attached is the text file with the log.
thanks,
j alfredo
Main Topics
Browse All TopicsHi everyone,
i managed several sbs 2003 for my clients. After a power failure one of my servers that runs SBS 2003 keeps logging many errors on the event viewer due to WMI (Windows Management Instrumentation) not being able to connect . Example of erros are:
1. Windows couldn't log the RSoP (Resultant Set of Policies) session. An attempt to connect to WMI failed.
2. The MAD Monitoring thread was unable to connect to WMI, error '0x80041002'.
3. Windows cannot perform filter check for Group Policy object CN={5E...}, CN=Policies, etc.
A few components don't work, SBS Windows Backups (using NTBackup), and Monitoring and Reporting stop working too.
Everything else seems to work on my server, exchange, Blackberry Professional, etc.
I always find some type of solution online but after doing research for many days i can't find a convincing resolutino.
Some mentioned to delete C:\Windows\System32\Wbem\R
Going to my services.msc and finding Windows Management Instrumentation i see the service started, but doing a right click, going to properties, dependencies, i get the error: WMI: Not found.
thanks in advance.
J. Alfredo
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
also, here is a copy of the wmi log:
.1405 21:22:53 (0) ** WMIDiag v2.0 started on Wednesday, November 04, 2009 at 21:22.
.1406 21:22:53 (0) **
.1407 21:22:53 (0) ** Copyright (c) Microsoft Corporation. All rights reserved - January 2007.
.1408 21:22:53 (0) **
.1409 21:22:53 (0) ** This script is not supported under any Microsoft standard support program or service.
.1410 21:22:53 (0) ** The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
.1411 21:22:53 (0) ** implied warranties including, without limitation, any implied warranties of merchantability
.1412 21:22:53 (0) ** or of fitness for a particular purpose. The entire risk arising out of the use or performance
.1413 21:22:53 (0) ** of the scripts and documentation remains with you. In no event shall Microsoft, its authors,
.1414 21:22:53 (0) ** or anyone else involved in the creation, production, or delivery of the script be liable for
.1415 21:22:53 (0) ** any damages whatsoever (including, without limitation, damages for loss of business profits,
.1416 21:22:53 (0) ** business interruption, loss of business information, or other pecuniary loss) arising out of
.1417 21:22:53 (0) ** the use of or inability to use the script or documentation, even if Microsoft has been advised
.1418 21:22:53 (0) ** of the possibility of such damages.
.1419 21:22:53 (0) **
.1420 21:22:53 (0) **
.1421 21:22:53 (0) ** --------------------------
.1422 21:22:53 (0) ** --------------------------
.1423 21:22:53 (0) ** --------------------------
.1424 21:22:53 (0) **
.1425 21:22:53 (0) ** --------------------------
.1426 21:22:53 (0) ** Windows Server 2003 - No service pack - 32-bit (3790) - User 'IC\ADMINISTRATOR' on computer 'ICMAIL'.
.1427 21:22:53 (0) ** --------------------------
.1428 21:22:53 (0) ** Environment: ..........................
.1429 21:22:53 (0) ** There are no missing WMI system files: ..........................
.1430 21:22:53 (0) ** There are no missing WMI repository files: ..........................
.1431 21:22:53 (0) ** WMI repository state: ..........................
.1432 21:22:53 (0) ** BEFORE running WMIDiag:
.1433 21:22:53 (0) ** The WMI repository has a size of: ..........................
.1434 21:22:53 (0) ** - Disk free space on 'C:': ..........................
.1435 21:22:53 (0) ** - INDEX.BTR, 2580480 bytes, 10/2/2009 1:37:53 PM
.1436 21:22:53 (0) ** - MAPPING.VER, 4 bytes, 11/2/2009 8:10:04 PM
.1437 21:22:53 (0) ** - MAPPING1.MAP, 15016 bytes, 11/2/2009 8:10:04 PM
.1438 21:22:53 (0) ** - MAPPING2.MAP, 15016 bytes, 11/2/2009 8:09:04 PM
.1439 21:22:53 (0) ** - OBJECTS.DATA, 28311552 bytes, 10/2/2009 1:37:53 PM
.1440 21:22:53 (0) ** AFTER running WMIDiag:
.1441 21:22:53 (0) ** The WMI repository has a size of: ..........................
.1442 21:22:53 (0) ** - Disk free space on 'C:': ..........................
.1443 21:22:53 (0) ** - INDEX.BTR, 2580480 bytes, 10/2/2009 1:37:53 PM
.1444 21:22:53 (0) ** - MAPPING.VER, 4 bytes, 11/2/2009 8:10:04 PM
.1445 21:22:53 (0) ** - MAPPING1.MAP, 15016 bytes, 11/2/2009 8:10:04 PM
.1446 21:22:53 (0) ** - MAPPING2.MAP, 15016 bytes, 11/2/2009 8:09:04 PM
.1447 21:22:53 (0) ** - OBJECTS.DATA, 28311552 bytes, 10/2/2009 1:37:53 PM
.1448 21:22:53 (0) ** --------------------------
.1449 21:22:53 (0) ** Windows Firewall: ..........................
.1450 21:22:53 (0) ** --------------------------
.1451 21:22:53 (0) ** DCOM Status: ..........................
.1452 21:22:53 (0) ** WMI registry setup: ..........................
.1453 21:22:53 (0) ** INFO: WMI service has dependents: ..........................
.1454 21:22:53 (0) ** - Exchange Management Service (MSEXCHANGEMGMT, StartMode='Automatic')
.1455 21:22:53 (0) ** => If the WMI service is stopped, the listed service(s) will have to be stopped as well.
.1456 21:22:53 (0) ** Note: If the service is marked with (*), it means that the service/application uses WMI but
.1457 21:22:53 (0) ** there is no hard dependency on WMI. However, if the WMI service is stopped,
.1458 21:22:53 (0) ** this can prevent the service/application to work as expected.
.1459 21:22:53 (0) **
.1460 21:22:53 (0) ** RPCSS service: ..........................
.1461 21:22:53 (0) ** WINMGMT service: ..........................
.1462 21:22:53 (0) ** --------------------------
.1463 21:22:53 (0) ** WMI service DCOM setup: ..........................
.1464 21:22:53 (0) ** WMI components DCOM registrations: ..........................
.1465 21:22:53 (0) ** WMI ProgID registrations: ..........................
.1466 21:22:53 (0) ** WMI provider DCOM registrations: ..........................
.1467 21:22:53 (0) ** WMI provider CIM registrations: ..........................
.1468 21:22:53 (0) ** WMI provider CLSIDs: ..........................
.1469 21:22:53 (0) ** WMI providers EXE/DLL availability: ..........................
.1470 21:22:53 (0) ** --------------------------
.1471 21:22:53 (0) ** Overall DCOM security status: ..........................
.1472 21:22:53 (0) ** Overall WMI security status: ..........................
.1473 21:22:53 (0) ** - Started at 'Root' --------------------------
.1474 21:22:53 (0) ** WMI permanent SUBSCRIPTION(S): ..........................
.1475 21:22:53 (0) ** WMI TIMER instruction(s): ..........................
.1476 21:22:53 (1) !! ERROR: WMI ADAP status: ..........................
.1477 21:22:53 (0) ** You can start the WMI AutoDiscovery/AutoPurge (ADAP) process to resynchronize
.1478 21:22:53 (0) ** the performance counters with the WMI performance classes with the following commands:
.1479 21:22:53 (0) ** i.e. 'WINMGMT.EXE /CLEARADAP'
.1480 21:22:53 (0) ** i.e. 'WINMGMT.EXE /RESYNCPERF'
.1481 21:22:53 (0) ** The ADAP process logs informative events in the Windows NT event log.
.1482 21:22:53 (0) ** More information can be found on MSDN at:
.1483 21:22:53 (0) ** http://msdn.microsoft.com/
.1484 21:22:53 (1) !! ERROR: WMI MONIKER CONNECTION errors occured for the following namespaces: ..........................
.1485 21:22:53 (0) ** - Root, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
.1486 21:22:53 (0) **
.1487 21:22:53 (1) !! ERROR: WMI CONNECTION errors occured for the following namespaces: ..........................
.1488 21:22:53 (0) ** - Root, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
.1489 21:22:53 (0) ** - Root, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
.1490 21:22:53 (0) ** - Root/Default, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
.1491 21:22:53 (0) ** - Root/CIMv2, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
.1492 21:22:53 (0) ** - Root/WMI, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
.1493 21:22:53 (0) **
.1494 21:22:53 (0) ** WMI GET operations: ..........................
.1495 21:22:53 (0) ** WMI MOF representations: ..........................
.1496 21:22:53 (0) ** WMI QUALIFIER access operations: ..........................
.1497 21:22:53 (0) ** WMI ENUMERATION operations: ..........................
.1498 21:22:53 (0) ** WMI EXECQUERY operations: ..........................
.1499 21:22:53 (0) ** WMI GET VALUE operations: ..........................
.1500 21:22:53 (0) ** WMI WRITE operations: ..........................
.1501 21:22:53 (0) ** WMI PUT operations: ..........................
.1502 21:22:53 (0) ** WMI DELETE operations: ..........................
.1503 21:22:53 (0) ** WMI static instances retrieved: ..........................
.1504 21:22:53 (0) ** WMI dynamic instances retrieved: ..........................
.1505 21:22:53 (0) ** WMI instance request cancellations (to limit performance impact): ..........................
.1506 21:22:53 (0) ** --------------------------
.1507 21:22:53 (0) **
.1508 21:22:53 (0) ** 6 error(s) 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found
.1509 21:22:53 (0) ** => This error is typically a WMI error. This WMI error is due to:
.1510 21:22:53 (0) ** - a missing WMI class definition or object.
.1511 21:22:53 (0) ** (See any GET, ENUMERATION, EXECQUERY and GET VALUE operation failures).
.1512 21:22:53 (0) ** You can correct the missing class definitions by:
.1513 21:22:53 (0) ** - Manually recompiling the MOF file(s) with the 'MOFCOMP <FileName.MOF>' command.
.1514 21:22:53 (0) ** Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.
.1515 21:22:53 (0) ** (This list can be built on a similar and working WMI Windows installation)
.1516 21:22:53 (0) ** The following command line must be used:
.1517 21:22:53 (0) ** i.e. 'WMIDiag CorrelateClassAndProvider'
.1518 21:22:53 (0) ** - a WMI repository corruption.
.1519 21:22:53 (0) ** In such a case, you must rerun WMIDiag with 'WriteInRepository' parameter
.1520 21:22:53 (0) ** to validate the WMI repository operations.
.1521 21:22:53 (0) ** Note: ENSURE you are an administrator with FULL access to WMI EVERY namespaces of the computer before
.1522 21:22:53 (0) ** executing the WriteInRepository command. To write temporary data from the Root namespace, use:
.1523 21:22:53 (0) ** i.e. 'WMIDiag WriteInRepository=Root'
.1524 21:22:53 (0) ** - If the WriteInRepository command fails, while being an Administrator with ALL accesses to ALL namespaces
.1525 21:22:53 (0) ** the WMI repository must be reconstructed.
.1526 21:22:53 (0) ** Note: The WMI repository reconstruction requires to locate all MOF files needed to rebuild the repository,
.1527 21:22:53 (0) ** otherwise some applications may fail after the reconstruction.
.1528 21:22:53 (0) ** This can be achieved with the following command:
.1529 21:22:53 (0) ** i.e. 'WMIDiag ShowMOFErrors'
.1530 21:22:53 (0) ** Note: The repository reconstruction must be a LAST RESORT solution and ONLY after executing
.1531 21:22:53 (0) ** ALL fixes previously mentioned.
.1532 21:22:53 (2) !! WARNING: Static information stored by external applications in the repository will be LOST! (i.e. SMS Inventory)
.1533 21:22:53 (0) **
.1534 21:22:53 (0) ** --------------------------
.1535 21:22:53 (0) ** WMI Registry key setup: ..........................
.1536 21:22:53 (0) ** --------------------------
.1537 21:22:53 (0) ** --------------------------
.1538 21:22:53 (0) ** --------------------------
.1539 21:22:53 (0) ** --------------------------
.1540 21:22:53 (0) **
.1541 21:22:53 (0) ** --------------------------
.1542 21:22:53 (0) ** --------------------------
.1543 21:22:53 (0) ** --------------------------
.1544 21:22:53 (0) **
.1545 21:22:53 (0) ** ERROR: WMIDiag detected issues that could prevent WMI to work properly!. Check 'C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOC
.1546 21:22:53 (0) **
.1547 21:22:53 (0) ** WMIDiag v2.0 ended on Wednesday, November 04, 2009 at 21:22 (W:35 E:13 S:1).
my backups stopped working when this wmi error started happening.
Meaning, the backups are still running and overwriting my old good backups with incomplete 2kb backup files.
in other words i have not backup of my system state.
my next step is to rebuild it then.
any specific instructions on how to do that? or should i just delete/raname my c:\windows\system32\wbem\R
thanks,
Yeah, the brute force approach of just stopping the service (Net stop winmgmt), renaming the respository directory, and restarting the service (Net start winmgmt) will normally suffice. (you don't actually have to reboot).
As you correctly pointed out... this is the last resort, but unfortunately, we're at that point now.
It generally takes a minute or two to recompile the repository... but there's nothing to do but sit back and wait.
Business Accounts
Answer for Membership
by: grayePosted on 2009-11-04 at 06:47:08ID: 25739788
Well, the first order of business is to download and run the WMI Diagnostic tool on that server. Then post the results here for us to see
http://www.microsoft.co m/download s/details. aspx? famil yid=d7ba3c d6-18d1-4d 05-b11e-4c 64192ae97d &displayla ng=en