There was an error 0x80041016 in creating the Antimalware Health State WMI instance.

Wednesday, July 18, 2012 3:11 PM

0

Looks like a WMI issue on that server http://msdn.microsoft.com/en-us/library/windows/desktop/aa394603(v=vs.85).aspx

Bechir Gharbi | My blog: @myITforum.com | Twitter: @Bechir_Gharbi | Linkedin: Bechir Gharbi | Time zone: GMT + 1

Thursday, July 19, 2012 2:17 AM

Moderator

0

Hi,

Thank you for the post.

In addition, repair WMI service with following command and then reboot your server.

net stop winmgmt /y
cd %windir%\system32\wbem
for /f %s in ('dir /b *.dll') do regsvr32 /s %s
wmiprvse /regserver
winmgmt /regserver
net start winmgmt
for /f %s in ('dir /s /b *.mof *.mfl') do mofcomp %s

If there are more inquiries on this issue, please feel free to let us know.

Regards

Rick Tan

TechNet Community Support

Friday, July 20, 2012 7:11 AM

0

Hi, Rick Tan,

I have run the commands and rebooted the server.

So far I have not seen the error, but I will monitor it and report back whether the error returns or not.

Thank you for your help!

Kind regards,

Carl-Marius

Monday, July 23, 2012 6:16 AM

0

Hi Rick Tan,

It has not solved the problem, the error still exists even after a WMI repair and server reboot.

Kind regards,

Carl-Marius

Monday, July 23, 2012 9:29 AM

Moderator

0

Hi Carl,

You have to use WmiDiag checkconsistency to check WMI repository healthy. If it's inconsistent, rebuild WMI repository. But it may result in the WMI based products not working.

http://blogs.technet.com/b/configmgrteam/archive/2009/05/08/wmi-troubleshooting-tips.aspx
http://blogs.technet.com/b/askperf/archive/2008/07/11/wmi-troubleshooting-the-repository-on-vista-server-2008.aspx
http://blogs.technet.com/b/askperf/archive/2009/04/13/wmi-rebuilding-the-wmi-repository.aspx

Regards

Rick Tan

TechNet Community Support

Monday, July 23, 2012 10:14 AM

0

Hi Rick Tan,

I have just run a wmidiag checkconsistency on the 2003 R2 Enterprise edition SP2 server, and it is consistent.

I have attached the report below.

Kind regards,

Carl-Marius

Edited by Carl-Marius Monday, July 23, 2012 10:17 AM

Monday, July 23, 2012 10:15 AM

0

71723 11:53:50 (0) ** WMIDiag v2.1 started on 23. juli 2012 at 11:43.
71724 11:53:50 (0) **
71725 11:53:50 (0) ** Copyright (c) Microsoft Corporation. All rights reserved - July 2007.
71726 11:53:50 (0) **
71727 11:53:50 (0) ** This script is not supported under any Microsoft standard support program or service.
71728 11:53:50 (0) ** The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
71729 11:53:50 (0) ** implied warranties including, without limitation, any implied warranties of merchantability
71730 11:53:50 (0) ** or of fitness for a particular purpose. The entire risk arising out of the use or performance
71731 11:53:50 (0) ** of the scripts and documentation remains with you. In no event shall Microsoft, its authors,
71732 11:53:50 (0) ** or anyone else involved in the creation, production, or delivery of the script be liable for
71733 11:53:50 (0) ** any damages whatsoever (including, without limitation, damages for loss of business profits,
71734 11:53:50 (0) ** business interruption, loss of business information, or other pecuniary loss) arising out of
71735 11:53:50 (0) ** the use of or inability to use the script or documentation, even if Microsoft has been advised
71736 11:53:50 (0) ** of the possibility of such damages.
71737 11:53:50 (0) **
71738 11:53:50 (0) **
71739 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
71740 11:53:50 (0) ** ----------------------------------------------------- WMI REPORT: BEGIN ----------------------------------------------------------
71741 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
71742 11:53:50 (0) **
71743 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
71744 11:53:50 (0) ** Windows Server 2003 - Service pack 2 - 32-bit (3790) - User 'SIL\AS' on computer 'A4'.
71745 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
71746 11:53:50 (0) ** INFO: Environment: .................................................................................................. 1 ITEM(S)!
71747 11:53:50 (0) ** INFO: => 46 possible incorrect shutdown(s) detected on:
71748 11:53:50 (0) **          - Shutdown on 05 July 2011 11:22:59 (GMT+2).
71749 11:53:50 (0) **          - Shutdown on 05 July 2011 11:23:26 (GMT+2).
71750 11:53:50 (0) **          - Shutdown on 05 July 2011 11:23:48 (GMT+2).
71751 11:53:50 (0) **          - Shutdown on 05 July 2011 11:24:51 (GMT+2).
71752 11:53:50 (0) **          - Shutdown on 04 September 2011 16:14:53 (GMT+2).
71753 11:53:50 (0) **          - Shutdown on 03 October 2011 08:15:51 (GMT+2).
71754 11:53:50 (0) **          - Shutdown on 05 October 2011 08:53:16 (GMT+2).
71755 11:53:50 (0) **          - Shutdown on 07 October 2011 09:56:39 (GMT+2).
71756 11:53:50 (0) **          - Shutdown on 02 November 2011 09:43:46 (GMT+1).
71757 11:53:50 (0) **          - Shutdown on 10 November 2011 08:04:34 (GMT+1).
71758 11:53:50 (0) **          - Shutdown on 02 December 2011 08:12:03 (GMT+1).
71759 11:53:50 (0) **          - Shutdown on 04 December 2011 13:30:56 (GMT+1).
71760 11:53:50 (0) **          - Shutdown on 05 December 2011 07:55:39 (GMT+1).
71761 11:53:50 (0) **          - Shutdown on 12 December 2011 08:29:01 (GMT+1).
71762 11:53:50 (0) **          - Shutdown on 02 January 2012 08:39:35 (GMT+1).
71763 11:53:50 (0) **          - Shutdown on 04 January 2012 07:50:13 (GMT+1).
71764 11:53:50 (0) **          - Shutdown on 02 February 2012 07:56:41 (GMT+1).
71765 11:53:50 (0) **          - Shutdown on 02 February 2012 13:39:16 (GMT+1).
71766 11:53:50 (0) **          - Shutdown on 03 February 2012 07:50:40 (GMT+1).
71767 11:53:50 (0) **          - Shutdown on 08 February 2012 08:12:27 (GMT+1).
71768 11:53:50 (0) **          - Shutdown on 14 February 2012 07:44:25 (GMT+1).
71769 11:53:50 (0) **          - Shutdown on 21 February 2012 07:14:46 (GMT+1).
71770 11:53:50 (0) **          - Shutdown on 23 February 2012 07:41:09 (GMT+1).
71771 11:53:50 (0) **          - Shutdown on 07 March 2012 08:00:44 (GMT+1).
71772 11:53:50 (0) **          - Shutdown on 07 March 2012 13:31:05 (GMT+1).
71773 11:53:50 (0) **          - Shutdown on 02 April 2012 07:51:05 (GMT+2).
71774 11:53:50 (0) **          - Shutdown on 02 April 2012 08:39:26 (GMT+2).
71775 11:53:50 (0) **          - Shutdown on 26 April 2012 07:53:46 (GMT+2).
71776 11:53:50 (0) **          - Shutdown on 18 June 2012 07:26:12 (GMT+2).
71777 11:53:50 (0) **          - Shutdown on 18 June 2012 07:58:53 (GMT+2).
71778 11:53:50 (0) **          - Shutdown on 19 June 2012 07:29:48 (GMT+2).
71779 11:53:50 (0) **          - Shutdown on 19 June 2012 07:56:34 (GMT+2).
71780 11:53:50 (0) **          - Shutdown on 01 July 2012 20:24:53 (GMT+2).
71781 11:53:50 (0) **          - Shutdown on 01 July 2012 20:38:53 (GMT+2).
71782 11:53:50 (0) **          - Shutdown on 01 July 2012 22:14:51 (GMT+2).
71783 11:53:50 (0) **          - Shutdown on 02 July 2012 07:01:36 (GMT+2).
71784 11:53:50 (0) **          - Shutdown on 02 July 2012 07:04:24 (GMT+2).
71785 11:53:50 (0) **          - Shutdown on 02 July 2012 07:22:54 (GMT+2).
71786 11:53:50 (0) **          - Shutdown on 02 July 2012 08:31:11 (GMT+2).
71787 11:53:50 (0) **          - Shutdown on 03 July 2012 08:17:43 (GMT+2).
71788 11:53:50 (0) **          - Shutdown on 03 July 2012 08:25:54 (GMT+2).
71789 11:53:50 (0) **          - Shutdown on 03 July 2012 08:27:33 (GMT+2).
71790 11:53:50 (0) **          - Shutdown on 03 July 2012 08:32:46 (GMT+2).
71791 11:53:50 (0) **          - Shutdown on 03 July 2012 08:38:00 (GMT+2).
71792 11:53:50 (0) **          - Shutdown on 03 July 2012 08:45:38 (GMT+2).
71793 11:53:50 (0) **          - Shutdown on 19 July 2012 09:48:03 (GMT+2).
71794 11:53:50 (0) **
71795 11:53:50 (0) ** System drive: ....................................................................................................... C: (Disk #0 Partition #0).
71796 11:53:50 (0) ** Drive type: ......................................................................................................... SCSI (VMware Virtual disk SCSI Disk Device).
71797 11:53:50 (0) ** There are no missing WMI system files: .............................................................................. OK.
71798 11:53:50 (0) ** There are no missing WMI repository files: .......................................................................... OK.
71799 11:53:50 (0) ** WMI repository state: ............................................................................................... CONSISTENT.
71800 11:53:50 (0) ** AFTER running WMIDiag:
71801 11:53:50 (0) ** The WMI repository has a size of: ................................................................................... 35 MB.
71802 11:53:50 (0) ** - Disk free space on 'C:': .......................................................................................... 28667 MB.
71803 11:53:50 (0) **   - INDEX.BTR,                     4661248 bytes,      23-07-2012 11:53:42
71804 11:53:50 (0) **   - MAPPING.VER,                   4 bytes,            23-07-2012 11:53:42
71805 11:53:50 (0) **   - MAPPING1.MAP,                  17868 bytes,        23-07-2012 11:53:42
71806 11:53:50 (0) **   - MAPPING2.MAP,                  17868 bytes,        23-07-2012 11:53:35
71807 11:53:50 (0) **   - OBJECTS.DATA,                  31752192 bytes,     23-07-2012 11:53:42
71808 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
71809 11:53:50 (2) !! WARNING: Windows Firewall Service: .................................................................................. STOPPED.
71810 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
71811 11:53:50 (0) ** DCOM Status: ........................................................................................................ OK.
71812 11:53:50 (0) ** WMI registry setup: ................................................................................................. OK.
71813 11:53:50 (0) ** INFO: WMI service has dependents: ................................................................................... 2 SERVICE(S)!
71814 11:53:50 (0) ** - Windows Firewall/Internet Connection Sharing (ICS) (SHAREDACCESS, StartMode='Disabled')
71815 11:53:50 (0) ** - SMS Agent Host (CCMEXEC, StartMode='Automatic')
71816 11:53:50 (0) ** => If the WMI service is stopped, the listed service(s) will have to be stopped as well.
71817 11:53:50 (0) **    Note: If the service is marked with (*), it means that the service/application uses WMI but
71818 11:53:50 (0) **          there is no hard dependency on WMI. However, if the WMI service is stopped,
71819 11:53:50 (0) **          this can prevent the service/application to work as expected.
71820 11:53:50 (0) **
71821 11:53:50 (0) ** RPCSS service: ...................................................................................................... OK (Already started).
71822 11:53:50 (0) ** WINMGMT service: .................................................................................................... OK (Already started).
71823 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
71824 11:53:50 (0) ** WMI service DCOM setup: ............................................................................................. OK.
71825 11:53:50 (0) ** WMI components DCOM registrations: .................................................................................. OK.
71826 11:53:50 (0) ** WMI ProgID registrations: ........................................................................................... OK.
71827 11:53:50 (2) !! WARNING: WMI provider DCOM registrations missing for the following provider(s): ..................................... 6 WARNING(S)!
71828 11:53:50 (0) ** - ROOT/THINPRINT, TPVCGProv ({2C6594DC-04AD-490F-A447-DC8E2772E9CB})
71829 11:53:50 (0) **   Provider DLL: ''
71830 11:53:50 (0) ** - ROOT/THINPRINT, TPAutoConnDLL ({2C6594DB-04AD-490F-A447-DC8E2772E9CB})
71831 11:53:50 (0) **   Provider DLL: ''
71832 11:53:50 (0) ** - ROOT/MICROSOFT/SECURITYCLIENTTESTWMI, TestProvider ({0B28E358-BE7A-428B-A544-D8534029A5B7})
71833 11:53:50 (0) **   Provider DLL: ''
71834 11:53:50 (0) ** - ROOT/MICROSOFT/POLICYPLATFORM/PROCESSOR, PolicyPlatform_PolicyProcessorProvider ({3AFEA1D5-6518-4BE3-B12D-ED3325DF0515})
71835 11:53:50 (0) **   Provider DLL: ''
71836 11:53:50 (0) ** - ROOT/MICROSOFT/POLICYPLATFORM/DOCUMENTS, PolicyPlatform_DocumentStore ({12F246F3-DF68-4252-AE6B-07B9CF73B99A}) (i.e. WMI Class 'PolicyPlatform_Document')
71837 11:53:50 (0) **   Provider DLL: ''
71838 11:53:50 (0) ** - ROOT/MICROSOFT/POLICYPLATFORM/DOCUMENTS/LOCAL, PolicyPlatform_LocalStore ({12F246F3-DF68-4252-AE6B-07B9CF73B99A}) (i.e. WMI Class 'PolicyPlatform_PrincipalDocumentBinding')
71839 11:53:50 (0) **   Provider DLL: ''
71840 11:53:50 (0) ** => This is an issue because there are still some WMI classes referencing this list of providers
71841 11:53:50 (0) **    while the DCOM registration is wrong or missing. This can be due to:
71842 11:53:50 (0) **    - a de-installation of the software.
71843 11:53:50 (0) **    - a deletion of some registry key data.
71844 11:53:50 (0) **    - a registry corruption.
71845 11:53:50 (0) ** => You can correct the DCOM configuration by:
71846 11:53:50 (0) **    - Executing the 'REGSVR32.EXE <Provider.DLL>' command.
71847 11:53:50 (0) **    Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.
71848 11:53:50 (0) **          (This list can be built on a similar and working WMI Windows installation)
71849 11:53:50 (0) **          The following command line must be used:
71850 11:53:50 (0) **          i.e. 'WMIDiag CorrelateClassAndProvider'
71851 11:53:50 (2) !! WARNING: Re-registering with REGSVR32.EXE all DLL from 'C:\WINDOWS\SYSTEM32\WBEM\'
71852 11:53:50 (0) **          may not solve the problem as the DLL supporting the WMI class(es)
71853 11:53:50 (0) **          can be located in a different folder.
71854 11:53:50 (0) **          You must refer to the class name to determine the software delivering the related DLL.
71855 11:53:50 (0) ** => If the software has been de-installed intentionally, then this information must be
71856 11:53:50 (0) **    removed from the WMI repository. You can use the 'WMIC.EXE' command to remove
71857 11:53:50 (0) **    the provider registration data.
71858 11:53:50 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\MICROSOFT\POLICYPLATFORM\DOCUMENTS\LOCAL path __Win32Provider Where Name='PolicyPlatform_LocalStore' DELETE'
71859 11:53:50 (0) ** => If the namespace was ENTIRELY dedicated to the intentionally de-installed software,
71860 11:53:50 (0) **    the namespace and ALL its content can be ENTIRELY deleted.
71861 11:53:50 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\MICROSOFT\POLICYPLATFORM\DOCUMENTS path __NAMESPACE Where Name='LOCAL' DELETE'
71862 11:53:50 (0) **    - Re-installing the software.
71863 11:53:50 (0) **
71864 11:53:50 (0) ** WMI provider CIM registrations: ..................................................................................... OK.
71865 11:53:50 (0) ** WMI provider CLSIDs: ................................................................................................ OK.
71866 11:53:50 (0) ** WMI providers EXE/DLL availability: ................................................................................. OK.
71867 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
71868 11:53:50 (0) ** Overall DCOM security status: ....................................................................................... OK.
71869 11:53:50 (0) ** Overall WMI security status: ........................................................................................ OK.
71870 11:53:50 (0) ** - Started at 'Root' --------------------------------------------------------------------------------------------------------------
71871 11:53:50 (0) ** INFO: WMI permanent SUBSCRIPTION(S): ................................................................................ 58.
71872 11:53:50 (0) ** - ROOT/CCM/POLICY, CCM_PolicyReplicationConsumer.Id="{9099D177-1AD6-46e6-BBC0-70F460786953}".
71873 11:53:50 (0) **   'SELECT * FROM __ClassOperationEvent WHERE TargetClass ISA "CCM_Policy_Config"'
71874 11:53:50 (0) ** - ROOT/CCM/POLICY, CCM_PolicyReplicationConsumer.Id="{9099D177-1AD6-46e6-BBC0-70F460786953}".
71875 11:53:50 (0) **   'SELECT * FROM __NamespaceCreationEvent'
71876 11:53:50 (0) ** - ROOT/CCM/POLICY, CCM_PolicyReplicationConsumer.Id="{9099D177-1AD6-46e6-BBC0-70F460786953}".
71877 11:53:50 (0) **   'SELECT * FROM __ClassOperationEvent WHERE TargetClass ISA "CCM_Policy"'
71878 11:53:50 (0) ** - ROOT/CCM/POLICY, CCM_PolicyReplicationConsumer.Id="{9099D177-1AD6-46e6-BBC0-70F460786953}".
71879 11:53:50 (0) **   'SELECT * FROM __ClassOperationEvent WHERE TargetClass ISA "CCM_Policy_EmbeddedObject"'
71880 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA44".
71881 11:53:50 (0) **   'select * from MSMCAEvent_InvalidError where (type = 2147811432) and (LogToEventlog <> 0)'
71882 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA23".
71883 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553235) and (LogToEventlog <> 0)'
71884 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA32".
71885 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811420) and (LogToEventlog <> 0)'
71886 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA14".
71887 11:53:50 (0) **   'select * from MSMCAEvent_MemoryError where (type = 2147811402) and (LogToEventlog <> 0)'
71888 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA37".
71889 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553249) and (LogToEventlog <> 0)'
71890 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="SCM Event Log Consumer".
71891 11:53:50 (0) **   'select * from MSFT_SCMEventLogEvent'
71892 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA5".
71893 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553217) and (LogToEventlog <> 0)'
71894 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA18".
71895 11:53:50 (0) **   'select * from MSMCAEvent_SystemEventError where (type = 2147811406) and (LogToEventlog <> 0)'
71896 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA3".
71897 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553215) and (LogToEventlog <> 0)'
71898 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA41".
71899 11:53:50 (0) **   'select * from MSMCAEvent_SMBIOSError where (type = 3221553253) and (LogToEventlog <> 0)'
71900 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA26".
71901 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811414) and (LogToEventlog <> 0)'
71902 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA36".
71903 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811424) and (LogToEventlog <> 0)'
71904 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA9".
71905 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553221) and (LogToEventlog <> 0) and not ((MSSid = 0) and ((MsOp <> 3) or (MSOp <> 4)))'
71906 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA10".
71907 11:53:50 (0) **   'select * from MSMCAEvent_MemoryError where (type = 2147811398) and (LogToEventlog <> 0)'
71908 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA17".
71909 11:53:50 (0) **   'select * from MSMCAEvent_MemoryError where (type = 3221553229) and (LogToEventlog <> 0)'
71910 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA1".
71911 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553213) and (LogToEventlog <> 0)'
71912 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA42".
71913 11:53:50 (0) **   'select * from MSMCAEvent_PlatformSpecificError where (type = 2147811430) and (LogToEventlog <> 0)'
71914 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA4".
71915 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811392) and (LogToEventlog <> 0)'
71916 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA25".
71917 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553237) and (LogToEventlog <> 0)'
71918 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA49".
71919 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (MajorErrorType = 4) and (MSSid = 0) and (MSOp = 4) and (LogToEventlog <> 0)'
71920 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA27".
71921 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553239) and (LogToEventlog <> 0)'
71922 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA45".
71923 11:53:50 (0) **   'select * from MSMCAEvent_InvalidError where (type = 3221553257) and (LogToEventlog <> 0)'
71924 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA8".
71925 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811396) and (LogToEventlog <> 0) and not ((MSSid = 0) and ((MsOp <> 3) or (MSOp <> 4)))'
71926 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA40".
71927 11:53:50 (0) **   'select * from MSMCAEvent_SMBIOSError where (type = 2147811428) and (LogToEventlog <> 0)'
71928 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA39".
71929 11:53:50 (0) **   'select * from MSMCAEvent_PCIComponentError where (type = 3221553251) and (LogToEventlog <> 0)'
71930 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA29".
71931 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553241) and (LogToEventlog <> 0)'
71932 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA20".
71933 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811408) and (LogToEventlog <> 0)'
71934 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA48".
71935 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (MajorErrorType = 4) and (MSSid = 0) and (MSOp = 3) and (LogToEventlog <> 0)'
71936 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA28".
71937 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811416) and (LogToEventlog <> 0)'
71938 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA33".
71939 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553245) and (LogToEventlog <> 0)'
71940 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA7".
71941 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553219) and (LogToEventlog <> 0)'
71942 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA16".
71943 11:53:50 (0) **   'select * from MSMCAEvent_MemoryError where (type = 2147811404) and (LogToEventlog <> 0)'
71944 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA43".
71945 11:53:50 (0) **   'select * from MSMCAEvent_PlatformSpecificError where (type = 3221553255) and (LogToEventlog <> 0)'
71946 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA21".
71947 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553233) and (LogToEventlog <> 0)'
71948 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA6".
71949 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811394) and (LogToEventlog <> 0)'
71950 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA31".
71951 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553243) and (LogToEventlog <> 0)'
71952 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA12".
71953 11:53:50 (0) **   'select * from MSMCAEvent_MemoryError where (type = 2147811400) and (LogToEventlog <> 0)'
71954 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA46".
71955 11:53:50 (0) **   'select * from MSMCAEvent_InvalidError where (type = 2147811434) and (LogToEventlog <> 0)'
71956 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA47".
71957 11:53:50 (0) **   'select * from MSMCAEvent_InvalidError where (type = 3221553259) and (LogToEventlog <> 0)'
71958 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA35".
71959 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553247) and (LogToEventlog <> 0)'
71960 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA0".
71961 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811388) and (LogToEventlog <> 0)'
71962 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA19".
71963 11:53:50 (0) **   'select * from MSMCAEvent_SystemEventError where (type = 3221553231) and (LogToEventlog <> 0)'
71964 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA11".
71965 11:53:50 (0) **   'select * from MSMCAEvent_MemoryError where (type = 3221553223) and (LogToEventlog <> 0)'
71966 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA52".
71967 11:53:50 (0) **   'select * from MSMCAEvent_MemoryPageRemoved'
71968 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA30".
71969 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811418) and (LogToEventlog <> 0)'
71970 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA15".
71971 11:53:50 (0) **   'select * from MSMCAEvent_MemoryError where (type = 3221553227) and (LogToEventlog <> 0)'
71972 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA38".
71973 11:53:50 (0) **   'select * from MSMCAEvent_PCIComponentError where (type = 2147811426) and (LogToEventlog <> 0)'
71974 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA34".
71975 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811422) and (LogToEventlog <> 0)'
71976 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA2".
71977 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811390) and (LogToEventlog <> 0)'
71978 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA22".
71979 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811410) and (LogToEventlog <> 0)'
71980 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA13".
71981 11:53:50 (0) **   'select * from MSMCAEvent_MemoryError where (type = 3221553225) and (LogToEventlog <> 0)'
71982 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA50".
71983 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811441) and (LogToEventlog <> 0)'
71984 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA51".
71985 11:53:50 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553266) and (LogToEventlog <> 0)'
71986 11:53:50 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA24".
71987 11:53:50 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811412) and (LogToEventlog <> 0)'
71988 11:53:50 (0) **
71989 11:53:50 (0) ** WMI TIMER instruction(s): ........................................................................................... NONE.
71990 11:53:50 (0) ** WMI ADAP status: .................................................................................................... OK.
71991 11:53:50 (0) ** INFO: WMI namespace(s) requiring PACKET PRIVACY: .................................................................... 1 NAMESPACE(S)!
71992 11:53:50 (0) ** - ROOT/SERVICEMODEL.
71993 11:53:50 (0) ** => When remotely connecting, the namespace(s) listed require(s) the WMI client to
71994 11:53:50 (0) **    use an encrypted connection by specifying the PACKET PRIVACY authentication level.
71995 11:53:50 (0) **    (RPC_C_AUTHN_LEVEL_PKT_PRIVACY or PktPrivacy flags)
71996 11:53:50 (0) **    i.e. 'WMIC.EXE /NODE:"A4" /AUTHLEVEL:Pktprivacy /NAMESPACE:\\ROOT\SERVICEMODEL Class __SystemSecurity'
71997 11:53:50 (0) **
71998 11:53:50 (0) ** WMI MONIKER CONNECTIONS: ............................................................................................ OK.
71999 11:53:50 (0) ** WMI CONNECTIONS: .................................................................................................... OK.
72000 11:53:50 (1) !! ERROR: WMI GET operation errors reported: ........................................................................... 6 ERROR(S)!
72001 11:53:50 (0) ** - root/ccm/ContentTransferManager, CCM_CTM_JobStateEx, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
72002 11:53:50 (0) **   MOF Registration: ''
72003 11:53:50 (0) ** - root/ccm/DataTransferService, CCM_DTS_JobItem, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
72004 11:53:50 (0) **   MOF Registration: ''
72005 11:53:50 (0) ** - root/ccm/events, SoftDistDownloadStartedEvent, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
72006 11:53:50 (0) **   MOF Registration: ''
72007 11:53:50 (0) ** - root/ccm/events, SoftDistDownloadCompletedEvent, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
72008 11:53:50 (0) **   MOF Registration: ''
72009 11:53:50 (0) ** - root/ccm/events, SoftDistDownloadCancelledEvent, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
72010 11:53:50 (0) **   MOF Registration: ''
72011 11:53:50 (0) ** - root/ccm/Policy, CCM_InventoryClientConfig, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
72012 11:53:50 (0) **   MOF Registration: ''
72013 11:53:50 (0) **
72014 11:53:50 (0) ** WMI MOF representations: ............................................................................................ OK.
72015 11:53:50 (0) ** WMI QUALIFIER access operations: .................................................................................... OK.
72016 11:53:50 (0) ** WMI ENUMERATION operations: ......................................................................................... OK.
72017 11:53:50 (1) !! ERROR: WMI EXECQUERY operation errors reported: ..................................................................... 12 ERROR(S)!
72018 11:53:50 (0) ** - Root/CIMv2, 'Select * From Win32_USBController' did not return any instance while AT LEAST 1 instance is expected.
72019 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Service_EndpointConfiguration WHERE Name = "UploadProtocol" AND CoClass = "{0DE0ED98-C389-4292-BB71-391CDE6BA69D}"' did not return any instance while AT LEAST 1 instance is expected.
72020 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "PatchUIMonitor"' did not return any instance while AT LEAST 1 instance is expected.
72021 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "PatchUIMonitorLogoff"' did not return any instance while AT LEAST 1 instance is expected.
72022 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "PatchUIMonitorLogon"' did not return any instance while AT LEAST 1 instance is expected.
72023 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "PatchUIMonitorStartup"' did not return any instance while AT LEAST 1 instance is expected.
72024 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "PolicyEvaluator_Startup"' did not return any instance while AT LEAST 1 instance is expected.
72025 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "RemoteToolsStartup"' did not return any instance while AT LEAST 1 instance is expected.
72026 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "SrcUpdateLogoff"' did not return any instance while AT LEAST 1 instance is expected.
72027 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "UploadProtocol"' did not return any instance while AT LEAST 1 instance is expected.
72028 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Service_SystemTaskConfiguration WHERE Name = "PolicyEvaluator_Startup" AND CoClass = "{F13946FA-8641-4B12-8BC0-2868D45D62FF}"' did not return any instance while AT LEAST 1 instance is expected.
72029 11:53:50 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Service_SystemTaskConfiguration WHERE Name = "SrcUpdateLogoff" AND CoClass = "{84CC61B8-9EA7-4EE2-B839-D7F1852A3688}"' did not return any instance while AT LEAST 1 instance is expected.
72030 11:53:50 (0) **
72031 11:53:50 (0) ** WMI GET VALUE operations: ........................................................................................... OK.
72032 11:53:50 (0) ** WMI WRITE operations: ............................................................................................... NOT TESTED.
72033 11:53:50 (0) ** WMI PUT operations: ................................................................................................. NOT TESTED.
72034 11:53:50 (0) ** WMI DELETE operations: .............................................................................................. NOT TESTED.
72035 11:53:50 (0) ** WMI static instances retrieved: ..................................................................................... 6310.
72036 11:53:50 (0) ** WMI dynamic instances retrieved: .................................................................................... 0.
72037 11:53:50 (0) ** WMI instance request cancellations (to limit performance impact): ................................................... 1.
72038 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
72039 11:53:50 (0) ** # of Event Log events BEFORE WMIDiag execution since the last 20 day(s):
72040 11:53:50 (0) **   DCOM: ............................................................................................................. 2.
72041 11:53:50 (0) **   WINMGMT: .......................................................................................................... 139.
72042 11:53:50 (0) **   WMIADAPTER: ....................................................................................................... 0.
72043 11:53:50 (0) ** => Verify the WMIDiag LOG at line #70268 for more details.
72044 11:53:50 (0) **
72045 11:53:50 (0) ** # of additional Event Log events AFTER WMIDiag execution:
72046 11:53:50 (0) **   DCOM: ............................................................................................................. 0.
72047 11:53:50 (0) **   WINMGMT: .......................................................................................................... 0.
72048 11:53:50 (0) **   WMIADAPTER: ....................................................................................................... 0.
72049 11:53:50 (0) **
72050 11:53:50 (0) ** 6 error(s) 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found
72051 11:53:50 (0) ** => This error is typically a WMI error. This WMI error is due to:
72052 11:53:50 (0) **    - a missing WMI class definition or object.
72053 11:53:50 (0) **      (See any GET, ENUMERATION, EXECQUERY and GET VALUE operation failures).
72054 11:53:50 (0) **      You can correct the missing class definitions by:
72055 11:53:50 (0) **      - Manually recompiling the MOF file(s) with the 'MOFCOMP <FileName.MOF>' command.
72056 11:53:50 (0) **      Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.
72057 11:53:50 (0) **            (This list can be built on a similar and working WMI Windows installation)
72058 11:53:50 (0) **            The following command line must be used:
72059 11:53:50 (0) **            i.e. 'WMIDiag CorrelateClassAndProvider'
72060 11:53:50 (0) **    - a WMI repository corruption.
72061 11:53:50 (0) **      Under Windows XP 64-bit SP1, Windows 2003 SP1 and Windows Vista, the
72062 11:53:50 (0) **      repository consistency is ALWAYS verified.
72063 11:53:50 (0) **      Under Windows XP SP2, the repository consistency must be explicitly requested:
72064 11:53:50 (0) **      i.e. 'WMIDiag CheckConsistency''
72065 11:53:50 (0) **      Check the state of the repository above in the WMIDiag report.
72066 11:53:50 (0) **      If the repository is inconsistent, it must be reconstructed.
72067 11:53:50 (0) **    Note: The WMI repository reconstruction requires to locate all MOF files needed to rebuild the repository,
72068 11:53:50 (0) **          otherwise some applications may fail after the reconstruction.
72069 11:53:50 (0) **          This can be achieved with the following command:
72070 11:53:50 (0) **          i.e. 'WMIDiag ShowMOFErrors'
72071 11:53:50 (0) **    Note: The repository reconstruction must be a LAST RESORT solution and ONLY after executing
72072 11:53:50 (0) **          ALL fixes previously mentioned.
72073 11:53:50 (2) !! WARNING: Static information stored by external applications in the repository will be LOST! (i.e. SMS Inventory)
72074 11:53:50 (0) **
72075 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
72076 11:53:50 (0) ** WMI Registry key setup: ............................................................................................. OK.
72077 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
72078 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
72079 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
72080 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
72081 11:53:50 (0) **
72082 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
72083 11:53:50 (0) ** ------------------------------------------------------ WMI REPORT: END -----------------------------------------------------------
72084 11:53:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
72085 11:53:50 (0) **
72086 11:53:50 (0) ** ERROR: WMIDiag detected issues that could prevent WMI to work properly!. Check 'C:\DOCUMENTS AND SETTINGS\AS\LOCAL SETTINGS\TEMP\WMIDIAG-V2.1_2003_.SRV.SP2.32_A4_2012.07.23_11.43.30.LOG' for details.
72087 11:53:50 (0) **
72088 11:53:50 (0) ** WMIDiag v2.1 ended on 23. juli 2012 at 11:53 (W:194 E:82 S:1).

Tuesday, July 24, 2012 2:38 AM

Moderator

0

Hi,

Please try to uninstall FEP and SCCM 2007 client agent (ccmsetup.exe /uninstall). Ensure no ccmsetup.exe in task manager and no Root/CCM in wmimgmt.msc console--properties--Security. Then reinstall SCCM 2007 agent and FEP 2010.

http://technet.microsoft.com/en-us/library/bb694276.aspx

Regards

Rick Tan

TechNet Community Support

Tuesday, July 24, 2012 8:26 AM

0

Hi Rick Tan,

I have just uninstalled the FEP and SCCM 2007 client and I have done this successfully.

I will reboot the server tonight and make a reinstall tomorrow.

I will keep you posted.

Kind regards,

Carl-Marius

Friday, July 27, 2012 8:47 AM

0

Hi Rich Tan,

I have not got the error after the server reboot, so I have my fingers crossed for that the error has been solved. :-)

If the error has not return in the next week, I will close this case and mark your post as answer.

Thank you for your help!

Kind regards,

Carl-Marius

Wednesday, August 01, 2012 7:34 AM

0

Hi Rich Tan,

The error still occurs in the eventlog on the server :-(

Do you have any further suggestions?

Kind regards,

Carl-Marius

Friday, August 03, 2012 2:14 AM

Moderator

0

Hi Carl,

Oh, I would like to suggest you contact Microsoft Customer Support Service (CSS) to troubleshoot this issue.
http://support.microsoft.com/kb/295539

Regards

Rick Tan

TechNet Community Support

Marked As Answer by Carl-Marius Friday, August 03, 2012 6:22 AM

Friday, August 03, 2012 6:22 AM

0

Hi Rick Tan,

I will do that!

Thank you for trying to solve my problem! :-D

Kind regards,

Carl-Marius

Thursday, October 25, 2012 10:15 AM

0

Did you ever get an answer to this problem (experiencing the exact same symptoms with 2008R2 + CCMClient 2012 + FEP 2010)

Monday, October 29, 2012 12:32 PM

0

Hi Johan F,

No, I have not found the solution to this problem and I am still having this issue on the server.

My next try is to contact Microsoft Customer Support Service (CSS), but I have not done this yet.

Kind regards,

Carl-Marius

There was an error 0x80041016 in creating the Antimalware Health State WMI instance.

All Replies

Products

Resources

Solutions

Updates

Trials

Related Sites

Training

Certifications

Other resources

Support by product

Other support links

Not an IT pro?