Host Process Error - Windows Instrumentation Management


  • Hello again JohnBUK (MSF)

    First off sorry about posting to an old thread but I did not see the New Thread Option at first. My problem is that I continue to get a Host Process for windows services stopped message. Here is the information you requested. One of the strange things my computer is doing is when I open a word file and the close it, a new empty word file is added. This information is for the current problem and deals with windows management instrumentation stopped working.


    Bill J.

    Problem signature

    Problem Event Name: APPCRASH

    Application Name: svchost.exe_Winmgmt

    Application Version: 6.0.6000.16386

    Application Timestamp: 4549adc4

    Fault Module Name: ole32.dll

    Fault Module Version: 6.0.6000.16386

    Fault Module Timestamp: 4549bd92

    Exception Code: c0000005

    Exception Offset: 0001dfe3

    OS Version: 6.0.6000.

    Locale ID: 1033

    Additional Information 1: 4ce6

    Additional Information 2: 65c740c1ff4ab57599dcadbf57d44068

    Additional Information 3: 63f0

    Additional Information 4: 15e42354f4c55c658d14a745e7863037

    Extra information about the problem

    Bucket ID: 383434982

    Thursday, February 14, 2008 5:52 PM

All replies

  • Hello, I am replying so the post shows up in "my threads'.  This is faulting in OLE32 because member data in Thread Local Storage (TLS) is not initialized.  My thought is that this occuring because WMI is attempting to process a request based on a timer likely from  a registered provider or event filter.


    I know my answer is technically correct, but not helpful.  There is a tool called webmtest that can be used to query the WMI repository, but it's been awhile since I have used it and need to dream up a good query.



    In the mean time check your Application Log and System log for any events around the same time as the svchost.exe_Winmgmt application crash.  Post any other winmgmt AppCrash events if you have them.




    I work at Microsoft. These are my opinions and not my employers.

    This posting is provided "AS IS" with no warranties, and confers no rights.

    Saturday, February 16, 2008 8:15 PM
  • Thanks John,

    It is nice of you to help. I opened the event viewer but I really don't understand any of it. I will past one of the most current problems.


    Log Name:      Application
    Source:        Application Error
    Date:          2008-02-17 12:23
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      HALMediaMaster
    Faulting application svchost.exe_ProfSvc, version 6.0.6000.16386, time stamp 0x4549adc4, faulting module ole32.dll, version 6.0.6000.16386, time stamp 0x4549bd92, exception code 0xc0000005, fault offset 0x0001dfe3, process id 0x3794, application start time 0x01c8718951a06eb2.
    Event Xml:
    <Event xmlns="">
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <TimeCreated SystemTime="2008-02-17T17:23:13.000Z" />
        <Security />


    Sunday, February 17, 2008 5:29 PM
  • Hi,


    Start / All Programs / Right Click on Command Prompt / Run as Administrator

    At the command prompt type the following command:

    sc config winmgmt type=  own

    sc config wuaserv type= own


    This will isoloate WMI and Windows Update in their own svchost.exe, this way they won't affect other running services if it crashes again.  After further investigation, WMI could also be a victim, since the problem is that OLE probably code uninitialized twice.





    I work at Microsoft. These are my opinions and not my employers.

    This posting is provided "AS IS" with no warranties, and confers no rights.


    Monday, February 18, 2008 3:53 PM
  • Thanks John,

    You have made big progress with my issue. I followed your directions with the following results.

    Sc config winmgmt type= own


    Sc config wuaserv type= own

    [SC] OpenService FAILED 1060:

    The specified service does not exist as an installed service.

    Although one of the commands failed, I am no longer getting the host error message and that is big progress, thanks. I appreciate your help.


    I still have a strange issue with WORD. When I open a WORD Doc and then close it, I usually get an extra file added that is empty. For example, I open a file with the title Letter and then close it, a few seconds go by and then a new empty file is displayed with the title -$etter. I also seem to get extra files sometimes with the title of ~WRD000.tmp.

    I don’t know if this is related but I also have two files that have been added in a personal folder with the title of ntuser.dat.LOG1 and the same with LOG2. LOG2 shows to be empty.

    Thank You,

    Bill J.


    Monday, February 18, 2008 5:27 PM
  • Hello Bill,


    Those ~WRD000.tmp. file and -$etter files are temporary files used by word and also provides the autosave feature for word.  They are normal. 


    The ntuser.dat.log1 and ntuser.dat.log2 are transaction log files for the registry and are normal as well.


    You normally don't see these normal files because they are hidden or are system files.


    Since you only need to see hidden and system files while you are troubleshooting, Inside the folder where you see them, you can re-hide them use the following steps.

    Alt T / Folder Options / Do not Show Hidden and System FIles


    Sorry about the typo above.  This is the correct command.

    sc config wuauserv type=own


    If you are not having troubles anymore, you don't need to do it.  The goal was to Isolate potentially problematic services into their own process space.





    I work at Microsoft. These are my opinions and not my employers.

    This posting is provided "AS IS" with no warranties, and confers no rights.

    Monday, February 18, 2008 9:15 PM
  • Hi John,

    Thanks for the fix and the information regarding the hidden files folder option. I selected do not show hidden files and folders and this took care of the unwanted files that were in view except for the unwanted annoying -$WORD file saves.

    I tried to restart and a shutdown for the change to take place but this did not get rid of the -$Worddoc files. I did try changing a few WORD options like trying no save just to see but the empty -$file keeps showing up.




    Tuesday, February 19, 2008 1:03 AM
  • I have started a new thread titled Hidden Files Can Not be hidden in Vista.


    Thank You,



    Thursday, February 21, 2008 5:54 PM
  • John

    this helped me too, I was getting killed off of RAS and could not get back in until the service restored itself.

    Since I used your commands, I still see failures but it doesn't bring down the RAS...


    Thursday, January 01, 2009 4:10 AM