none
Major WMI repository problems - workstations slowing to a crawl RRS feed

  • Question

  • We're having a ton of problems with extremely slow workstations and all appears to be the result of SCCM 2012.  We first noticed this because the c:\windows\system32\wbem\repository folder will have a corrupted.rec file that is over a gig and a half in size, also the object.data will be just as big.  We have hundreds of workstations that are running incredibly slow.  If we reset the repository or salvage the repository the problem just comes back.  Need help!  I apologize for the extra large log file

    WARNING: WMI provider DCOM registrations missing for the following provider(s): ..................................... 3 WARNING(S)!
    71462 11:16:54 (0) ** - ROOT/MICROSOFT/POLICYPLATFORM/PROCESSOR, PolicyPlatform_PolicyProcessorProvider ({3AFEA1D5-6518-4BE3-B12D-ED3325DF0515})
    71463 11:16:54 (0) **   Provider DLL: ''
    71464 11:16:54 (0) ** - ROOT/MICROSOFT/POLICYPLATFORM/DOCUMENTS, PolicyPlatform_DocumentStore ({12F246F3-DF68-4252-AE6B-07B9CF73B99A})
    71465 11:16:54 (0) **   Provider DLL: ''
    71466 11:16:54 (0) ** - ROOT/MICROSOFT/POLICYPLATFORM/DOCUMENTS/LOCAL, PolicyPlatform_LocalStore ({12F246F3-DF68-4252-AE6B-07B9CF73B99A}) (i.e. WMI Class 'PolicyPlatform_Document')
    71467 11:16:54 (0) **   Provider DLL: ''
    71468 11:16:54 (0) ** => This is an issue because there are still some WMI classes referencing this list of providers
    71469 11:16:54 (0) **    while the DCOM registration is wrong or missing. This can be due to:
    71470 11:16:54 (0) **    - a de-installation of the software.
    71471 11:16:54 (0) **    - a deletion of some registry key data.
    71472 11:16:54 (0) **    - a registry corruption.
    71473 11:16:54 (0) ** => You can correct the DCOM configuration by:
    71474 11:16:54 (0) **    - Executing the 'REGSVR32.EXE <Provider.DLL>' command.
    71475 11:16:54 (0) **    Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.
    71476 11:16:54 (0) **          (This list can be built on a similar and working WMI Windows installation)
    71477 11:16:54 (0) **          The following command line must be used:
    71478 11:16:54 (0) **          i.e. 'WMIDiag CorrelateClassAndProvider'
    71479 11:16:54 (2) !! WARNING: Re-registering with REGSVR32.EXE all DLL from 'C:\WINDOWS\SYSTEM32\WBEM\'
    71480 11:16:54 (0) **          may not solve the problem as the DLL supporting the WMI class(es)
    71481 11:16:54 (0) **          can be located in a different folder.
    71482 11:16:54 (0) **          You must refer to the class name to determine the software delivering the related DLL.
    71483 11:16:54 (0) ** => If the software has been de-installed intentionally, then this information must be
    71484 11:16:54 (0) **    removed from the WMI repository. You can use the 'WMIC.EXE' command to remove
    71485 11:16:54 (0) **    the provider registration data.
    71486 11:16:54 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\MICROSOFT\POLICYPLATFORM\DOCUMENTS\LOCAL path __Win32Provider Where Name='PolicyPlatform_LocalStore' DELETE'
    71487 11:16:54 (0) ** => If the namespace was ENTIRELY dedicated to the intentionally de-installed software,
    71488 11:16:54 (0) **    the namespace and ALL its content can be ENTIRELY deleted.
    71489 11:16:54 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\MICROSOFT\POLICYPLATFORM\DOCUMENTS path __NAMESPACE Where Name='LOCAL' DELETE'
    71490 11:16:54 (0) **    - Re-installing the software.
    71491 11:16:54 (0) **
    71492 11:16:54 (2) !! WARNING: WMI provider CIM registrations missing for the following provider(s): ...................................... 1 WARNING(S)!
    71493 11:16:54 (0) ** - ROOT/CIMV2/SMS, Microsoft.ConfigurationManager.AssetProvider Version=5.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35 (i.e. WMI Class 'SMS_SoftwareTag')
    71494 11:16:54 (0) **   MOF Registration: ''
    71495 11:16:54 (0) ** => This is an issue because there are still some WMI classes referencing this list of providers
    71496 11:16:54 (0) **    while the CIM registration is wrong or missing. This can be due to:
    71497 11:16:54 (0) **    - a de-installation of the software.
    71498 11:16:54 (0) **    - a deletion of some CIM registration information.
    71499 11:16:54 (0) ** => You can correct the CIM configuration by:
    71500 11:16:54 (0) **    - Manually recompiling the MOF file(s) with the 'MOFCOMP <FileName.MOF>' command.
    71501 11:16:54 (0) **    Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.
    71502 11:16:54 (0) **          (This list can be built on a similar and working WMI Windows installation)
    71503 11:16:54 (0) **          The following command line must be used:
    71504 11:16:54 (0) **          i.e. 'WMIDiag CorrelateClassAndProvider'
    71505 11:16:54 (0) **    - Re-installing the software.
    71506 11:16:54 (0) ** => If the software has been de-installed intentionally, then this information must be
    71507 11:16:54 (0) **    removed from the WMI repository. You can use the 'WMIC.EXE' command to remove the provider
    71508 11:16:54 (0) **    registration data and its set of associated classes.
    71509 11:16:54 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\CIMV2\SMS path __Win32Provider Where Name='Microsoft.ConfigurationManager.AssetProvider Version=5.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35' DELETE'
    71510 11:16:54 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\CIMV2\SMS Class SMS_SoftwareTag DELETE'
    71511 11:16:54 (0) ** => If the namespace was ENTIRELY dedicated to the intentionally de-installed software,
    71512 11:16:54 (0) **    the namespace and ALL its content can be ENTIRELY deleted.
    71513 11:16:54 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\CIMV2 path __NAMESPACE Where Name='SMS' DELETE'
    71514 11:16:54 (0) **
    71515 11:16:54 (0) ** WMI provider CLSIDs: ................................................................................................ OK.
    71516 11:16:54 (2) !! WARNING: Some WMI providers EXE/DLL file(s) are missing: ............................................................ 1 WARNING(S)!
    71517 11:16:54 (0) ** - ROOT/CIMV2/SMS, Microsoft.ConfigurationManager.AssetProvider Version=5.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35, mscoree.dll
    71518 11:16:54 (0) ** => This will make any operations related to the WMI class supported by the provider(s) to fail.
    71519 11:16:54 (0) **    This can be due to:
    71520 11:16:54 (0) **    - the de-installation of the software.
    71521 11:16:54 (0) **    - the deletion of some files.
    71522 11:16:54 (0) ** => If the software has been de-installed intentionally, then this information must be
    71523 11:16:54 (0) **    removed from the WMI repository. You can use the 'WMIC.EXE' command to remove
    71524 11:16:54 (0) **    the provider registration data.
    71525 11:16:54 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\CIMV2\SMS path __Win32Provider Where Name='Microsoft.ConfigurationManager.AssetProvider Version=5.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35' DELETE'
    71526 11:16:54 (0) ** => If not, you must restore a copy of the missing provider EXE/DLL file(s) as indicated by the path.
    71527 11:16:54 (0) **    You can retrieve the missing file from:
    71528 11:16:54 (0) **    - A backup.
    71529 11:16:54 (0) **    - The Windows CD.
    71530 11:16:54 (0) **    - Another Windows installation using the same version and service pack level of the examined system.
    71531 11:16:54 (0) **    - The original CD or software package installing this WMI provider.
    71532 11:16:54 (0) **
    71533 11:16:54 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    71534 11:16:54 (0) ** INFO: User Account Control (UAC): ................................................................................... ENABLED.
    71535 11:16:54 (0) ** => WMI tasks requiring Administrative privileges on this computer MUST run in an elevated context.
    71536 11:16:54 (0) **    i.e. You can start your scripts or WMIC commands from an elevated command
    71537 11:16:54 (0) **         prompt by right clicking on the 'Command Prompt' icon in the Start Menu and
    71538 11:16:54 (0) **         selecting 'Run as Administrator'.
    71539 11:16:54 (0) **    i.e. You can also execute the WMI scripts or WMIC commands as a task
    71540 11:16:54 (0) **         in the Task Scheduler within the right security context.
    71541 11:16:54 (0) **
    71542 11:16:54 (0) ** INFO: Local Account Filtering: ...................................................................................... ENABLED.
    71543 11:16:54 (0) ** => WMI tasks remotely accessing WMI information on this computer and requiring Administrative
    71544 11:16:54 (0) **    privileges MUST use a DOMAIN account part of the Local Administrators group of this computer
    71545 11:16:54 (0) **    to ensure that administrative privileges are granted. If a Local User account is used for remote
    71546 11:16:54 (0) **    accesses, it will be reduced to a plain user (filtered token), even if it is part of the Local Administrators group.
    71547 11:16:54 (0) **
    71548 11:16:54 (0) ** Overall DCOM security status: ....................................................................................... OK.
    71549 11:16:54 (0) ** Overall WMI security status: ........................................................................................ OK.
    71550 11:16:54 (0) ** - Started at 'Root' --------------------------------------------------------------------------------------------------------------
    71551 11:16:54 (0) ** INFO: WMI permanent SUBSCRIPTION(S): ................................................................................ 6.
    71552 11:16:54 (0) ** - ROOT/SUBSCRIPTION, CommandLineEventConsumer.Name="BVTConsumer".
    71553 11:16:54 (0) **   'SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99'
    71554 11:16:54 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="SCM Event Log Consumer".
    71555 11:16:54 (0) **   'select * from MSFT_SCMEventLogEvent'
    71556 11:16:54 (0) ** - ROOT/CCM/POLICY, CCM_PolicyReplicationConsumer.Id="{9099D177-1AD6-46e6-BBC0-70F460786953}".
    71557 11:16:54 (0) **   'SELECT * FROM __NamespaceCreationEvent'
    71558 11:16:54 (0) ** - ROOT/CCM/POLICY, CCM_PolicyReplicationConsumer.Id="{9099D177-1AD6-46e6-BBC0-70F460786953}".
    71559 11:16:54 (0) **   'SELECT * FROM __ClassOperationEvent WHERE TargetClass ISA "CCM_Policy_EmbeddedObject"'
    71560 11:16:54 (0) ** - ROOT/CCM/POLICY, CCM_PolicyReplicationConsumer.Id="{9099D177-1AD6-46e6-BBC0-70F460786953}".
    71561 11:16:54 (0) **   'SELECT * FROM __ClassOperationEvent WHERE TargetClass ISA "CCM_Policy_Config"'
    71562 11:16:54 (0) ** - ROOT/CCM/POLICY, CCM_PolicyReplicationConsumer.Id="{9099D177-1AD6-46e6-BBC0-70F460786953}".
    71563 11:16:54 (0) **   'SELECT * FROM __ClassOperationEvent WHERE TargetClass ISA "CCM_Policy"'
    71564 11:16:54 (0) **
    71565 11:16:54 (0) ** WMI TIMER instruction(s): ........................................................................................... NONE.
    71566 11:16:54 (0) ** INFO: WMI namespace(s) requiring PACKET PRIVACY: .................................................................... 4 NAMESPACE(S)!
    71567 11:16:54 (0) ** - ROOT/CIMV2/SECURITY/MICROSOFTTPM.
    71568 11:16:54 (0) ** - ROOT/CIMV2/SECURITY/MICROSOFTVOLUMEENCRYPTION.
    71569 11:16:54 (0) ** - ROOT/CIMV2/TERMINALSERVICES.
    71570 11:16:54 (0) ** - ROOT/SERVICEMODEL.
    71571 11:16:54 (0) ** => When remotely connecting, the namespace(s) listed require(s) the WMI client to
    71572 11:16:54 (0) **    use an encrypted connection by specifying the PACKET PRIVACY authentication level.
    71573 11:16:54 (0) **    (RPC_C_AUTHN_LEVEL_PKT_PRIVACY or PktPrivacy flags)
    71574 11:16:54 (0) **    i.e. 'WMIC.EXE /NODE:"AHC-D8934XV1" /AUTHLEVEL:Pktprivacy /NAMESPACE:\\ROOT\SERVICEMODEL Class __SystemSecurity'
    71575 11:16:54 (0) **
    71576 11:16:54 (0) ** WMI MONIKER CONNECTIONS: ............................................................................................ OK.
    71577 11:16:54 (0) ** WMI CONNECTIONS: .................................................................................................... OK.
    71578 11:16:54 (1) !! ERROR: WMI GET operation errors reported: ........................................................................... 37 ERROR(S)!
    71579 11:16:54 (0) ** - Root/CIMV2, MSFT_NetInvalidDriverDependency, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71580 11:16:54 (0) **   MOF Registration: ''
    71581 11:16:54 (0) ** - Root/CIMV2, Win32_OsBaselineProvider, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71582 11:16:54 (0) **   MOF Registration: ''
    71583 11:16:54 (0) ** - Root/CIMV2, Win32_OsBaseline, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71584 11:16:54 (0) **   MOF Registration: ''
    71585 11:16:54 (0) ** - Root/CIMV2, Win32_DriverVXD, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71586 11:16:54 (0) **   MOF Registration: ''
    71587 11:16:54 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_GenericIKEandAuthIP, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71588 11:16:54 (0) **   MOF Registration: ''
    71589 11:16:54 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_GenericIKEandAuthIP, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71590 11:16:54 (0) **   MOF Registration: ''
    71591 11:16:54 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecAuthIPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71592 11:16:54 (0) **   MOF Registration: ''
    71593 11:16:54 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecAuthIPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71594 11:16:54 (0) **   MOF Registration: ''
    71595 11:16:54 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecAuthIPv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71596 11:16:54 (0) **   MOF Registration: ''
    71597 11:16:54 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecAuthIPv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71598 11:16:54 (0) **   MOF Registration: ''
    71599 11:16:54 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecIKEv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71600 11:16:54 (0) **   MOF Registration: ''
    71601 11:16:54 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecIKEv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71602 11:16:54 (0) **   MOF Registration: ''
    71603 11:16:54 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecIKEv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71604 11:16:54 (0) **   MOF Registration: ''
    71605 11:16:54 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecIKEv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71606 11:16:54 (0) **   MOF Registration: ''
    71607 11:16:54 (0) ** - Root/CIMV2, Win32_PerfFormattedData_TermService_TerminalServices, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71608 11:16:54 (0) **   MOF Registration: ''
    71609 11:16:54 (0) ** - Root/CIMV2, Win32_PerfRawData_TermService_TerminalServices, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71610 11:16:54 (0) **   MOF Registration: ''
    71611 11:16:54 (0) ** - Root/WMI, ReserveDisjoinThread, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71612 11:16:54 (0) **   MOF Registration: ''
    71613 11:16:54 (0) ** - Root/WMI, ReserveLateCount, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71614 11:16:54 (0) **   MOF Registration: ''
    71615 11:16:54 (0) ** - Root/WMI, ReserveJoinThread, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71616 11:16:54 (0) **   MOF Registration: ''
    71617 11:16:54 (0) ** - Root/WMI, ReserveDelete, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71618 11:16:54 (0) **   MOF Registration: ''
    71619 11:16:54 (0) ** - Root/WMI, ReserveBandwidth, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71620 11:16:54 (0) **   MOF Registration: ''
    71621 11:16:54 (0) ** - Root/WMI, ReserveCreate, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71622 11:16:54 (0) **   MOF Registration: ''
    71623 11:16:54 (0) ** - Root/WMI, SystemConfig_PhyDisk, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71624 11:16:54 (0) **   MOF Registration: ''
    71625 11:16:54 (0) ** - Root/WMI, SystemConfig_Video, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71626 11:16:54 (0) **   MOF Registration: ''
    71627 11:16:54 (0) ** - Root/WMI, SystemConfig_IDEChannel, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71628 11:16:54 (0) **   MOF Registration: ''
    71629 11:16:54 (0) ** - Root/WMI, SystemConfig_NIC, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71630 11:16:54 (0) **   MOF Registration: ''
    71631 11:16:54 (0) ** - Root/WMI, SystemConfig_Network, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71632 11:16:54 (0) **   MOF Registration: ''
    71633 11:16:54 (0) ** - Root/WMI, SystemConfig_CPU, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71634 11:16:54 (0) **   MOF Registration: ''
    71635 11:16:54 (0) ** - Root/WMI, SystemConfig_LogDisk, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71636 11:16:54 (0) **   MOF Registration: ''
    71637 11:16:54 (0) ** - Root/WMI, SystemConfig_Power, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71638 11:16:54 (0) **   MOF Registration: ''
    71639 11:16:54 (0) ** - root/ccm/ContentTransferManager, CCM_CTM_JobStateEx, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71640 11:16:54 (0) **   MOF Registration: ''
    71641 11:16:54 (0) ** - root/ccm/DataTransferService, CCM_DTS_JobItem, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71642 11:16:54 (0) **   MOF Registration: ''
    71643 11:16:54 (0) ** - root/ccm/LocationServices, LocationRequest, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71644 11:16:54 (0) **   MOF Registration: ''
    71645 11:16:54 (0) ** - root/ccm/events, SoftDistDownloadStartedEvent, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71646 11:16:54 (0) **   MOF Registration: ''
    71647 11:16:54 (0) ** - root/ccm/events, SoftDistDownloadCompletedEvent, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71648 11:16:54 (0) **   MOF Registration: ''
    71649 11:16:54 (0) ** - root/ccm/events, SoftDistDownloadCancelledEvent, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71650 11:16:54 (0) **   MOF Registration: ''
    71651 11:16:54 (0) ** - root/ccm/Policy, CCM_InventoryClientConfig, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
    71652 11:16:54 (0) **   MOF Registration: ''
    71653 11:16:54 (0) ** => When a WMI performance class is missing (i.e. 'Win32_PerfRawData_TermService_TerminalServices'), it is generally due to
    71654 11:16:54 (0) **    a lack of buffer refresh of the WMI class provider exposing the WMI performance counters.
    71655 11:16:54 (0) **    You can refresh the WMI class provider buffer with the following command:
    71656 11:16:54 (0) **
    71657 11:16:54 (0) **    i.e. 'WINMGMT.EXE /SYNCPERF'
    71658 11:16:54 (0) **
    71659 11:16:54 (0) ** WMI MOF representations: ............................................................................................ OK.
    71660 11:16:54 (0) ** WMI QUALIFIER access operations: .................................................................................... OK.
    71661 11:16:54 (0) ** WMI ENUMERATION operations: ......................................................................................... OK.
    71662 11:16:54 (1) !! ERROR: WMI EXECQUERY operation errors reported: ..................................................................... 13 ERROR(S)!
    71663 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Service_EndpointConfiguration WHERE Name = "UploadProtocol" AND CoClass = "{0DE0ED98-C389-4292-BB71-391CDE6BA69D}"' did not return any instance while AT LEAST 1 instance is expected.
    71664 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "LSLogon"' did not return any instance while AT LEAST 1 instance is expected.
    71665 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "PatchUIMonitor"' did not return any instance while AT LEAST 1 instance is expected.
    71666 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "PatchUIMonitorLogoff"' did not return any instance while AT LEAST 1 instance is expected.
    71667 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "PatchUIMonitorLogon"' did not return any instance while AT LEAST 1 instance is expected.
    71668 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "PatchUIMonitorStartup"' did not return any instance while AT LEAST 1 instance is expected.
    71669 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "PolicyEvaluator_Startup"' did not return any instance while AT LEAST 1 instance is expected.
    71670 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "RemoteToolsStartup"' did not return any instance while AT LEAST 1 instance is expected.
    71671 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "SrcUpdateLogoff"' did not return any instance while AT LEAST 1 instance is expected.
    71672 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Logging_ComponentConfiguration WHERE Name = "UploadProtocol"' did not return any instance while AT LEAST 1 instance is expected.
    71673 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Service_SystemTaskConfiguration WHERE Name = "LSLogon" AND CoClass = "{D6E8E829-A355-4706-A7DA-2AB8E323DAB7}"' did not return any instance while AT LEAST 1 instance is expected.
    71674 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Service_SystemTaskConfiguration WHERE Name = "PolicyEvaluator_Startup" AND CoClass = "{F13946FA-8641-4B12-8BC0-2868D45D62FF}"' did not return any instance while AT LEAST 1 instance is expected.
    71675 11:16:54 (0) ** - root/ccm/Policy/machine, 'Select * From CCM_Service_SystemTaskConfiguration WHERE Name = "SrcUpdateLogoff" AND CoClass = "{84CC61B8-9EA7-4EE2-B839-D7F1852A3688}"' did not return any instance while AT LEAST 1 instance is expected.
    71676 11:16:54 (0) **
    71677 11:16:54 (0) ** WMI GET VALUE operations: ........................................................................................... OK.
    71678 11:16:54 (0) ** WMI WRITE operations: ............................................................................................... NOT TESTED.
    71679 11:16:54 (0) ** WMI PUT operations: ................................................................................................. NOT TESTED.
    71680 11:16:54 (0) ** WMI DELETE operations: .............................................................................................. NOT TESTED.
    71681 11:16:54 (0) ** WMI static instances retrieved: ..................................................................................... 17478.
    71682 11:16:54 (0) ** WMI dynamic instances retrieved: .................................................................................... 0.
    71683 11:16:54 (0) ** WMI instance request cancellations (to limit performance impact): ................................................... 4.
    71684 11:16:54 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    71685 11:16:54 (0) ** # of Event Log events BEFORE WMIDiag execution since the last 20 day(s):
    71686 11:16:54 (0) **   DCOM: ............................................................................................................. 0.
    71687 11:16:54 (0) **   WINMGMT: .......................................................................................................... 0.
    71688 11:16:54 (0) **   WMIADAPTER: ....................................................................................................... 0.
    71689 11:16:54 (0) **
    71690 11:16:54 (0) ** # of additional Event Log events AFTER WMIDiag execution:
    71691 11:16:54 (0) **   DCOM: ............................................................................................................. 0.
    71692 11:16:54 (0) **   WINMGMT: .......................................................................................................... 0.
    71693 11:16:54 (0) **   WMIADAPTER: ....................................................................................................... 0.
    71694 11:16:54 (0) **
    71695 11:16:54 (0) ** 37 error(s) 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found
    71696 11:16:54 (0) ** => This error is typically a WMI error. This WMI error is due to:
    71697 11:16:54 (0) **    - a missing WMI class definition or object.
    71698 11:16:54 (0) **      (See any GET, ENUMERATION, EXECQUERY and GET VALUE operation failures).
    71699 11:16:54 (0) **      You can correct the missing class definitions by:
    71700 11:16:54 (0) **      - Manually recompiling the MOF file(s) with the 'MOFCOMP <FileName.MOF>' command.
    71701 11:16:54 (0) **      Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.
    71702 11:16:54 (0) **            (This list can be built on a similar and working WMI Windows installation)
    71703 11:16:54 (0) **            The following command line must be used:
    71704 11:16:54 (0) **            i.e. 'WMIDiag CorrelateClassAndProvider'
    71705 11:16:54 (0) **      Note: When a WMI performance class is missing, you can manually resynchronize performance counters
    71706 11:16:54 (0) **            with WMI by starting the ADAP process.
    71707 11:16:54 (0) **    - a WMI repository corruption.
    71708 11:16:54 (0) **      In such a case, you must rerun WMIDiag with 'WriteInRepository' parameter
    71709 11:16:54 (0) **      to validate the WMI repository operations.
    71710 11:16:54 (0) **    Note: ENSURE you are an administrator with FULL access to WMI EVERY namespaces of the computer before
    71711 11:16:54 (0) **          executing the WriteInRepository command. To write temporary data from the Root namespace, use:
    71712 11:16:54 (0) **          i.e. 'WMIDiag WriteInRepository=Root'
    71713 11:16:54 (0) **    - If the WriteInRepository command fails, while being an Administrator with ALL accesses to ALL namespaces
    71714 11:16:54 (0) **      the WMI repository must be reconstructed.
    71715 11:16:54 (0) **    Note: The WMI repository reconstruction requires to locate all MOF files needed to rebuild the repository,
    71716 11:16:54 (0) **          otherwise some applications may fail after the reconstruction.
    71717 11:16:54 (0) **          This can be achieved with the following command:
    71718 11:16:54 (0) **          i.e. 'WMIDiag ShowMOFErrors'
    71719 11:16:54 (0) **    Note: The repository reconstruction must be a LAST RESORT solution and ONLY after executing
    71720 11:16:54 (0) **          ALL fixes previously mentioned.
    71721 11:16:54 (2) !! WARNING: Static information stored by external applications in the repository will be LOST! (i.e. SMS Inventory)
    71722 11:16:54 (0) **
    71723 11:16:54 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
    71724 11:16:54 (0) ** Unexpected, wrong or missing registry key values: ................................................................... 1 KEY(S)!
    71725 11:16:54 (0) ** INFO: Unexpected registry key value:
    71726 11:16:54 (0) **   - Current:  HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\Logging (REG_SZ) -> 0
    71727 11:16:54 (0) **   - Expected: HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\Logging (REG_SZ) -> 1
    71728 11:16:54 (0) **     From the command line, the registry configuration can be corrected with the following command:
    71729 11:16:54 (0) **     i.e. 'REG.EXE Add "HKLM\SOFTWARE\Microsoft\WBEM\CIMOM" /v "Logging" /t "REG_SZ" /d "1" /f'

    Thursday, August 15, 2013 3:40 PM

Answers

  • This is obviously not normal. I suggest you start a thread on a Windows forum though or open a case with Microsoft as this isn't specifically a ConfigMgr issue.

    Jason | http://blog.configmgrftw.com

    Wednesday, August 21, 2013 1:28 AM

All replies

  • Are there many expired software updates in your update groups?

    Torsten Meringer | http://www.mssccmfaq.de

    Thursday, August 15, 2013 3:58 PM
    Moderator
  • The hotfix rollup from KB2775511 should also help.

    Jason | http://blog.configmgrftw.com

    Thursday, August 15, 2013 5:40 PM
  • The hotfix rollup from KB2775511 should also help.

    Jason | http://blog.configmgrftw.com

    We've actually gone through and installed it and it seems to be help (could be my imagination) but we're still having the problem.  All expired updates have been removed.  When I turn on WBEM logging and check the logs all it says is WDM call returned error: 5.  No other information.

    Friday, August 16, 2013 7:20 PM
  • Nobody?  All of the computers with problems have almost identical WMIDiag log files.  37 WBEM_E_NOT_FOUND errors.  Is there any way I can actually troubleshoot to see why the OBJECT.DATA file is getting so big and eventually creating a corrupted.rec?  There's got to be some way!
    Tuesday, August 20, 2013 7:50 PM
  • Are you running XP or W7 clients? Will flushing WMI repository work? How long the client will after repository flush?
    Tuesday, August 20, 2013 8:28 PM
  • Are you running XP or W7 clients? Will flushing WMI repository work? How long the client will after repository flush?
    They're all Windows 7 64-bit clients.  If I flush the repository I can actually see the Object.data file getting bigger and bigger and it may take a few hours to corrupt again or it may take a day or two.
    Wednesday, August 21, 2013 1:05 AM
  • This is obviously not normal. I suggest you start a thread on a Windows forum though or open a case with Microsoft as this isn't specifically a ConfigMgr issue.

    Jason | http://blog.configmgrftw.com

    Wednesday, August 21, 2013 1:28 AM
  • I had the same issue, it was due to config manager storing update information in the repository. I had to disable that feature and revert to wsus.
    Friday, October 18, 2013 1:31 PM
  • Is this true?  ConfigMgr (using WSUS) saving update information in the WMI repository??

    I'm having the same issue with numerous systems.  The WMI repository is growing to around 400-500 MB and we are getting corrupted WMI.  Flushing WMI, recreating, only delays issue from returning.


    Jay

    Wednesday, June 18, 2014 5:28 PM
  • Kind of. ConfigMgr clients store most everything in WMI. This includes update compliance information as well as update deployment information. Disabling Software Updates is extreme though and not warranted though as proven by the tens of thousands (and more) of customers running ConfigMgr fine with Software Updates enabled. You can't just deploy every update in the catalog though and do have to do some targeting of updates to the appropriate systems; i.e., don't deploy server updates to workstations and don't include products in the catalog selection that you never intend to patch. You should also periodically clean out expired updates from your deployments as this has been known to cause issues.

    Jason | http://blog.configmgrftw.com

    Wednesday, June 18, 2014 6:19 PM
  • Thank you Jason... this is helpful. 

    One last question on this matter then.  If deployments are better refined (less deployed as you mention) will WMI purge out old updates as I'd expect?


    Jay


    • Edited by Jason Deary Wednesday, June 18, 2014 8:22 PM
    Wednesday, June 18, 2014 8:20 PM
  • Jason,

    After removing software update groups deployments, will the client purge WMI automatically to reduce size?


    Jay

    Thursday, June 19, 2014 8:48 PM
  • I honestly don't know for sure. The data itself should absolutely be purged which should be all that matters but there's not a lot of concrete info out on this since so many people resort to simply deleting the repository and letting it rebuild.

    Jason | http://blog.configmgrftw.com

    Sunday, June 22, 2014 6:54 PM