Repeated WMI DCOM errors

E

eplantz

We have an office of 50+ Dell workstations all running XP SP3 with all
current patches. The servers are all Server 2008 (Active directory,
Exchange 2007, etc.)

For months now, there have been a DCOM problem that I have been unable
to resolve.

Every morning, at 2:30AM, all workstations are rebooted. I do this
with a PSSHUTDOWN script.

Every morning, 1 or 2 workstations develop a DCOM error loop right
after the workstation has rebooted. It just keeps going and going.....
causing extremely slow logins and processing. The usual solution is to
reboot the workstation which clears the loop condition and makes the
workstation normal again. The affected workstations are not the same
every day..... it seems to affect all of the units on the LAN but
different ones each day. Yes, some of them repeat after a while.

The error seems to be related to WMI and I have looked at/set
permissions on various CLSID items and in WMI control panel and
DCOMCNFG with no change in the problem.

I need to get rid of this problem. I need to have XP stop repeating
this DCOM error race condition and any help forum members can provide
would be helpful.

the following log excerpt shows the EVENTLOG entry at 2:30AM (event
log item is when the workstation was rebooted) , the loop and then
forced rebooted again around 8:38am.

Information 3/23/2011 8:33:58 AM Tcpip None 4201 N/A LCY
Information 3/23/2011 8:34:06 AM eventlog None 6005 N/A LCY
Information 3/23/2011 8:34:06 AM eventlog None 6009 N/A LCY
Error 3/23/2011 8:33:24 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:30:43 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:27:40 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:24:49 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:21:51 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:18:52 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:15:53 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:12:55 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:09:16 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:06:36 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:03:56 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 8:00:59 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:58:19 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:55:39 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:52:59 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:49:59 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:46:59 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:43:41 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:41:01 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:38:02 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:35:07 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:32:07 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:28:59 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:26:18 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:23:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:20:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:20:05 AM DCOM None 10010 SYSTEM LCY
Error 3/23/2011 7:17:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:14:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:11:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:08:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:05:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 7:02:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:59:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:56:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:53:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:50:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:47:33 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:44:53 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:42:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:39:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:36:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:32:53 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:30:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:27:13 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:23:47 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:21:06 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:18:05 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:15:16 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:12:27 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:09:42 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:07:02 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:04:22 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 6:01:42 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:59:02 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:56:22 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:53:42 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:51:02 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:48:22 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:45:42 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:43:02 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:40:15 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:37:18 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:34:23 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:31:43 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:29:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:26:23 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:23:43 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:21:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:20:01 AM DCOM None 10010 SYSTEM LCY
Error 3/23/2011 5:18:23 AM DCOM None 10010 NETWORK SERVICE LCY
Information 3/23/2011 5:17:29 AM Service Control Manager None 7036 N/A
LCY
Error 3/23/2011 5:15:43 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:13:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:09:43 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:07:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:03:23 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 5:00:43 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:58:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:55:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:52:23 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:49:43 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:47:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:44:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:41:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:38:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:35:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:32:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:28:43 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:26:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:22:43 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:20:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:17:03 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:13:47 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:11:06 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:08:11 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 4:05:30 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 3:16:16 AM DCOM None 10010 SYSTEM LCY
Error 3/23/2011 3:07:41 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 3:05:01 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 2:45:21 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 2:42:41 AM DCOM None 10010 NETWORK SERVICE LCY
Error 3/23/2011 2:40:01 AM DCOM None 10010 NETWORK SERVICE LCY
Information 3/23/2011 2:37:37 AM Service Control Manager None 7036 N/A
LCY
Information 3/23/2011 2:37:37 AM Service Control Manager None 7035
SYSTEM LCY
Error 3/23/2011 2:37:37 AM Service Control Manager None 7022 N/A LCY
Error 3/23/2011 2:37:37 AM Service Control Manager None 7022 N/A LCY
Warning 3/23/2011 2:34:08 AM LsaSrv SPNEGO (Negotiator) 40961 N/A LCY
Information 3/23/2011 2:31:45 AM Tcpip None 4201 N/A LCY
Information 3/23/2011 2:31:53 AM eventlog None 6005 N/A LCY
Information 3/23/2011 2:31:53 AM eventlog None 6009 N/A LCY
Information 3/23/2011 2:30:56 AM eventlog None 6006 N/A LCY

this is the content of one of the DCOM errors:

The server {1F87137D-0E7C-44D5-8C73-4EFFB68962F2} did not register
with DCOM within the required timeout.



and some entries from the WBEM log:


(Sat Mar 19 02:38:13 2011.418312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 02:38:13 2011.418312) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 02:40:53 2011.578312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 02:42:53 2011.698328) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80041013
(Sat Mar 19 02:43:33 2011.738312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 02:43:33 2011.738312) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 02:46:13 2011.898312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 02:48:53 2011.1058312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 02:48:53 2011.1058312) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 02:51:33 2011.1218312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 02:53:34 2011.1339656) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80041013
(Sat Mar 19 02:54:13 2011.1378312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 02:54:13 2011.1378312) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 02:56:53 2011.1538312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 02:58:54 2011.1659734) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80041013
(Sat Mar 19 02:59:33 2011.1698312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 02:59:33 2011.1698312) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 03:02:13 2011.1858312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:04:14 2011.1979875) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80041013
(Sat Mar 19 03:04:53 2011.2018312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:04:53 2011.2018312) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 03:07:33 2011.2178312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:08:36 2011.2241093) : NT Event Log Consumer: could not
retrieve sid, 0x80041002
(Sat Mar 19 03:09:34 2011.2299531) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80041013
(Sat Mar 19 03:10:13 2011.2338312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:10:13 2011.2338312) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 03:12:53 2011.2498312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:14:54 2011.2619500) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80041013
(Sat Mar 19 03:15:33 2011.2658312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:15:33 2011.2658312) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 03:18:13 2011.2818312) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:23:34 2011.3139515) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:23:34 2011.3139515) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 03:28:54 2011.3459515) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:31:34 2011.3619515) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:31:34 2011.3619515) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 03:34:14 2011.3779515) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:39:35 2011.4100828) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:39:35 2011.4100828) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 03:42:15 2011.4260828) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:44:55 2011.4420828) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:44:55 2011.4420828) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 03:47:35 2011.4580828) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:52:57 2011.4902125) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:52:57 2011.4902125) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 03:55:37 2011.5062125) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:58:17 2011.5222125) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 03:58:17 2011.5222125) : Non-WMI error code recieved from
provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt
to re-activate
(Sat Mar 19 04:00:57 2011.5382125) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 04:06:18 2011.5703437) : Unable to load event provider
'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2':
0x80080005
(Sat Mar 19 04:0

<lots more repeated until forced reboot).

Thanks

Gene
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top