and open a new listening port on every
    single machine I want to collect the event log from.
    I read the following blog entry, which seemed to indicate that RPC was the best choice for performance, considering I'm going to be making high frequency connections to over 2000 targets:
    http://blogs.technet.com/b/josebda/archive/2010/04/02/comparing-rpc-wmi-and-winrm-for-remote-server-management-with-powershell-v2.aspx 
    However, everything I have found on the subject of remote event collection seems to suggest that WinRM is the "approved" method for event log collection. The vendor using the WinRM approach is also suggesting that it is the only official MS supported
    way of doing this.
    So I would like to ask, is there a reason that WMI and RPC should not be used for this purpose, since they clearly work and don't require any changes to my environment? Is there some advantage to WinRM that justifies touching my entire estate and opening
    an additional port (increasing my attack surface)?
    Thanks in advance,

    Hi,
    I'm aware of the push method, and may indeed move to it in time, although I'm just as likely to install a 3rd party agent on the machines to perform this role with greater functionality and manageability for the same effort. I've only seen organisations
    using commercial agents (snare, splunk, etc) or WMI for log collection in practice, so I don't think I'm the only one with reservations about it.
    Anything that involves making configuration changes to a large and very varied estate is not something to do lightly. Particularly if alternatives exist that don't require this change to be carried out immediately. That is why I'm looking to properly understand
    the pros and cons of these "legacy" approaches for use as an interim solution if nothing more.
    Pulling probably is more resource intensive, although I've not seen an actual comparison, but it's not really that fragile in my experience. If a single pull fails, you just collect the logs you missed at the next pull cycle in a few seconds/minutes.
    All logs are pulled directly into a SIEM for analysis, so that part is covered.
    Anyway, I appreciate the input, but I'm still holding out for concrete reasons to move away from WMI/RPC or to embrace WinRM. Bear in mind I'm considering fixing something that doesn't look broken to me!
    Cheers,

  • Multiple event log errors with Indesign.exe

    A colleague is having some issues with CS3 and certain programs keep crashing and she has to keep restarting. I've not been given any further info at this stage so  I decided to delve into her event logs. Doing so uncovered a number of different InDesign errors, not of which seem to turn up especially relevent or helpful information when researched using Google.
    Faulting application InDesign.exe, version 6.0.0.352, time stamp 0x48bf8dab, faulting module GRAPHICS.RPLN, version 6.0.0.352, time stamp 0x48bf96f6, exception code 0xc0000005, fault offset 0x0003d27f, process id 0x1468, application start time 0x01cb064fddc3e01a.
    which has occured 7 times within the last hour or so. And
    Faulting application InDesign.exe, version 6.0.0.352, time stamp 0x48bf8dab, faulting module TEXT EDITOR.RPLN, version 6.0.0.352, time stamp 0x48bfaeb3, exception code 0xc0000005, fault offset 0x0001c187, process id 0x968, application start time 0x01cb063042d7b346.
    Dreamweaver, so different, but earlier in the week:
    Faulting application Dreamweaver.exe, version 10.0.0.4117, time stamp 0x48c874b4, faulting module MSVCR80.dll, version 8.0.50727.3053, time stamp 0x4889d619, exception code 0xc0000005, fault offset 0x00015500, process id 0xae8, application start time 0x01cb0328d57ca5c2.
    Last week:
    Faulting application InDesign.exe, version 6.0.0.352, time stamp 0x48bf8dab, faulting module Public.dll, version 6.0.0.352, time stamp 0x48bf8c2d, exception code 0xc0000005, fault offset 0x0002fd16, process id 0x1564, application start time 0x01cb0164aa056a40.
    Not sure if these are connected to her Creative Suite applications crashing, but they certainly don't look overly encouraging. She's running CS4 Design Standard, on a Dell XPS 420 with 3GB RAM and 32bit Vista Business OS.
    Any help appreciated as she's had to restart 3 or 4 times today, loosing work each time.
    Thanks!

    Peter, that's a good point, I'll get her to run an update. In the past we have been sceptical of updates since this seemed to cause more problems when the software was running fine, but I guess we have little choice here. Fingers crossed!
    @VectorIsBetter09 that's an interesting point. We do have somebody running Windows 7 64bit with the same applications installed (fresh install of CS4 rather than an upgrade to it from CS3) and I believe that's not had any issues. However, it does seem odd that the PC has been running with this software for well over a year/18 months with very few problems.

  • WMI stops returning event log entries

    A little bit of a strange issues with Server 2008. We've been trying to implement cisco CDA for a customer which uses wmi to read the security log on a DC and then matches the users up with the devices that are connecting to the network. Every week or so
    the CDA would stop receiving mappings from 2 out of 3 domain controllers. Once the wmi service is restarted on the DC the events start going through again.
    I've been able to replicate the behaviour using a script:
    strComputer = "dc-001.domain.local"
    Set objWMIService = GetObject("winmgmts:{(Security)}\\" & _
    strComputer & "\root\cimv2")
    Set colMonitoredEvents = objWMIService.ExecNotificationQuery _    
    ("Select * from __InstanceCreationEvent Where " _
    & "TargetInstance ISA 'Win32_NTLogEvent' " _
    & "and TargetInstance.EventCode=4768")
    Do While True
    Set objLatestEvent = colMonitoredEvents.NextEvent()
    Wscript.Echo objLatestEvent.TargetInstance.User
    Wscript.Echo objLatestEvent.TargetInstance.TimeWritten
    wscript.Echo objLatestEvent.TargetInstance.Message
    Wscript.Echo
    Loop
    This hotfix http://support.microsoft.com/kb/2705357 seems to match what I'm seeing as there
    are no errors ...just no events returned back. Unfortunately installing the hotfix made no difference at all.
    It's also worth noting I can run different wmi queries while the one above isn't working so wmi service is up and running.
    Has anyone else come across this, or have I missed another patch somewhere?

    Hi Kacenka,
    On current situation, please use
    WMI Diagnosis Tool to ascertain the current state of the WMI service. For more details, please refer to the following article.
    WMIDiag 2.1 is here!
    Meanwhile, please post the above script in the
    Official Scripting Guys Forum, then confirm if it can help you to achieve that target correctly.
    If any more detail, please feel free to let me know.
    Hope this helps.
    Best regards,
    Justin Gu

  • File history stopped working after a warning message in the event log

    I have encountered this twice that File history stopped working, the event log says:
    Unusual condition was encountered during finalization of a backup cycle for configuration C:\Users\xxxx\AppData\Local\Microsoft\Windows\FileHistory\Configuration\Config
    If I re-run it, it consumes the backup disk space but still failed to backup.
    I have to manually delete all backup, turn off File History and re-configure it again to make it work.
    This happened twice already, so all my file history lost after re-config.
    Anyone encounter the same situation?

    MICROSOFT is plagued by idiots!!!!
    - Just turn it off
    - then click  "select drive"
    - and when it asks you the retarded question... just click >>>>>"NO"<<<<<<<    -_-
    Seriously... this is the answer.... frigging retards at microsoft... to think it takes an army of programmers and billions of dollars to create such idiocy!
    http://answers.microsoft.com/en-us/windows/forum/windows_8-performance/cannot-change-drive-in-file-history-windows-8/6dbeca54-d05e-4f93-9262-45a56d6a82d1?page=2&msgId=f1792c5e-c5d0-4163-b449-c7165d72f88d&tab=question&status=AllReplies&status=AllReplies%2CAllReplies
    I cant believe these morons put everyone through such hell and then don't even bother to follow up with the correct solution.
    To top it of the moron moderator marks this as an answer??!!!
    What a pathetic joke - I hope everyone reads this message before being punished by the miles of bullcrap in this thread -_-
    Microsoft = ridiculous
    Thanks! I guess the TL;DR version is "to change your file history drive you need to discard the current temp files."
    Exactly :)
    It's the bad wording in the messages.
    the first message (which I can only vaguely remember so can't quote exactly) that gives you the impression you can continue
    something but doesn't make clear that to so will need the "old drive" configured the way the "old drive" was.
    Then the next message is just confusing:
    “we can't copy files to this location.  Your current File History drive is disconnected.  Reconnect the drive and try again” 
    sounds like 
    “we can't copy files to this location. [because there's a problem with the new location]
    Your current File History drive is disconnected. [the new location is disconnected]
    Reconnect the drive and try again [reconnect your new location and try again]” 
    When it should be reworded to say something along the lines of (in more formal language):
    "You asked us to continue...give us the drive you were previously using...or if it's no longer available, click here to start from scratch"
    (I know that's all the opposite of tldr but I'm trying again to put into words what I think was happening).

  • Application error happening at least twice a day. Faulting applicaiton name: wmiprvse.exe

    We're experiencing an issue with one of our Windows Server 2008R2 Standard Edition SP1 servers where an Application error occurs at least twice, and sometimes up to 5 or 6 times per day.  The following error is what we see.  Any help would be greatly
    appreciated, and I'll be checking back frequently to check for updates and provide more info whenever needed.  Thanks!
    General:
    Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79d42
    Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c8f9
    Exception code: 0xc0000374
    Fault offset: 0x00000000000c40f2
    Faulting process id: 0x1bbc
    Faulting application start time: 0x01cd5d65dbeb2e7c
    Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
    Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
    Details:
    System
    Provider
    [ Name]
    Application Error
    EventID
    1000
    [ Qualifiers]
    0
    Level
    2
    Task
    100
    Keywords
    0x80000000000000
    TimeCreated
    [ SystemTime]
    2012-07-09T08:34:39.000000000Z
    EventRecordID
    6812
    Channel
    Application
    Computer
    {FQDN}
    Security
    EventData
    wmiprvse.exe
    6.1.7601.17514
    4ce79d42
    ntdll.dll
    6.1.7601.17514
    4ce7c8f9
    c0000374
    00000000000c40f2
    1bbc
    01cd5d65dbeb2e7c
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\SYSTEM32\ntdll.dll
    ebe1621c-c9a0-11e1-a1d4-5cf3fce8cef6
    ETA:  I also ran the wmidiag.exe tool from Microsoft.  I saw it as a suggestion on another forum and ran it.  I don't know if it has any bearing here, but this is the log in case it's helpful
    show
    06604 14:51:25 (0) ** WMIDiag v2.1 started on Tuesday, July 10, 2012 at 14:40.
    06605 14:51:25 (0) ** 
    06606 14:51:25 (0) ** Copyright (c) Microsoft Corporation. All rights reserved - July 2007.
    06607 14:51:25 (0) ** 
    06608 14:51:25 (0) ** This script is not supported under any Microsoft standard support program or service.
    06609 14:51:25 (0) ** The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
    06610 14:51:25 (0) ** implied warranties including, without limitation, any implied warranties of merchantability
    06611 14:51:25 (0) ** or of fitness for a particular purpose. The entire risk arising out of the use or performance
    06612 14:51:25 (0) ** of the scripts and documentation remains with you. In no event shall Microsoft, its authors,
    06613 14:51:25 (0) ** or anyone else involved in the creation, production, or delivery of the script be liable for
    06614 14:51:25 (0) ** any damages whatsoever (including, without limitation, damages for loss of business profits,
    06615 14:51:25 (0) ** business interruption, loss of business information, or other pecuniary loss) arising out of
    06616 14:51:25 (0) ** the use of or inability to use the script or documentation, even if Microsoft has been advised
    06617 14:51:25 (0) ** of the possibility of such damages.
    06618 14:51:25 (0) ** 
    06619 14:51:25 (0) ** 
    06620 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06621 14:51:25 (0) ** ----------------------------------------------------- WMI REPORT: BEGIN ----------------------------------------------------------
    06622 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06623 14:51:25 (0) ** 
    06624 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06625 14:51:25 (0) ** Windows Server 2008 R2 - Service pack 1 - 64-bit (7601) - User {Username} on computer {ComputerName}.
    06626 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06627 14:51:25 (0) ** Environment: ........................................................................................................ OK.
    06628 14:51:25 (0) ** System drive: ....................................................................................................... C: (Disk #0 Partition #1).
    06629 14:51:25 (0) ** Drive type: ......................................................................................................... SCSI (IBM ServeRAID M5015 SCSI Disk Device).
    06630 14:51:25 (0) ** There are no missing WMI system files: .............................................................................. OK.
    06631 14:51:25 (0) ** There are no missing WMI repository files: .......................................................................... OK.
    06632 14:51:25 (0) ** WMI repository state: ............................................................................................... CONSISTENT.
    06633 14:51:25 (0) ** AFTER running WMIDiag:
    06634 14:51:25 (0) ** The WMI repository has a size of: ................................................................................... 90 MB.
    06635 14:51:25 (0) ** - Disk free space on 'C:': .......................................................................................... 75295 MB.
    06636 14:51:25 (0) **   - INDEX.BTR,                     15818752 bytes,     7/10/2012 2:38:58 PM
    06637 14:51:25 (0) **   - MAPPING1.MAP,                  242388 bytes,       7/10/2012 2:33:33 PM
    06638 14:51:25 (0) **   - MAPPING2.MAP,                  242388 bytes,       7/10/2012 2:38:58 PM
    06639 14:51:25 (0) **   - OBJECTS.DATA,                  77570048 bytes,     7/10/2012 2:38:58 PM
    06640 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06641 14:51:25 (2) !! WARNING: Windows Firewall: .......................................................................................... DISABLED.
    06642 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06643 14:51:25 (0) ** DCOM Status: ........................................................................................................ OK.
    06644 14:51:25 (0) ** WMI registry setup: ................................................................................................. OK.
    06645 14:51:25 (0) ** INFO: WMI service has dependents: ................................................................................... 1 SERVICE(S)!
    06646 14:51:25 (0) ** - Internet Connection Sharing (ICS) (SHAREDACCESS, StartMode='Disabled')
    06647 14:51:25 (0) ** => If the WMI service is stopped, the listed service(s) will have to be stopped as well.
    06648 14:51:25 (0) **    Note: If the service is marked with (*), it means that the service/application uses WMI but
    06649 14:51:25 (0) **          there is no hard dependency on WMI. However, if the WMI service is stopped,
    06650 14:51:25 (0) **          this can prevent the service/application to work as expected.
    06651 14:51:25 (0) ** 
    06652 14:51:25 (0) ** RPCSS service: ...................................................................................................... OK (Already started).
    06653 14:51:25 (0) ** WINMGMT service: .................................................................................................... OK (Already started).
    06654 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06655 14:51:25 (0) ** WMI service DCOM setup: ............................................................................................. OK.
    06656 14:51:25 (0) ** WMI components DCOM registrations: .................................................................................. OK.
    06657 14:51:25 (0) ** WMI ProgID registrations: ........................................................................................... OK.
    06658 14:51:25 (0) ** WMI provider DCOM registrations: .................................................................................... OK.
    06659 14:51:25 (0) ** WMI provider CIM registrations: ..................................................................................... OK.
    06660 14:51:25 (0) ** WMI provider CLSIDs: ................................................................................................ OK.
    06661 14:51:25 (2) !! WARNING: Some WMI providers EXE/DLL file(s) are missing: ............................................................ 18 WARNING(S)!
    06662 14:51:25 (0) ** - ROOT/QLOGIC_CMPI, QLogic_NIC_Provider, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{28A5F598-F699-4A6B-B9F9-8C7EB9B7359F}:QLogic_NIC_Provider
    06663 14:51:25 (0) ** - ROOT/QLOGIC_CMPI, QLogic_FCHBA_Provider, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{0AE588DD-D2E9-41EB-BCD1-8BF474187EC5}:QLogic_FCHBA_Provider
    06664 14:51:25 (0) ** - ROOT/IBMSD, ADPT_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{B007445E-6AF0-4CBD-9009-809F071FCE69}:ADPT_Module
    06665 14:51:25 (0) ** - ROOT/IBMSD, IBM_PA_Providers, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{2244E0FA-D37A-4F6E-82FB-92F1DB78716D}:IBM_PA_Providers
    06666 14:51:25 (0) ** - ROOT/IBMSD, EndpointRegistrationProviderModule, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{BF833E81-33AA-40ED-B74A-329F006DB4F8}:EndpointRegistrationProviderModule
    06667 14:51:25 (0) ** - ROOT/CIMV2, SBLIM_Data_Gatherer, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{0D03AF80-A160-44EF-9E8B-318201F41693}:SBLIM_Data_Gatherer
    06668 14:51:25 (0) ** - ROOT/ADPT, ADPT_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{B007445E-6AF0-4CBD-9009-809F071FCE69}:ADPT_Module
    06669 14:51:25 (0) ** - ROOT/PG_INTEROP, SBLIM_Data_Gatherer, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{0D03AF80-A160-44EF-9E8B-318201F41693}:SBLIM_Data_Gatherer
    06670 14:51:25 (0) ** - ROOT/PG_INTEROP, LSIESG_SMIS13_HHR_ProviderModule, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{E21064DD-757A-4F2D-B798-81CDFF03B48C}:LSIESG_SMIS13_HHR_ProviderModule
    06671 14:51:25 (0) ** - ROOT/PG_INTEROP, emulex_fc_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{27734403-1E6C-4BC7-B97D-1FE9657B35EC}:emulex_fc_provider_Module
    06672 14:51:25 (0) ** - ROOT/PG_INTEROP, emulex_ucna_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{68D3C192-F517-41CC-B852-BA74A8D05A85}:emulex_ucna_provider_Module
    06673 14:51:25 (0) ** - ROOT/IBMSE, emulex_fc_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{27734403-1E6C-4BC7-B97D-1FE9657B35EC}:emulex_fc_provider_Module
    06674 14:51:25 (0) ** - ROOT/IBMSE, IBM_PA_Providers, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{2244E0FA-D37A-4F6E-82FB-92F1DB78716D}:IBM_PA_Providers
    06675 14:51:25 (0) ** - ROOT/IBMSE, emulex_ucna_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{68D3C192-F517-41CC-B852-BA74A8D05A85}:emulex_ucna_provider_Module
    06676 14:51:25 (0) ** - ROOT/LSI_MR_1_3_0, LSIESG_SMIS13_HHR_ProviderModule, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{E21064DD-757A-4F2D-B798-81CDFF03B48C}:LSIESG_SMIS13_HHR_ProviderModule
    06677 14:51:25 (0) ** - ROOT/EMULEX, emulex_fc_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{27734403-1E6C-4BC7-B97D-1FE9657B35EC}:emulex_fc_provider_Module
    06678 14:51:25 (0) ** - ROOT/EMULEX, emulex_ucna_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{68D3C192-F517-41CC-B852-BA74A8D05A85}:emulex_ucna_provider_Module
    06679 14:51:25 (0) ** - ROOT/BROCADE, brcdprovider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{48898EFD-0F9A-4657-B03D-FF400A7D2CDE}:brcdprovider_Module
    06680 14:51:25 (0) ** => This will make any operations related to the WMI class supported by the provider(s) to fail.
    06681 14:51:25 (0) **    This can be due to:
    06682 14:51:25 (0) **    - the de-installation of the software.
    06683 14:51:25 (0) **    - the deletion of some files.
    06684 14:51:25 (0) ** => If the software has been de-installed intentionally, then this information must be
    06685 14:51:25 (0) **    removed from the WMI repository. You can use the 'WMIC.EXE' command to remove
    06686 14:51:25 (0) **    the provider registration data.
    06687 14:51:25 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\BROCADE path __Win32Provider Where Name='brcdprovider_Module' DELETE'
    06688 14:51:25 (0) ** => If not, you must restore a copy of the missing provider EXE/DLL file(s) as indicated by the path.
    06689 14:51:25 (0) **    You can retrieve the missing file from:
    06690 14:51:25 (0) **    - A backup.
    06691 14:51:25 (0) **    - The Windows CD.
    06692 14:51:25 (0) **    - Another Windows installation using the same version and service pack level of the examined system.
    06693 14:51:25 (0) **    - The original CD or software package installing this WMI provider.
    06694 14:51:25 (0) ** 
    06695 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06696 14:51:25 (0) ** INFO: User Account Control (UAC): ................................................................................... DISABLED.
    06697 14:51:25 (0) ** INFO: Local Account Filtering: ...................................................................................... ENABLED.
    06698 14:51:25 (0) ** => WMI tasks remotely accessing WMI information on this computer and requiring Administrative
    06699 14:51:25 (0) **    privileges MUST use a DOMAIN account part of the Local Administrators group of this computer
    06700 14:51:25 (0) **    to ensure that administrative privileges are granted. If a Local User account is used for remote
    06701 14:51:25 (0) **    accesses, it will be reduced to a plain user (filtered token), even if it is part of the Local Administrators group.
    06702 14:51:25 (0) ** 
    06703 14:51:25 (0) ** Overall DCOM security status: ....................................................................................... OK.
    06704 14:51:25 (0) ** Overall WMI security status: ........................................................................................ OK.
    06705 14:51:25 (0) ** - Started at 'Root' --------------------------------------------------------------------------------------------------------------
    06706 14:51:25 (0) ** INFO: WMI permanent SUBSCRIPTION(S): ................................................................................ 2.
    06707 14:51:25 (0) ** - ROOT/SUBSCRIPTION, CommandLineEventConsumer.Name="BVTConsumer".
    06708 14:51:25 (0) **   'SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99'
    06709 14:51:25 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="SCM Event Log Consumer".
    06710 14:51:25 (0) **   'select * from MSFT_SCMEventLogEvent'
    06711 14:51:25 (0) ** 
    06712 14:51:25 (0) ** WMI TIMER instruction(s): ........................................................................................... NONE.
    06713 14:51:25 (0) ** INFO: WMI namespace(s) requiring PACKET PRIVACY: .................................................................... 3 NAMESPACE(S)!
    06714 14:51:25 (0) ** - ROOT/CIMV2/SECURITY/MICROSOFTTPM.
    06715 14:51:25 (0) ** - ROOT/CIMV2/TERMINALSERVICES.
    06716 14:51:25 (0) ** - ROOT/SERVICEMODEL.
    06717 14:51:25 (0) ** => When remotely connecting, the namespace(s) listed require(s) the WMI client to
    06718 14:51:25 (0) **    use an encrypted connection by specifying the PACKET PRIVACY authentication level.
    06719 14:51:25 (0) **    (RPC_C_AUTHN_LEVEL_PKT_PRIVACY or PktPrivacy flags)
    06720 14:51:25 (0) **    i.e. 'WMIC.EXE /NODE:"{ComputerName}" /AUTHLEVEL:Pktprivacy /NAMESPACE:\\ROOT\SERVICEMODEL Class __SystemSecurity'
    06721 14:51:25 (0) ** 
    06722 14:51:25 (0) ** WMI MONIKER CONNECTIONS: ............................................................................................ OK.
    06723 14:51:25 (0) ** WMI CONNECTIONS: .................................................................................................... OK.
    06724 14:51:25 (1) !! ERROR: WMI GET operation errors reported: ........................................................................... 30 ERROR(S)!
    06725 14:51:25 (0) ** - Root/CIMV2, MSFT_NetInvalidDriverDependency, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06726 14:51:25 (0) **   MOF Registration: ''
    06727 14:51:25 (0) ** - Root/CIMV2, Win32_OsBaselineProvider, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06728 14:51:25 (0) **   MOF Registration: ''
    06729 14:51:25 (0) ** - Root/CIMV2, Win32_OsBaseline, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06730 14:51:25 (0) **   MOF Registration: ''
    06731 14:51:25 (0) ** - Root/CIMV2, Win32_DriverVXD, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06732 14:51:25 (0) **   MOF Registration: ''
    06733 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_GenericIKEandAuthIP, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06734 14:51:25 (0) **   MOF Registration: ''
    06735 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_GenericIKEandAuthIP, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06736 14:51:25 (0) **   MOF Registration: ''
    06737 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecAuthIPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06738 14:51:25 (0) **   MOF Registration: ''
    06739 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecAuthIPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06740 14:51:25 (0) **   MOF Registration: ''
    06741 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecAuthIPv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06742 14:51:25 (0) **   MOF Registration: ''
    06743 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecAuthIPv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06744 14:51:25 (0) **   MOF Registration: ''
    06745 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecIKEv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06746 14:51:25 (0) **   MOF Registration: ''
    06747 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecIKEv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06748 14:51:25 (0) **   MOF Registration: ''
    06749 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecIKEv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06750 14:51:25 (0) **   MOF Registration: ''
    06751 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecIKEv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06752 14:51:25 (0) **   MOF Registration: ''
    06753 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_TermService_TerminalServices, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06754 14:51:25 (0) **   MOF Registration: ''
    06755 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_TermService_TerminalServices, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06756 14:51:25 (0) **   MOF Registration: ''
    06757 14:51:25 (0) ** - Root/WMI, ReserveDisjoinThread, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06758 14:51:25 (0) **   MOF Registration: ''
    06759 14:51:25 (0) ** - Root/WMI, ReserveLateCount, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06760 14:51:25 (0) **   MOF Registration: ''
    06761 14:51:25 (0) ** - Root/WMI, ReserveJoinThread, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06762 14:51:25 (0) **   MOF Registration: ''
    06763 14:51:25 (0) ** - Root/WMI, ReserveDelete, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06764 14:51:25 (0) **   MOF Registration: ''
    06765 14:51:25 (0) ** - Root/WMI, ReserveBandwidth, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06766 14:51:25 (0) **   MOF Registration: ''
    06767 14:51:25 (0) ** - Root/WMI, ReserveCreate, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06768 14:51:25 (0) **   MOF Registration: ''
    06769 14:51:25 (0) ** - Root/WMI, SystemConfig_PhyDisk, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06770 14:51:25 (0) **   MOF Registration: ''
    06771 14:51:25 (0) ** - Root/WMI, SystemConfig_Video, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06772 14:51:25 (0) **   MOF Registration: ''
    06773 14:51:25 (0) ** - Root/WMI, SystemConfig_IDEChannel, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06774 14:51:25 (0) **   MOF Registration: ''
    06775 14:51:25 (0) ** - Root/WMI, SystemConfig_NIC, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06776 14:51:25 (0) **   MOF Registration: ''
    06777 14:51:25 (0) ** - Root/WMI, SystemConfig_Network, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06778 14:51:25 (0) **   MOF Registration: ''
    06779 14:51:25 (0) ** - Root/WMI, SystemConfig_CPU, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06780 14:51:25 (0) **   MOF Registration: ''
    06781 14:51:25 (0) ** - Root/WMI, SystemConfig_LogDisk, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06782 14:51:25 (0) **   MOF Registration: ''
    06783 14:51:25 (0) ** - Root/WMI, SystemConfig_Power, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    06784 14:51:25 (0) **   MOF Registration: ''
    06785 14:51:25 (0) ** => When a WMI performance class is missing (i.e. 'Win32_PerfRawData_TermService_TerminalServices'), it is generally due to
    06786 14:51:25 (0) **    a lack of buffer refresh of the WMI class provider exposing the WMI performance counters.
    06787 14:51:25 (0) **    You can refresh the WMI class provider buffer with the following command:
    06788 14:51:25 (0) ** 
    06789 14:51:25 (0) **    i.e. 'WINMGMT.EXE /SYNCPERF'
    06790 14:51:25 (0) ** 
    06791 14:51:25 (0) ** WMI MOF representations: ............................................................................................ OK.
    06792 14:51:25 (0) ** WMI QUALIFIER access operations: .................................................................................... OK.
    06793 14:51:25 (0) ** WMI ENUMERATION operations: ......................................................................................... OK.
    06794 14:51:25 (2) !! WARNING: WMI EXECQUERY operation errors reported: ................................................................... 2 WARNING(S)!
    06795 14:51:25 (0) ** - Root/CIMV2, 'Select * From Win32_PointingDevice WHERE Status = "OK"' did not return any instance while AT LEAST 1 instance is expected.
    06796 14:51:25 (0) ** - Root/CIMV2, 'Select * From Win32_Keyboard' did not return any instance while AT LEAST 1 instance is expected.
    06797 14:51:25 (0) ** 
    06798 14:51:25 (2) !! WARNING: WMI GET VALUE operation errors reported: ................................................................... 5 WARNING(S)!
    06799 14:51:25 (0) ** - Root, Instance: __EventConsumerProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000').
    06800 14:51:25 (0) ** - Root, Instance: __EventProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000').
    06801 14:51:25 (0) ** - Root, Instance: __EventSinkCacheControl=@, Property: ClearAfter='00000000000015.000000:000' (Expected default='00000000000230.000000:000').
    06802 14:51:25 (0) ** - Root, Instance: __ObjectProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000').
    06803 14:51:25 (0) ** - Root, Instance: __PropertyProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000').
    06804 14:51:25 (0) ** 
    06805 14:51:25 (0) ** WMI WRITE operations: ............................................................................................... NOT TESTED.
    06806 14:51:25 (0) ** WMI PUT operations: ................................................................................................. NOT TESTED.
    06807 14:51:25 (0) ** WMI DELETE operations: .............................................................................................. NOT TESTED.
    06808 14:51:25 (0) ** WMI static instances retrieved: ..................................................................................... 2072.
    06809 14:51:25 (0) ** WMI dynamic instances retrieved: .................................................................................... 0.
    06810 14:51:25 (0) ** WMI instance request cancellations (to limit performance impact): ................................................... 1.
    06811 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06812 14:51:25 (0) ** # of Event Log events BEFORE WMIDiag execution since the last 20 day(s):
    06813 14:51:25 (0) **   DCOM: ............................................................................................................. 0.
    06814 14:51:25 (0) **   WINMGMT: .......................................................................................................... 0.
    06815 14:51:25 (0) **   WMIADAPTER: ....................................................................................................... 0.
    06816 14:51:25 (0) ** 
    06817 14:51:25 (0) ** # of additional Event Log events AFTER WMIDiag execution:
    06818 14:51:25 (0) **   DCOM: ............................................................................................................. 0.
    06819 14:51:25 (0) **   WINMGMT: .......................................................................................................... 0.
    06820 14:51:25 (0) **   WMIADAPTER: ....................................................................................................... 0.
    06821 14:51:25 (0) ** 
    06822 14:51:25 (0) ** 30 error(s) 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found
    06823 14:51:25 (0) ** => This error is typically a WMI error. This WMI error is due to:
    06824 14:51:25 (0) **    - a missing WMI class definition or object.
    06825 14:51:25 (0) **      (See any GET, ENUMERATION, EXECQUERY and GET VALUE operation failures).
    06826 14:51:25 (0) **      You can correct the missing class definitions by:
    06827 14:51:25 (0) **      - Manually recompiling the MOF file(s) with the 'MOFCOMP <FileName.MOF>' command.
    06828 14:51:25 (0) **      Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.
    06829 14:51:25 (0) **            (This list can be built on a similar and working WMI Windows installation)
    06830 14:51:25 (0) **            The following command line must be used:
    06831 14:51:25 (0) **            i.e. 'WMIDiag CorrelateClassAndProvider'
    06832 14:51:25 (0) **      Note: When a WMI performance class is missing, you can manually resynchronize performance counters
    06833 14:51:25 (0) **            with WMI by starting the ADAP process.
    06834 14:51:25 (0) **    - a WMI repository corruption.
    06835 14:51:25 (0) **      In such a case, you must rerun WMIDiag with 'WriteInRepository' parameter
    06836 14:51:25 (0) **      to validate the WMI repository operations.
    06837 14:51:25 (0) **    Note: ENSURE you are an administrator with FULL access to WMI EVERY namespaces of the computer before
    06838 14:51:25 (0) **          executing the WriteInRepository command. To write temporary data from the Root namespace, use:
    06839 14:51:25 (0) **          i.e. 'WMIDiag WriteInRepository=Root'
    06840 14:51:25 (0) **    - If the WriteInRepository command fails, while being an Administrator with ALL accesses to ALL namespaces
    06841 14:51:25 (0) **      the WMI repository must be reconstructed.
    06842 14:51:25 (0) **    Note: The WMI repository reconstruction requires to locate all MOF files needed to rebuild the repository,
    06843 14:51:25 (0) **          otherwise some applications may fail after the reconstruction.
    06844 14:51:25 (0) **          This can be achieved with the following command:
    06845 14:51:25 (0) **          i.e. 'WMIDiag ShowMOFErrors'
    06846 14:51:25 (0) **    Note: The repository reconstruction must be a LAST RESORT solution and ONLY after executing
    06847 14:51:25 (0) **          ALL fixes previously mentioned.
    06848 14:51:25 (2) !! WARNING: Static information stored by external applications in the repository will be LOST! (i.e. SMS Inventory)
    06849 14:51:25 (0) ** 
    06850 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06851 14:51:25 (0) ** Unexpected, wrong or missing registry key values: ................................................................... 1 KEY(S)!
    06852 14:51:25 (0) ** INFO: Unexpected registry key value:
    06853 14:51:25 (0) **   - Current:  HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\Logging (REG_SZ) -> 0
    06854 14:51:25 (0) **   - Expected: HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\Logging (REG_SZ) -> 1
    06855 14:51:25 (0) **     From the command line, the registry configuration can be corrected with the following command:
    06856 14:51:25 (0) **     i.e. 'REG.EXE Add "HKLM\SOFTWARE\Microsoft\WBEM\CIMOM" /v "Logging" /t "REG_SZ" /d "1" /f'
    06857 14:51:25 (0) ** 
    06858 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06859 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06860 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06861 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06862 14:51:25 (0) ** 
    06863 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06864 14:51:25 (0) ** ------------------------------------------------------ WMI REPORT: END -----------------------------------------------------------
    06865 14:51:25 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    06866 14:51:25 (0) ** 
    06867 14:51:25 (0) ** ERROR: WMIDiag detected issues that could prevent WMI to work properly!.  Check 'C:\USERS\{Username}\APPDATA\LOCAL\TEMP\WMIDIAG-V2.1_2K8R2.SRV.SP1.64_{ComputerName}_2012.07.10_14.40.25.LOG' for details.
    06868 14:51:25 (0) ** 
    06869 14:51:25 (0) ** WMIDiag v2.1 ended on Tuesday, July 10, 2012 at 14:51 (W:103 E:51 S:1).

    Following might help
    A Wmiprvse.exe process crashes in Windows Server 2008 R2 when you use the WMI interface to query the hardware status on a computer that supports the IPMI standard
    http://support.microsoft.com/kb/2280777
    I do not represent the organisation I work for, all the opinions expressed here are my own.
    This posting is provided "AS IS" with no warranties or guarantees and confers no rights.
    I saw this in my googling.  Listed as the cause on the hotfix page is the following: "This
    problem occurs because the Ipmiprv.dll module leads the Wmiprvse.exe process to crash. This behavior depends on certain hardware sensor types when the sensor is enumerated."  The
    faulting module for that hotfix is ipmiprv.dll, and our faulting module is ntdll.dll.  I'm thinking that this hotfix isn't applicable, but I'm open to hearing why I'm incorrect if I am.
    Seth Johnson

  • WMIPRVSE.exe crashing server 2012 r2 Standard

    I am getting the following error and when this happens I am unable to query wmi objects until I kill the wmiprvse process which is using 25% CPU and restart the WMI service.  Can anyone point me in the right direction
    Log Name:      Application
    Source:        Application Error
    Date:          3/13/2014 8:09:20 AM
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:     
    Description:
    Faulting application name: wmiprvse.exe, version: 6.3.9600.16384, time stamp: 0x5215f9c9
    Faulting module name: DnsServerPsProvider.dll, version: 6.3.9600.16384, time stamp: 0x5215e759
    Exception code: 0xc0000005
    Fault offset: 0x00000000000ef9d1
    Faulting process id: 0x2e30
    Faulting application start time: 0x01cf3db0fef3c715
    Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
    Faulting module path: C:\Windows\System32\wbem\DnsServerPsProvider.dll
    Report Id: afdec300-aab0-11e3-80c4-00155d141503
    Faulting package full name:
    Faulting package-relative application ID:
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-03-13T13:09:20.000000000Z" />
        <EventRecordID>19343</EventRecordID>
        <Channel>Application</Channel>
        <Computer></Computer>
        <Security />
      </System>
      <EventData>
        <Data>wmiprvse.exe</Data>
        <Data>6.3.9600.16384</Data>
        <Data>5215f9c9</Data>
        <Data>DnsServerPsProvider.dll</Data>
        <Data>6.3.9600.16384</Data>
        <Data>5215e759</Data>
        <Data>c0000005</Data>
        <Data>00000000000ef9d1</Data>
        <Data>2e30</Data>
        <Data>01cf3db0fef3c715</Data>
        <Data>C:\Windows\system32\wbem\wmiprvse.exe</Data>
        <Data>C:\Windows\System32\wbem\DnsServerPsProvider.dll</Data>
        <Data>afdec300-aab0-11e3-80c4-00155d141503</Data>
        <Data>
        </Data>
        <Data>
        </Data>
      </EventData>
    </Event>

    Hi,
    Would you please let me confirm if uses the Win32_Service WMI class to query some service information? Before
    this issue occurred, have you change any settings or installed any third-party application? Based on your description, I noticed that the wmiprvse process used 25% CPU. Meanwhile, did memory usage of Wmiprvse.exe process keeps increasing, and the system performance
    decreases?
    Please use sfc /scannow command to scan and verify protected system files. For more details, please refer to
    the following article.
    System File Checker (sfc)
    In addition, please perform a clean boot to check if software conflicts. For detailed operations, please refer
    to the following KB.
    How to perform a clean boot in Windows
    The dnsserverpsprovider.dll has description DNS WMIv2 Provider. Meanwhile, please navigate to path of DnsServerPsProvider.dll
    and check if it’s OK.
    By the way, please refer to the following article and trace WMI activity. Then check if you can find some more
    clues.
    Tracing WMI Activity
    Hope this helps.
    Best regards,
    Justin Gu

Maybe you are looking for

  • How do I keep an Edge Animate banner ad file size small?

    Most publishers cap the file size of banner ads at 30 KB to 50 KB. Is that possible using Edge? I know someone asked a question like this two years ago, and the reply was to use a CDN to serve the larger .js files. Is there a more direct approach now

  • Color correction technique

    After editing my project and publishing to a DVD , I've been a liitle disappointed in the color saturation of my final project when viewed on my TV. The video just appears a little flat. Can someone guide me through a good color correction process th

  • Text in a Cell Problem

    http://martinpaulphotography.com/About.html The text on my about page is currently a graphic. I want it to be live text. I deleted the graphic and typed into the cell. It looked fine in DW but when I preview it in my browser the text is not constrain

  • Bank accounts and app tabs

    I have a general question about app tabs and accessing my bank accounts online. I have read articles that say that when accessing your accounts online the safest method is to have only that trusted site open, so that in case there is a problem you do

  • Information on SAP: ERP 2004 ECC Component

    Hi All, We are performing a Pilot Project for one of our client, by integrating and harnessing the functionalities of technologies like SAP: Netweaver Portal (GUI), SAP: Exchange Infrastructure (Middleware), Manufacturing Execution System (MES) along