strange event viewer error

G

gerryf

OK, here's the error

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage
99" could not be reactivated in namespace "//./root/CIMV2" because of
error 0x80041003. Events cannot be delivered through this filter until the
problem is corrected.

Basically, how do I correct the problem?

This is occurring on two identical machines, both of which were updated from
Windows XP Professional. Not a great deal of interesting stuff on these
machines--simple workstations. I suspect this may have resulted from the
upgrade, rather than the clean install.

The PCs seem to work fine except for these errors.
 
M

Miles Li [MSFT]

Dear Customer,

Thanks for posting in partner newsgroup.

The '0x80041003' error code you provided indicates that
WBEM_E_ACCESS_DENIED.

This typically results when the process trying to access the namespace does
not have the required WMI privileges. The account attempting remote access
should be an administrator on the target computer; in addition, the account
might need to have a specific privilege enabled. To troubleshoot this
error, check the namespace security on the remote namespace to see the
privileges enabled for the account.


For this issue, I'd like to know which user account is used when processing
the query and whether there is proper permission on the '/root/CIMV2'.

To verify the permission of '/root/CIMV2':

Run--->'wmimgmt.msc'--->WMI control
(local)--->Properties--->Security--->/root/CIMV2


Please note: In Windows XP, 'Everyone' group have Execute Methods
permission by default. In Windows Vista, it is replaced with 'Authenticated
Users' group.

Hope this helps.

Miles Li
Microsoft Online Partner Support
 
G

gerryf

Thank you Miles,

Yes, from what I was able to glean from various sources, that is what I
thought as well. However, it didn't seem to make sense to me in the context
of the situation. All of the attempts to investigate this issue have led me
to Windows server running MYSQL server, but none (yet) seem to be Vista
related.

This is a newly installed Vista Ultimate machine (upgrade, actually), in a
network. There is no remote access -- the two machines are presently
standalone machines. These machines were fully updated XP Pro machines that
were updated using the Technet supplied Vista with integrated sp1 iso. The
error appears while checking the event log from an administrator account.

It appears the security for Root\CIMv2 is the default

Authenticated users has EXECUTE METHODS, PROVIDER WRITE, ENABLE ACCOUNT are
set to allow
Local Service EXECUTE METHODS, PROVIDER WRITE, ENABLE ACCOUNT are set to
allow
Network Service EXECUTE METHODS, PROVIDER WRITE, ENABLE ACCOUNT are set to
allow
Administrators EXECUTE METHODS, FULL WRITE, PARTIAL WRITER,, PROVIDER
WRITE, ENABLE ACCOUNT are set to allow

How can I determine what account is used when processing the query--indeed,
what query?
 
G

gerryf

Thank you Mark,

I had actually toyed with that idea given it seems to be at least marginally
related to wbem according to the error message, but the error seems to occur
mostly on servers running mysql so I was unsure if I should try that.
 
G

gerryf

That seems to have done the trick--after deleting the repository files and
rebooting 5 times the error has not recurred

Thanks!
 
M

Miles Li [MSFT]

Hello,

Thanks for Mark's sharing.

Yes, 'Root\CIMv2' has the proper default permission and it should works.

For Mark's suggest has affects now, I'd like to recommend you to have a
further test to see whether it is stable or not.

Again, thanks for using newsgroups.


Miles Li
Microsoft Online Partner Support
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top