none
Event 5858 from WMI-Activity RRS feed

  • Question

  • Many instances of Event 5858 from WMI-Activity are appearing in the Microsoft-Windows-WMI-Activity/Operational log.

    An example of the event message text is "Id = {BA4361BF-423A-0001-1284-43BA3A42CD01}; ClientMachine = SERVER1; User = SERVER\bnf1; ClientProcessId = 928; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown

    Is there a solution or a workaround?

    Thanks.

    mardi 5 juin 2012 17:22

Toutes les réponses

  • Hi,

    Thank you for your post.

    This is a quick note to let you know that we are performing research on this issue.


    Lawrence

    TechNet Community Support

    lundi 11 juin 2012 07:34
    Modérateur
  • Thank you!
    lundi 11 juin 2012 16:42
  • Thank you!

    Any progress?

    It is the same here, only I discover that after this string of messges on two (of my 12) servers, some services that were stopped automagically shortly before, are not restarted.

    This is more than an annoyance, because these services (VMware tools service on one server and all Veeam Backup and Replicatation services on the other) are pretty important.

    Jan


    Jan Z

    mercredi 29 août 2012 14:55
  • These events continue in Windows Server 2012 RTM.  There are a couple of different sources of this event, as detailed below.

    1.  A group of about 15 instances occurs during Windows Setup, is associated with the operation WbemServices::CreateInstanceEnum, and fails with a result code of 0x8004100A (WBEM_E_CRITICAL_ERROR).  The WMI Error Constants web page says "Report the error to Microsoft Technical Support".

    2.  Another group is associated with the operation WbemServices::ExecQuery, and fails with a result code of 0x80041032 (WBEM_E_CALL_CANCELLED).

    3.  The most common group, which occurs when Group Policy is applied, is associated with the operation WbemServices::DeleteInstance, and fails with a result code of 0x80041002 (WBEM_E_NOT_FOUND).  This group references Group Policy Preferences, which are not available in non domain-joined computers, and in the case of domain-joined computers, occurs for all such objects that are not defined.  For example, when a preference is definded for User Configuration > Preferences > Control Panel Settings > Start Menu, and gpupdate /force is run, the count of event 5858 will be reduced by 1, because this prefrence has been defined.

    jeudi 6 septembre 2012 13:42
  • Any update on this? I have the exact same issue when trying to start Direct Access on Server 2012, even before the configuration.
    mercredi 5 décembre 2012 22:00
  • Hello

    fresh installation of Windows 2012 Standard generates these WMI-Activity 5858 events to log:

    Error 12. 12. 2012 17:48:34 Microsoft-Windows-WMI-Activity 5858 None Id = {356CD90E-D888-0001-27D9-6C3588D8CD01}; ClientMachine = WIN-23RS9SG3UCE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1092; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown

    Error 12. 12. 2012 17:41:18
    Microsoft-Windows-WMI-Activity 5858 None Id = {5BE6862E-D885-0000-5F86-E65B85D8CD01}; ClientMachine = WIN-23RS9SG3UCE; User = WIN-23RS9SG3UCE\Administrator; ClientProcessId = 2080; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown

    Error 12. 12. 2012 17:39:18 Microsoft-Windows-WMI-Activity 5858 None Id = {5BE6862E-D885-0000-6186-E65B85D8CD01}; ClientMachine = WIN-23RS9SG3UCE; User = WIN-23RS9SG3UCE\Administrator; ClientProcessId = 2080; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown

    Error 12. 12. 2012 17:37:18 Microsoft-Windows-WMI-Activity 5858 None Id = {5BE6862E-D885-0000-5F86-E65B85D8CD01}; ClientMachine = WIN-23RS9SG3UCE; User = WIN-23RS9SG3UCE\Administrator; ClientProcessId = 2080; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown

    None of the mentioned Id couldn't I find in the system registry.

    Thank you in advance for any idea how to solve these errors.


    • Modifié Jiri Huml jeudi 13 décembre 2012 10:08
    jeudi 13 décembre 2012 10:05
  • I have same prolem on Exchange 2010 SP1 server.

    Log Name:      Microsoft-Windows-WMI-Activity/Operational
    Source:        Microsoft-Windows-WMI-Activity
    Date:          12/21/2012 8:38:11 PM
    Event ID:      5858
    Task Category: None
    Level:         Error
    Keywords:     
    User:          SYSTEM
    Computer:      Exchange10-1.practice.com
    Description:
    Id = {5DBAD974-6927-44C5-AF34-578E94F65775}; ClientMachine = EXCHANGE10-1; User = ; ClientProcessId = 772; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_345497259_281931215_3209510912_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418EF04-B0B4-4623-BF7E-D74AB47BBDAA}" />
        <EventID>5858</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x4000000000000000</Keywords>
        <TimeCreated SystemTime="2012-12-22T03:38:11.117070900Z" />
        <EventRecordID>169</EventRecordID>
        <Correlation />
        <Execution ProcessID="772" ThreadID="4868" />
        <Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
        <Computer>Exchange10-1.practice.com</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <UserData>
        <Operation_ClientFailure xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
          <Id>{5DBAD974-6927-44C5-AF34-578E94F65775}</Id>
          <ClientMachine>EXCHANGE10-1</ClientMachine>
          <User>
          </User>
          <ClientProcessId>772</ClientProcessId>
          <Component>Unknown</Component>
          <Operation>Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_345497259_281931215_3209510912_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"</Operation>
          <ResultCode>0x80041002</ResultCode>
          <PossibleCause>Unknown</PossibleCause>
        </Operation_ClientFailure>
      </UserData>
    </Event>


    yxh

    • Proposé comme réponse Badboy740 jeudi 15 novembre 2018 09:00
    • Non proposé comme réponse Badboy740 jeudi 15 novembre 2018 09:00
    samedi 22 décembre 2012 03:47
  • Hi!

    Is there any update about this problem?

    I have the same problem:

    Microsoft-Windows-WMI-Activity

    5858

    2013.01.08. 3:25:25

    393

    Esemény részletei:   

    Id = {00000001-0000-0003-C9AE-1D194AE0CD01}; ClientMachine = SBS; User = NT AUTHORITY\SYSTEM; ClientProcessId = 11352; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : select * from Win32_OperatingSystem Where ProductType!=2 or ProductType!=3; ResultCode = 0x80041032; PossibleCause = Unknown

    Thanks!

    mardi 8 janvier 2013 07:37
  • Hi,

    I have the same issues on all 4 of my machines.  Most prominent is the 80041002 shown in every WMIDiag.vbs log file ever executed.  They always show the same 30 classes as being missing on most systems where WMIDiag is run.  Most common error listed in WMI-Activity/Operational log is consistent 80041032 entries every few minutes to every 2 hours.  They occur immediately after cimwin32.dll is loaded.  These issues have been researched for years and no solutiuon has ever been posted by Microsoft or anyone else.  Come on Microsft, what is going on with Windows Management Instrumentation?

    Best regards.

    mardi 8 janvier 2013 21:24
  • Hi, I am having the same issue. Does anyone even know what is the cause? Is it hardware and/or software?

    Thanks,

    -Matt

    dimanche 13 janvier 2013 22:17
  • have any of you windows server as a VM on XEN server? I have 2 win servers on XEN server and i have suspicion it's reason for this.
    dimanche 10 février 2013 11:53
  • have any of you windows server as a VM on XEN server? I have 2 win servers on XEN server and i have suspicion it's reason for this.

    No,

    I have only 2 servers installed (DELL Poweredge and Intel Board)

    and both have any thousends errors in WMI Events 5858

    vendredi 22 février 2013 18:10
  • I have the same issue on Windows 7 professional x64

    Id = {02CBDA40-F800-0000-E865-AAE33D0FCE01}; ClientMachine = Client04; User = NT AUTHORITY\SYSTEM; ClientProcessId = 980; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_1447720405_913420198_1853421413_1156 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown

    event id 5858
    WMI-Activity

    This issue was raised back in June last year - no progress by anyone? Microsoft, where are you on this?

    Steve

    mercredi 6 mars 2013 10:39
  • I have the same issue on Windows 7 professional x64

    Id = {02CBDA40-F800-0000-E865-AAE33D0FCE01}; ClientMachine = Client04; User = NT AUTHORITY\SYSTEM; ClientProcessId = 980; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_1447720405_913420198_1853421413_1156 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown

    event id 5858
    WMI-Activity

    This issue was raised back in June last year - no progress by anyone? Microsoft, where are you on this?

    Steve

    I'm having the similar issue on win7pro 64 bit.  This error appears to be triggered by a problem with the Windows Diagnostic Services, which blow up and cannot run.  Consequently, many troubleshooter wizards can't run either.  My actual error code is:

    Id = {034BFC78-F800-0007-44C2-5786103FCE01}; ClientMachine = JOHN-GALT; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4860; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : hpqBIntM; ResultCode = 0x80041032; PossibleCause = Unknown

    In my case, it appears to be pointing to the HP BIOS enumerator, which (according to WMI diagnostics) is dynamic.  WMI diagnostic log shows some errors  around HP_BIOSEnumeration (in Root/HP/INSTRUMENTEDBIOS) because (InstancesOfSink_OnCompleted) : 0x8004100F invalid instance.

    Ideas?

    mardi 16 avril 2013 19:05
  • The core problem for this set of issues is that the WMI error event ID 5858 is being generated generically and is not only representing functional error conditions. Unfortunately, for application/backwards compatibility, we can’t just get rid of it, because people have gone to the effort of parsing the event (more below) to look for the instances where there is useful data.

    Event 5858 is generated any time there is an error returned to the WMI client API. Many of these “errors” are behaviors that the client application handles (for example, checking for something that is not present), so seeing event 5858 does not tell you enough. The user data section of the event has the information to explain if the problem is important, but it must be parsed. That makes this event hard to use for monitoring, so some notes on that are at the end.

    To understand WMI event 5858, the key elements are in userdata, specifically:

    • ResultCode – this tells you the real reason event is generated, and is the most valuable piece of information. More info is below, but searching TechNet for the ResultCode will usually give you the information you need.
    • Operation – the relevant info follows “Start IWbemServices::”, and tells you what WMI was asked to do. This includes run a query, enumerate/create/delete instances, look for a class, etc. There is a full list here: //msdn.microsoft.com/en-us/library/windows/desktop/gg196568(v=vs.85).aspx
    • User – it sometimes it helps to know what account was trying to do the Operation, particularly if the ResultCode is 0x80041003 – Access Denied.

    ResultCode details: There is a good list of ResultCodes here: //support.microsoft.com/kb/295821. The ones listed in this thread are:

    • 0x80041032 – Call Cancelled. The client application cancelled the request that was made. That is almost always ignorable as a WMI error. The component or application (SCCM, or Group Policy) for example) that was calling into WMI cancelled the request, and will likely generate its own event if it is important to do.
    • 0x8004100A – Critical Error. This could be a significant problem, and should be investigated. The WMI infrastructure is not working properly. You can either use WMIDiag (see this article: //blogs.technet.com/b/askperf/archive/2012/02/03/wmidiag-2-1-is-here.aspx) or from an elevated command prompt run Winmgmt –VerifyRepository.  
    • 0x80041002 – Not Found. This is usually ignorable by itself. It means that WMI could not find the instance of a class that was requested, which is not unusual.
    • 0x8004100F – Invalid Object. This could be a significant problem and should be investigated. It could be a problem where the WMI provider is badly written, or it could be an issue within the WMI repository. See Troubleshooting below.

    Operation details – This begins with “Start IWbemServices::”, then the actual operation, with parameters you can use to find out more info. Examples from the thread above are:

    • ExecQuery – run a WMI query. The structure is ExecQuery - <namespace> : <query>. Example is ExecQuery - root\CIMV2 : select * from Win32_OperatingSystem Where ProductType!=2 or ProductType!=3. You can use the PS command get-wmiobject –namespace (insert the namespace) –query “(insert the query portion)
    • DeleteInstance – delete a specific instance of a WMI class. Looks like: DeleteInstance - <namespace>: <instance information>. Example is DeleteInstance - Root\Rsop\User\S_1_5_21_1447720405_913420198_1853421413_1156 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}".
    • CreateInstanceEnum – sets up to enumerate all instances of a class. Structure is CreateInstanceEnum - <namespace> : <classname>.

    Troubleshooting:

    As noted, some of the issues listed above are important to understand. There are some good topics on WMI Troubleshooting in TechNet, so I won’t try to repeat them. There is a generally good article here: technet.microsoft.com/en-us/magazine/2006.09.wmievents.aspx. The most critical things to check for are repository issues, which you can do either using WMIDiag (see this article: blogs.technet.com/b/askperf/archive/2012/02/03/wmidiag-2-1-is-here.aspx) or from an elevated command prompt run Winmgmt –VerifyRepository, and confirm that the repository is in good shape.

    Monitoring:

    You have to parse event 5858 to get the critical info, so other events are easier to use for monitoring. The most critical events to watch for relating to WMI are still in the Windows-Application log, not Microsoft-Windows-WMI-Activity/Operational log (where event 5858 is found). All of the most serious errors that will show up with an event 5858 will also have something in the Windows-Application log. Documentation for the most relevant events are listed in multiple topics under this reference: //technet.microsoft.com/en-us/library/cc727020(v=ws.10).aspx

    In summary:

    Event 5858 is confusing, generally ignorable, and unfortunately not something we can get rid of easily. It does provide valuable information if you know how to parse it. The most relevant information is the ResultCode in the UserData section – copy and paste that into a search of TechNet for meaningful information.


    jeudi 30 mai 2013 21:09
  • Thanks for your detailed and authoritative (MSFT) reply. In my view, the objective is not to get rid of Event 5858, but to get rid of the code that generates the ignorable instances of Event 5858.
    lundi 3 juin 2013 16:16
  • Last spring (2013), I wrote a mof file that generates the 32 or 34 objects that WMIDiag.vbs chokes on and informs almost every user that they are missing.  I copied information for most of the classes from various places on the internet checking for accuracy of the information.  Compiling this .mof file in addition to running the batch file described below will clear up most or all of the 0x80041002 WMI errors that WMIDiag generates and the diagnostic will run successfully in most cases where there is not any really serious structural repository damage. I've modified WMIDiag.vbs to successfully run on Windows 8.0, 8.1 and Windows Server 2012.

    I also wrote a large batch file (116KB) that repairs many repository issues.  A lot of posted WMI repair batch files and instructions for repairing the repository do not take ALL issues into consideration and can cause their own problems.  For example, there are uninstall .mof files in %Windir%\System32\wbem and %Windir%\System32\wbem\en-US.  If the uninstall .mof and .mfl files are not temporarily renamed while compiling mof files the user will compile the uninstall information also uninstalling anywhere from 8 to 34 or more .mof files and the entire set of classes for each.  Almost all batch files found on the internet try to compile the language specific files (.mfl) in the %Windir%\System32\wbem folder when the .mfl files actually reside in the %Windir%\System32\wbem\en-US folder for Windows 7 and 8, so you must change folders appropriately or use the correct path when compiling .mfls.  Output from my batch operations is written to a text log file which can be searched for the word "error" to verify success or failure of all operations.  A couple of zero length mof files in the %Windir%\System32\wbem\en-US folder are also temporarily renamed to avoid spurious errors.

    I am currently working on a batch file that sets the correct ownership and permissions for the %Windir%\System32\wbem and %Windir%\System32\wbem\en-US folders.  Execution of this batch file enables users to edit and compile mof and mfl files in the appropriate Windows folders.  The batch file uses Subinacl.exe for this purpose. My batch file would be good for home systems or offline systems, but I don't think any corporate users would want to screw around with any of their Windows permissions in this manner.  The batch file removes the read only attribute from the Windows folder and WBEM subfolders and files and it adds "full control" security for System, Administrators, and TrustedInstaller.  Local Service, Network Service and Users are given either modify or read and execute rights.  These last security settings will not sit right with many corporate users with online systems.  It also ensures that most Windows registry keys and subkeys are owned by Administrators and that full control is given to Administrators and System with Users getting read access.  The last major change it performs is to modify Program Files and Program Files (x86) so that the user can write and store data in the folders and sub-folders.  I prefer this option since I install many portable applications on my systems and I prefer to store program configuration in .ini files in the program folders when possible rather than the Appdata folders.  This way I can copy a portable application from my system and know I have the latest configuration settings included.

    I make these tools available for download from a OneDrive folder if I think they can help someone.


    • Modifié RichardtheGeek vendredi 7 août 2015 20:28 Make more descriptive
    vendredi 20 décembre 2013 18:47
  • Seems like that would be some good stuff to share. CodePlex (The link below) is a great place to host Win related software.....

    http://www.codeplex.com/

    mercredi 30 avril 2014 19:03
  • Thanks for the suggestion.  I've continued working on the projects over the last couple of months.  It would only require a little clean-up to make the projects presentable.  I've also modified WMIDiag.vbs to operate with Windows 8, 8.1 and Windows Server 2012.  It ran successfully for me on Win 8 and 8.0 and for another guy with Windows Server 2012.  I could probably make that available also.  After running my programs, I have an absolutely clean WMIDiag report.  I'll give it some thought and maybe in a week or so I'll put it on codeplex.
    mercredi 30 avril 2014 22:38
  • Thanks for the suggestion.  I've continued working on the projects over the last couple of months.  It would only require a little clean-up to make the projects presentable.  I've also modified WMIDiag.vbs to operate with Windows 8, 8.1 and Windows Server 2012.  It ran successfully for me on Win 8 and 8.0 and for another guy with Windows Server 2012.  I could probably make that available also.  After running my programs, I have an absolutely clean WMIDiag report.  I'll give it some thought and maybe in a week or so I'll put it on codeplex.
    @RichardtheGeek:  Sorry to resurrect this message, however, this project that you are working on with WMI and Server/8.1/etc, not only sounds like a daunting and intricate task but also an incredibly useful one in both personal environments and enterprise alike.  I was wondering if you did in fact host your most current products online so that I may look into them for my purposes on my own domains/systems/test and live environments.  Were you able to post the product online?  BTW I applaud your efforts to even begin to tackle WMI and WBEM issues! I am sure you are aware first hand of how abundant, annoying, destructive if not handled properly and anxiety laden WMI and WBEM are.  I have resulted to the easy way out method of rename or remove and rebuild on a few occasions which yes works and lets you move past for a bit, however, returns like a plaque later on at the worst of times it seems.  It sounds like the work you have done so far is a big leap towards the "correct" way of handling the WMI and WBEM problems and I do respect that!  Hope to hear from you soon! -Chad
    vendredi 7 août 2015 13:57
  • I tried to do it the right way instead of simply deleting the repository and rebuilding.  There are too many issues involved for rebuilding the repository to be an adequate solution.  For example if you rebuild the repository by mofcomping all .mof files, there are uninstall .mof files also and the user uninstalls anywhere from 8 to 36 functions unknowingly depending on OS.  The uninstall files must be managed so that specific classes are not uninstalled.  Also, the language specific .mfl files are stored in the en-US folder, not in the WBEM folder so they don't get recompiled during a rebuild.  There are a number of other nagging issues with rebuilding the repository such as zero length files that generate a mofcomp error.  I've rarely found a system yet that I cannot get WMIDiag.vbs to run without errors without deleting and rebuilding the repository.  I've only worked on a dozen or so systems with the stuff.  Unfortunately, I have not found a place to publish my stuff.  I make it available to from my Onedrive when requested.  Let me know what your problem is and I'll let you know if my stuff will help.
    vendredi 7 août 2015 18:38
  • I do appreciate your efforts in explaining your actions. I have been running 8.1 for some time without this issue until an update downloaded and installed on 09/02/2015. I would greatly appreciate copies of your batch files, because this issue is triggering a domino of issues in warnings, errors, etc.

    Many thanks for your help

     
    mercredi 9 septembre 2015 15:48
  • What type of problem are you having?  If you provide more information I can tailor the batch file(s) I send you.  Sorry it took me so long to respond, your email went into my junk mail folder.
    vendredi 11 septembre 2015 22:43
  • fwiw - I still get a TON of these event entries on Windows Server 2012 R2 Datacenter with all the latest patches.  Fresh install.  In addition to the above hex values, I see 0x80041010, and 0x80041007.  These repeat every 30 seconds in the event log.  Very unnecessary bloating of the event log repository, and overhead on CPU and memory resources.
    jeudi 21 avril 2016 13:54
  • As stated earlier, I have a .mof file that addes missing classes, a batch file that changes permissions on Windows folders, particularly %windir%\System32\WBEM, and a modified WMIDiag.vbs that runs on Windows Server 2012.  All the systems I've tried it on clear up many of the spurious errors from Windows Management Instrumentation.  A couple of people have tried them on Windows Server 2012 (not sure of the release) and WMIDiag runs clean.  Let me know if you are interested,  You can print out the batch file to see what it will do.  It re-compiles all .mof files after it renames the uninstall .mof files and then renames them back.

    If you are interested in the software, please send some examples of your errors first and perform a directory listing on uninstall .mof files with "dir *uninst*.mof" so I can make sure that all Windows Server 2012 mof files are renames before the remaining .mof files are re-compiled.

    I'm operating at half speed.  My new motherboard crashed and I am on an older Win 7 system, so if my communications is sporadic, that's why.  I'm recovering my files from backups.

    vendredi 22 avril 2016 13:15
  • Davodavodavo-

    After having a similar problem as you and searching for days for an answer, I was able to find a solution. I never found all of it in one place, so even though this is an old thread, I think it may be useful to have something here.

    I was having extreme CPU and disk usage problems, where my older laptop had slowed considerably. Of interest, it would boot fine but once connected to a wifi network would beegin to have problems. I traced it to the fact that WmiPrvSe was querying hundreds or thousands of registry keys per second (according to SysInternal's procmon). Further investigation showed that CIMWin32 was somehow implicated. As I looked at the logs, I was getting the WMI-Activity 5858 problem also. I was lucky that it referenced hpqBIntM, but also in the Windows-Application log I found an entry by hpqwmiex. The entry was cryptic, but searching for hpqwmiex online led to some sites discussing how to remove some of the bloatware associated with HP laptops and the automatic programs that come with them. Specifically hpqwmiex may be associated with the HP Health-Monitor or something. I don't know why I didn't uninstall that years ago. They suggested simply renaming the hpqwmiex.exe file, but I renamed the whole "Program Files(x86)\Hewlett-Packard" folder since I did not want any of the applications to run.

    After a reboot I haven't had any problems. It seems the built-in HP Advisor and Health Check don't work, but that was my intent anyways.

    If anybody else out there has a similar problem, hopefully they can find this solution.

    samedi 23 juillet 2016 19:35
  • I'll have to look into the HP background programs.  I had some running on the Windows 7 system I was using for development of my .mof and batch files, but I didn't see any correlation between HP Programs and WMI errors.  Most of the issues I refer to in my posts are strictly related to missing WMI classes from the WMI repository.  Most of these missing classes were due to classes from older operating systems no longer being supported in current operating systems so they were spurious errors, but they still prevented WMIDiag.vbs from running cleanly.  I no longer have my development system available and believe it or not, the ASUS motherboard failure I refer to in my April 22, 2016 post has still not be resolved by ASUS after multiple RMAs so I don't have my windows 10 development system.

    Thanks for the info on the HP programs.  I will definitely look into them on my systems since I have an HP LaserJet printer.

    lundi 25 juillet 2016 17:26
  • wheyourtextrunstogetherIdon'tevenbothertoreadit

    This is STILL broken in Windows 10

    • Modifié Bill-777 mercredi 5 avril 2017 14:49
    mercredi 5 avril 2017 14:48
  • Yes, it is still broken.  It won't get better, it will only get worse with newer versions of the operating system.  With each new release, I think more classes become obsolete and are not present in the WMI repository.  Adding the deprecated classes doesn't cause any problems, but it does clear up the spurious errors.  I have WMIDiag.vbs running clean on my Windows 10 version 1607 installations.  Of course, I had to modify WMIDiag.vbs to run on Windows 10 systems.  Most of the 5858 errors are meaningless and can safely be ignored so there is not much to worry about with them.  You will not be able to clean them up completely because of the nature of WMI.
    mercredi 5 avril 2017 20:45
  • PossibleCause = Throttling Idle Tasks, refer to CIMOM regkey: ArbTaskMaxIdle This is a response to this issue it seams  to be also answered here https://social.technet.microsoft.com/Search/en-US?query=PossibleCause%20%3D%20Throttling%20Idle%20Tasks%2C%20refer%20to%20CIMOM%20regkey%3A%20ArbTaskMaxIdle&ac=4
    jeudi 15 novembre 2018 09:02
  •  This is the complete error listed Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-55M63OP; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2068; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\WMI : ASUSManagement; ResultCode = 0x80041032; PossibleCause = Throttling Idle Tasks, refer to CIMOM regkey: ArbTaskMaxIdle
    jeudi 15 novembre 2018 09:03
  • I am using a relatively new computer, and I was having the same WMI issues. When I went the event Viewer I was getting lots of error logs, similar to everyone here. I found the PID, and used task manager to trace the PID to HP Workwise which I did not use anyways. I uninstalled it, but noticed the WMI still causing problems. I checked the logs again, and it pointed to the HP CASL framework service program, which was similar to the hpqwmiex program. Managed to delete the HPCASL service, but still WMI was causing problems. Went to the event viewer, but this time the PID didn't match anything on the task manager services toolbar. I assume it is some other HP service that is running. I don't know anything about computers, but it is clear there is some issue with HP's programs that is doing something.
    mercredi 2 janvier 2019 23:27
  • This is a very old thread and as far as I know this has never been resolved.  The HP background programs may be causing some of the issues.  I don't have an HP system, but I do have an HP Laser Printer so I have HP programs running on my system also.  I never researched that side of the problem.  I was able to get WMIDiag.vbs to run error free by adding MOF classes that were missing and manipulating other files and ACLs.  WMIDiag.vbs is the best option that Microsoft provided to verify that WMI is running correctly.  I had to make some modifications to the program to get it to run perfectly on Windows 10 various versions, but even then the 5858 errors continue to be generated in the WMI-Activity event log.  It appears that many of the 5858 errors are caused by WMI timing issues where a device or process may be busy.  They can be ignored.  Good luck clearing up the errors.
    samedi 5 janvier 2019 02:01
  • HI
    I find these documents.

    WMI-Activity Event 5858 logged frequently with ResultCode = 0x80041032

    https://support.microsoft.com/en-sg/help/3124914/wmi-activity-event-5858-logged-frequently-with-resultcode-0x80041032

    New WMI arbitrator behavior in Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
    https://support.microsoft.com/en-sg/help/4096063/new-wmi-arbitrator-behavior-in-windows-server


    Best Regards
    Andy YOU
    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    mercredi 3 juillet 2019 05:18
  • I am having this problem, too, and it relates to Intel IPROSetMonitor.exe calling an event, where the filter of the task fails.  To identify what is causing the problem on your system, the output of the error message has some information.  If you dig a little deeper, and get the ClientProcessID, you can use that in Task Manager on the running system to find the program calling for data.  I found the xml view to be quick and easy.  In Task Manager, be sure that the ID column is visible.  Right Click on a column heading and click the ID button to display the process ID.

    This will tell you what program is having an issue.  I can't go further into why this happens because others are still trying to figure this out for a long while now.

    The issue at hand on my end is still an investigation.  I am applying driver updates for the NIC, and I had to delete my vNIC to be able to uninstall the Intel Network Connection software before I could actually get the upgraded drivers to install on the Windows Server 2012R2 system.

    Hope this helps someone identify what program is having this issue of numerous WMI 


    dimanche 28 juillet 2019 04:24