locked
WMI and DCOM errors RRS feed

  • Question

  • We have an office of 50+ Dell workstations all running XP SP3 with all current patches. The servers are all Server 2008 (Active directory, Exchange 2007, etc.)

    For months now, there have been a DCOM problem that I have been unable to resolve.

    Every morning, at 2:30AM, all workstations are rebooted. I do this with a PSSHUTDOWN script.

    Every morning, 1 or 2 workstations develop a DCOM error loop right after the workstation has rebooted. It just keeps going and going..... causing extremely slow logins and processing. The usual solution is to reboot the workstation which clears the loop condition and makes the workstation normal again. The affected workstations are not the same every day..... it seems to affect all of the units on the LAN but different ones each day. Yes, some of them repeat after a while.

    The error seems to be related to WMI and I have looked at/set permissions on various CLSID items and in WMI control panel and DCOMCNFG with no change in the problem.

    I need to get rid of this problem. I need to have XP stop repeating this DCOM error race condition and any help forum members can provide would be helpful.

    the following log excerpt shows the EVENTLOG entry at 2:30AM (event log item is when the workstation was rebooted) , the loop and then forced rebooted again around 8:38am.

    Information 3/23/2011 8:33:58 AM Tcpip None 4201 N/A LCY
    Information 3/23/2011 8:34:06 AM eventlog None 6005 N/A LCY
    Information 3/23/2011 8:34:06 AM eventlog None 6009 N/A LCY
    Error 3/23/2011 8:33:24 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:30:43 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:27:40 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:24:49 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:21:51 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:18:52 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:15:53 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:12:55 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:09:16 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:06:36 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:03:56 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 8:00:59 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:58:19 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:55:39 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:52:59 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:49:59 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:46:59 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:43:41 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:41:01 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:38:02 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:35:07 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:32:07 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:28:59 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:26:18 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:23:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:20:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:20:05 AM DCOM None 10010 SYSTEM LCY
    Error 3/23/2011 7:17:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:14:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:11:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:08:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:05:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 7:02:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:59:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:56:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:53:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:50:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:47:33 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:44:53 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:42:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:39:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:36:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:32:53 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:30:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:27:13 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:23:47 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:21:06 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:18:05 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:15:16 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:12:27 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:09:42 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:07:02 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:04:22 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 6:01:42 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:59:02 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:56:22 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:53:42 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:51:02 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:48:22 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:45:42 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:43:02 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:40:15 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:37:18 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:34:23 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:31:43 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:29:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:26:23 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:23:43 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:21:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:20:01 AM DCOM None 10010 SYSTEM LCY
    Error 3/23/2011 5:18:23 AM DCOM None 10010 NETWORK SERVICE LCY
    Information 3/23/2011 5:17:29 AM Service Control Manager None 7036 N/A LCY
    Error 3/23/2011 5:15:43 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:13:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:09:43 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:07:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:03:23 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 5:00:43 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:58:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:55:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:52:23 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:49:43 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:47:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:44:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:41:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:38:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:35:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:32:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:28:43 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:26:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:22:43 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:20:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:17:03 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:13:47 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:11:06 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:08:11 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 4:05:30 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 3:16:16 AM DCOM None 10010 SYSTEM LCY
    Error 3/23/2011 3:07:41 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 3:05:01 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 2:45:21 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 2:42:41 AM DCOM None 10010 NETWORK SERVICE LCY
    Error 3/23/2011 2:40:01 AM DCOM None 10010 NETWORK SERVICE LCY
    Information 3/23/2011 2:37:37 AM Service Control Manager None 7036 N/A LCY
    Information 3/23/2011 2:37:37 AM Service Control Manager None 7035 SYSTEM LCY
    Error 3/23/2011 2:37:37 AM Service Control Manager None 7022 N/A LCY
    Error 3/23/2011 2:37:37 AM Service Control Manager None 7022 N/A LCY
    Warning 3/23/2011 2:34:08 AM LsaSrv SPNEGO (Negotiator) 40961 N/A LCY
    Information 3/23/2011 2:31:45 AM Tcpip None 4201 N/A LCY
    Information 3/23/2011 2:31:53 AM eventlog None 6005 N/A LCY
    Information 3/23/2011 2:31:53 AM eventlog None 6009 N/A LCY
    Information 3/23/2011 2:30:56 AM eventlog None 6006 N/A LCY

    this is the content of one of the DCOM errors:

    The server {1F87137D-0E7C-44D5-8C73-4EFFB68962F2} did not register with DCOM within the required timeout.



    and some entries from the WBEM log:


    (Sat Mar 19 02:38:13 2011.418312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 02:38:13 2011.418312) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 02:40:53 2011.578312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 02:42:53 2011.698328) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80041013
    (Sat Mar 19 02:43:33 2011.738312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 02:43:33 2011.738312) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 02:46:13 2011.898312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 02:48:53 2011.1058312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 02:48:53 2011.1058312) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 02:51:33 2011.1218312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 02:53:34 2011.1339656) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80041013
    (Sat Mar 19 02:54:13 2011.1378312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 02:54:13 2011.1378312) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 02:56:53 2011.1538312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 02:58:54 2011.1659734) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80041013
    (Sat Mar 19 02:59:33 2011.1698312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 02:59:33 2011.1698312) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 03:02:13 2011.1858312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:04:14 2011.1979875) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80041013
    (Sat Mar 19 03:04:53 2011.2018312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:04:53 2011.2018312) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 03:07:33 2011.2178312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:08:36 2011.2241093) : NT Event Log Consumer: could not retrieve sid, 0x80041002
    (Sat Mar 19 03:09:34 2011.2299531) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80041013
    (Sat Mar 19 03:10:13 2011.2338312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:10:13 2011.2338312) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 03:12:53 2011.2498312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:14:54 2011.2619500) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80041013
    (Sat Mar 19 03:15:33 2011.2658312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:15:33 2011.2658312) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 03:18:13 2011.2818312) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:23:34 2011.3139515) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:23:34 2011.3139515) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 03:28:54 2011.3459515) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:31:34 2011.3619515) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:31:34 2011.3619515) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 03:34:14 2011.3779515) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:39:35 2011.4100828) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:39:35 2011.4100828) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 03:42:15 2011.4260828) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:44:55 2011.4420828) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:44:55 2011.4420828) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 03:47:35 2011.4580828) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:52:57 2011.4902125) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:52:57 2011.4902125) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 03:55:37 2011.5062125) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:58:17 2011.5222125) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 03:58:17 2011.5222125) : Non-WMI error code recieved from provider MS_NT_EVENTLOG_EVENT_PROVIDER: 0x80080005. WMI will attempt to re-activate
    (Sat Mar 19 04:00:57 2011.5382125) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 04:06:18 2011.5703437) : Unable to load event provider 'MS_NT_EVENTLOG_EVENT_PROVIDER' in namespace '//./root/CIMV2': 0x80080005
    (Sat Mar 19 04:0

    <lots more repeated until forced reboot).

    Thanks

    Gene
     

    Sunday, April 24, 2011 3:00 PM

All replies

  • Can you stagger the reboots by 1 minute so that the servers do not get overwhelmed

     


    My MVP is for the Windows Desktop Experience, i.e. Windows XP, Vista and Windows 7 IT

    Remote Assistance is available for a fee.

    I am best with C++ and I am learning C# using Visual Studio 2010

    Developer | Windows IT | Chess | Economics | Hardcore Games | Vegan Advocate | PC Reviews

    Sunday, April 24, 2011 5:53 PM
  • Can you stagger the reboots by 1 minute so that the servers do not get overwhelmed

     


    My MVP is for the Windows Desktop Experience, i.e. Windows XP, Vista and Windows 7 IT

    Remote Assistance is available for a fee.

    I am best with C++ and I am learning C# using Visual Studio 2010

    Developer | Windows IT | Chess | Economics | Hardcore Games | Vegan Advocate | PC Reviews

    yes, i tried that. still get the problem.

     

    in fact, new observation..... the DCOM loop starts about 8-10 minutes after boot-up. if i do not log in after reboot, it is likely to begin the looping again but NEVER if the workstation has a login.

     

    Monday, April 25, 2011 4:47 AM
  • our Win7 computers are unaffected by this.

     

    i cannot justify the cost of migration just to get rid of this error.

     

    Tuesday, April 26, 2011 1:30 AM