Newly installed Windows 2012 R2 server throws the following event roughly every 3 minutes:
Session "" failed to start with the following error: 0xc0000022
The PID referenced in the event points to WmiPrvSE.exe running as NETWORK SERVICE. Is there something obvious I'm missing because I'm not sure where to go with the information I found so far. I already did my fair sharing of Binggling and everything I find doesn't apply or doesn't fix the problem.
More information: If I run procmon against WmiPrvSE and wait for the event to show up again, the only thing I see is the following:
Is there a way to backtrace what networking component/driver/module/whatever that is attempting to do this? This feels like an HP problem, but I'm gonna have to prove it to them before they'll do anything. Sigh...
I have been plagued by the very same problem on HP DL3xx Gen8 servers newly provisioned w/ W2012r2 and the following is what I have found:
1. The problem is caused by the "HP Insight Management WBEM Provider for Windows".
2. WBEM generates these errors only when you have configured Microsoft NIC teams.
3. To resolve this issue, you can either not use teamed NIC's, or simply uninstall HP's WBEM provider and use the "HP Proliant Agentless Management Service".
4. HP support is totally clueless about the problems associated with their WBEM provider service.
Hope this simple post saves other admins a lot of grief.
Same issue here on HP DL360p Gen8 server running Windows 2012. I had a single 2 port NIC configured as a team, and all was well. Then I had to add a second physical adapter. That one has 2 ports as well, but does not have teaming configured, nor is it part of the primary team. Removing WBEM providers solved the problem. WBEM was the data source for the HP System Management Homepage, so without it the SMH is blank. Now I need to setup SNMP. :-(
Well ping HP, we will see how it goes.
Microsoft and HP recently responded to this harmless event log entry. You can find the responses and the workaround here:
Using this workaround stopped the event entry.