WMIdiag, what have I learned

J

J Lunis

XP SR2
Windows Services gives me an error of 'Interface: class not registered'
when I check dependencies of any service.
In addition, I have a frequent Event Viewer error relating to DCOM
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Description:
The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register
with DCOM within the required timeout.

Under Local Area Connection Status>Properties>Advanced I have
'Windows can not display the Properties of this connection. The Windows
Management Instrumentation (WMI)information might be corrupted.'

These errors are related to WMI so I ran WMIdiag. Found some errors but
do not understand how I can correct them. Guidance please.


..1230 08:42:57 (1) !! ERROR: WMI ADAP status:
..................................................................... NOT
AVAILABLE
..1231 08:42:57 (0) ** You can start the WMI AutoDiscovery/AutoPurge
(ADAP) process to resynchronize
..1232 08:42:57 (0) ** the performance counters with the WMI
performance classes with the following commands:
..1233 08:42:57 (0) ** e.g. 'WINMGMT.EXE /CLEARADAP'
..1234 08:42:57 (0) ** e.g. 'WINMGMT.EXE /RESYNCPERF'
..1235 08:42:57 (0) ** The ADAP process logs informative events in the
Windows NT event log.
******NOTE: I ran the above commands in the CMD window. Have no idea
if it made a difference. ******************

..1238 08:42:57 (1) !! ERROR: WMI CONNECTION errors occured for the
following namespaces: ......................... 5 ERROR(S)!
..1239 08:42:57 (0) ** - Root, 0x80040154 - Class not registered.
..1240 08:42:57 (0) ** - Root, 0x80040154 - Class not registered.
..1241 08:42:57 (0) ** - Root/Default, 0x80040154 - Class not registered.
..1242 08:42:57 (0) ** - Root/CIMv2, 0x80040154 - Class not registered.
..1243 08:42:57 (0) ** - Root/WMI, 0x80040154 - Class not registered.

..1253 08:42:57 (0) ** WMI static instances retrieved:
............................................................. 0.
..1254 08:42:57 (0) ** WMI dynamic instances retrieved:
............................................................ 0.
..1255 08:42:57 (0) ** WMI instances request cancellations (to limit
performance impact): ......................... 0.

..1256 08:42:57 (0) **
..1257 08:42:57 (0) ** 5 error(s) 0x80040154 - (WBEM_UNKNOWN) This error
code is external to WMI.
..1258 08:42:57 (0) ** => This error is not a WMI error. This error is a
typical DCOM registration error.
..1259 08:42:57 (0) ** The registry information for DCOM to initialize
a DCOM object is missing or wrongly configured.
..1260 08:42:57 (0) ** => You can correct the DCOM configuration by:
..1261 08:42:57 (0) ** - Executing the 'Filename.EXE /RegServer' command.
..1262 08:42:57 (0) ** - Executing the 'REGSVR32.EXE <Provider.DLL>'
command.
..1263 08:42:57 (0) ** Note: You can build a list of classes in
relation with their WMI provider and MOF file with WMIDiag.
..1264 08:42:57 (0) ** (This list can be built on a similar and
working WMI Windows installation)
..1265 08:42:57 (0) ** The following command line must be used:
..1266 08:42:57 (0) ** e.g. 'WMIDiag CorrelateClassAndProvider'
..1267 08:42:57 (2) !! WARNING: Re-registering with REGSVR32.EXE all DLL
from 'C:\WINDOWS\SYSTEM32\WBEM\'
..1268 08:42:57 (0) ** may not solve the problem as the DLL
supporting the WMI class(es)
..1269 08:42:57 (0) ** can be located in a different folder.
..1270 08:42:57 (0) ** You must refer to the class name to
determine the software delivering the related DLL.
..1271 08:42:57 (0) ** - Re-installing the software.
 
J

J Lunis

OK, did that.
* cd /d %windir%\system32\wbem
* for %i in (*.dll) do RegSvr32 -s %i
* for %i in (*.exe) do %i /RegServer
On performing the 3rd line (/RegSvr32) I get a popup
'Windows Management Instrumentation Tester.' Correct or not, I hit the
CONNECT button. New popup - 'root\default' in the top box. 'Connection
Using' is 'IWBEMLocator.' I hit CONNECT again and get a popup
'Number 0x,080040154
Facility: Interface
Description:Class not registered' whcih I 'dismiss'
Now what?
 
J

J Lunis

And another thing.
When I run "for %i in (*.exe) do %i /RegServer"
I get "file '/regserver' not found."
 
J

J Lunis

And the following Application errors
-------
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Description:
Failed to load MOF
C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V1.1.4322\ASPNET.MOF while recovering
repository file.
---------------
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Description:
Failed to load MOF
C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET.MOF while
recovering repository file.
--------------------
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 64
Description:
The named section Global\Wmi Provider Sub System Counters, was created
with insufficient size, this could constitute a Denial of Service attack.
----------------
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 43
Description:
WMI ADAP failed to connect to namespace \\.\root\cimv2 with the
following error: 0x80040154
--------------------
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 60
Description:
WMI ADAP was unable to process the performance libraries: 0x80041001
-------------------
Event Type: Error
Event Source: PerfDisk
Event Category: None
Event ID: 2001
Description:
Unable to read the disk performance information from the system. Disk
performance counters must be enabled for at least one physical disk or
logical volume in order for these counters to appear. Disk performance
counters can be enabled by using the Hardware Device Manager property
pages. Status code returned is data DWORD 0.
----------------------
Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 64
Description:
The named section Global\Wmi Provider Sub System Counters, was created
with insufficient size, this could constitute a Denial of Service attack.
 
W

Wesley Vogel

What's that .NET crap running for?

Event Source: WinMgmt
Event ID: 4

http://www.microsoft.com/technet/su...&ProdVer=5.2&EvtID=4&EvtSrc=WinMgmt&LCID=1033

Event Source: WinMgmt
Event ID: 64
From a newsgroup post: "Right-click "My Computer" and choose "Manage" to
open the Computer Management tool. Click on "Services" in the list in the
left-hand pane and then select "Windows Management Instrumentation" from the
list in the right-hand pane. There are two entries for "Windows Management
Instrumentation". You need to select the main one, not the "Driver
Extensions" entry. With the correct Service highlighted, click on the "Stop"
link which will appear to halt the Service. With the Service halted, use "My
Computer" to locate the folders \Windows\System32\Wbern\Repository and
\Windows\System32\Wbern\Repository\FS. Delete all files in those folders.
Reboot to allow the service to be restarted and the necessary files
recreated".
http://www.eventid.net/display.asp?eventid=64&eventno=6486&source=WinMgmt&phase=1

Event Source: WinMgmt
Event ID: 43
http://www.microsoft.com/technet/su...ProdVer=5.0&EvtID=43&EvtSrc=WinMgmt&LCID=1033

WMI Event 43 Generated After Changing System Default Locale
http://support.microsoft.com/kb/268881

WinMgmt Error Message 43 in the Event Log in Simplified Chinese Windows 2000
http://support.microsoft.com/kb/259568

Event Source: WinMgmt
Event ID: 60
http://www.microsoft.com/technet/su...ProdVer=5.2&EvtID=60&EvtSrc=WinMgmt&LCID=1033

Code 0x80041001 means: WBEM_E_FAILED (The call failed.)

As per one user: "Fixed it myself by running sfc /scannow after using the
winmgmt /resyncperf -p processID and winmgmt /clearadap commands at command
prompt.". We had reports that this suggestion did not always fix the
problem.

From a newsgroup post: "To stop them go to Control Panel - Administrative
Tols - > Services. After you stop the WMI services put them also to Manual
startup - so that next time you restart your computer the services are not
run again. Consequences? If you don't know what WMI is then none."
http://www.eventid.net/display.asp?eventid=60&eventno=491&source=WinMgmt&phase=1

Event Source: PerfDisk
Event ID: 2001
http://www.eventid.net/display.asp?eventid=2001&eventno=730&source=Perfdisk&phase=1

No need to subscribe to EventID.Net...

M253251 is
Using Diskperf in Windows 2000
http://support.microsoft.com/kb/253251

M296187 is
Application Log Events Generated When You Start Performance Counter Query
http://support.microsoft.com/kb/296187

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top