Advice on WMI / WINMGMT event logs after IIS reinstall

Also I keep getting an email from the server with this information in it:

SERVERNAME has reported a Error.  Reported status is:
Queues - Unknown
Drives - Unknown
Services - Error
Memory - Unknown
CPU - Unknown

Regards

GuyAdams

Have you installed Windows Server 2003 Service Pack 1 without installing the remainder of the required SBS Service Pack 1 components?

http://support.microsoft.com/kb/915148

http://sbsurl.com/sp1

Jeff
TechSoEasy

Originally before I had to reinstall IIS, I installed SP1, all 5 parts.

Then I reinstalled IIS, Exchange and Sharepoint and only installed the 2nd part (sharepoint sp1) and exchange SP2.

When I reinstalled SBS monitoring, I installed it from the cd3 folder of the SP1 for SBS.

Thanks for your response Jeff.

Regards

Guy_Adams

If you've reinstalled all that stuff you need to repply SBS SP1 again.  (Any time you reinstall a component you have to reapply SBS SP1, just the SBS portion, not all 5 parts).  Because of this, I've actually just stored the Service Pack installation files on my server's hard drive in the same way you'd have an i386 folder with the OS install files.

Jeff
TechSoEasy

What's annoying is the fact since posting this the the issue seems to have stopped. Although I have still had two of the strange emails as I mentioned above. Dont understand why the server would send that email but not log any errors in the event log?

I will reapply SBS SP1 and see if this irons the issue out.

Regards

Guy Adams

That email doesn't seem as though it is coming from the SBS Health Monitor.  Can you look at the headers on the email and post those here?

Jeff
TechSoEasy

Header information seems fine:

Microsoft Mail Internet Headers Version 2.0
Received: from SERVERNAME ([192.168.110.2]) by domainname.com with Microsoft SMTPSVC(6.0.3790.1830);
       Sun, 18 Jun 2006 21:13:00 +0100
Date: Sun, 18 Jun 2006 20:13:00 GMT
To: myemail@domainname.com
Cc:
From: <WMI@SERVERNAME>
Sender: <WMI@NAMESERVER>
Reply-To:
Subject: Error on SERVERNAME
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="- - =_HH_= - ---"
Return-Path: WMI@SERVERNAME
Message-ID: <SERVERNAME2gRs0000001c@domainname.com>
X-OriginalArrivalTime: 18 Jun 2006 20:13:00.0323 (UTC) FILETIME=[98C33730:01C69313]

--- - =_HH_= - ---
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit


--- - =_HH_= - -----

I checked the event logs and no critical errors or warnings.

Just thought I would let you know, not long after I reinstalled IIS, I got a load of database errors for DHCP in the system log, they all said consult the DHCP reports, I did so and there was nothing in them to indicate an issue. This behaviour has since stopped. There has been no problems with DHCP.

I expect a few errors when you reinstall such a massive piece of a server, I mean IIS, Exchange, Sharepoint and WSUS is quite a large part of the server and this is what I put the DHCP errors down to.

I will re-apply SP1 today.

Regards

GuyAdams

WHOA!!!!  WSUS???? You seemed to have skipped that part in the beginning!!!

Actually, you've not been very revealing at all about what's changed lately... it's like pulling teeth to get this stuff outta you!  :-)

By chance, did you follow the SBS Guidelines for installing WSUS???  Please see http://sbsurl.com/wsus for details.  Not following these guidelines will cause all sorts of errors.  And I've reinstalled IIS, Exchange and Shrarepoint many times and there should NOT be any errors other than immediatly during and after the reinstall.

Jeff
TechSoEasy

P. S.  a newsgroup post seems to have included this info... which I just now saw:  http://snipurl.com/ryus

Jeff
TechSoEasy

Jeff, thats not my post.

I have several none production SBS servers which I have been using for test labs, our network has only one SBS which acts as a GC, with other 2003 servers as secondary DC's.

The reason I had to reinstall IIS was because I have just taken this network on, the admin before this was a part time admin who as It turned out didnt really seem to know much. I've been trying to tidy some of the mess he's left but to be honest i was 50/50 as to if it would have been easier to reinstall 2 of the 5 servers completely.

IIS was in a mess and nothing much worked, no OWA, no OMA, no monitoring and reporting and a IUSR issue. Slowly but surely I have managed to get IIS sorted, with help from others, especially EE. Iam no expert with IIS or Sharepoint.

The DHCP errors came as a surprise to me, and have vanished now, the WMI / WINMGMT event log error have also now ceased, its just the email which I cannot figure out.

I hope this clears things a little.

Regards

GuyAdams

When I first started trouble shooting IIS, I tried reinstalling it then restoring the metabase but the issues came back, so I then reinstalled IIS and all the applications that ran on it:

IIS
Exchange
Sharepoint
WSUS
Symantec Mail Security

Sorry I did not include this information, my fault.

Regards

GuyAdams

Guy,

I truly understand your pain... especially when coming in and having to deal with all that.  The majority of my consulting practice these days is reinstalling SBS's that have been wrongly installed by apparently highly skilled individuals that had no concept of SBS.  Even though you've mostly figured things out, I hope you don't mind a bit of further info/review...

I would point out... that your comment "I am no expert with IIS or Sharepoint." boarders on this type of issue though... even if ever so slightly, and given that you seem quite knowledgeable about a number of other things and I'm probably reading A LOT into your quick tidbits of a post... so bear with me.

SBS requires that you pretty much check all of your enterprise server knowledge at the door.  Because SBS contains modules and roles that you would never combine in a single standard server it is managed much differently... EVERYTHING needs to be done the SBS way if there is an SBS way to do it.  Even though SBS is basically a preconfigured server, it unfortunately does not block the ability to configure something manually that could break something else.  So, it's even more important that if you are managing an SBS machine and you have other basic server management knowledge that you make sure you keep up with SBS information and announcements.

So... take a look at http://sbsurl.com/itpro and http:Q_21831460.html which has a host of other links that will provide good SBS info.

And... to help you solve the email issue... that message is NOT coming from the SBS Monitoring... it looks as though you may have another DNS server on your network???  (I'm guessing because of the SENDER being WMI@NAMESERVER -- this is NOT what a regular SBS alert would come from... if you have any available to you, compare the headers).

I'd take a look in your Exchange logs and see if you can track down the actual machine that's sending these out.

Jeff
TechSoEasy

Jeff,

Thanks for the advice, I love SBS, its a great product and although my knowledge of Windows Server 2000/2003 is good, SBS has been a learning curve for me, hence two none production test lab SBS servers and as little work as possible completed on the production server.

The headers I removed the servername / domain / email information from and used SERVERNAME and DOMAINNAME as replacements.

There are other DNS servers on the network but the email headers confirm this email was received from the SBS.

I have incorrectly changed one of the header entries, it was:

<WMI@NAMESERVER>

it should of been

<WMI@SERVERNAME>

That was my fault.

Its just really thrown me this, you would think that if you received an email saying there is an error then something would be posted in the event logs too.

Thanks for your help / advice so far Jeff, it is much appreciated.

Regards

Guy Adams

By the way, I enjoyed reading your articles on 'unified platform' I think since taking on an SBS I have begun to understand that more and more.

Thanks

Guy_Adams

Even if your NAMESERVER/SERVERNAME was a typo... I'd still suggest that these are not coming form the SBS's Monitoring.  They very well may be going through Exchange though.... I think they are originating from another server on the network.

SBS Monitoring Alerts do not include a SENDER field, and by default they generally show 127.0.0.1 as the originating domain, not the actual private IP.

Here's a sample:

Microsoft Mail Internet Headers Version 2.0
Received: from sbs2003 ([127.0.0.1]) by sampleclient.com with Microsoft SMTPSVC(6.0.3790.1830);
       Tue, 13 Jun 2006 21:59:51 -0700
thread-index: AcaPb15SoQHHlfrrSnWpcIKxMPsrow==
Thread-Topic: Routing and Remote Access Alert on SBS2003
From: "Sample Client" <Administrator@sampleclient.com>
To: <recipient@destination.com>
Cc:
Bcc:
Subject: Routing and Remote Access Alert on SBS2003
Date: Tue, 13 Jun 2006 21:59:51 -0700
Message-ID: <000001c68f6f$5e52e2f0$0210a8c0@sampleclient.local>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft CDO for Exchange 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2663
Return-Path: Administrator@sampleclient.com
X-OriginalArrivalTime: 14 Jun 2006 04:59:51.0405 (UTC) FILETIME=[5E5EC9D0:01C68F6F]

These are fairly standard across all SBS's that I manage.

Jeff
TechSoEasy

I appreciate what you are saying but why would it say:

Sender: <WMI@OUR_SBS_SERVERNAME>

I'm currently check the logs of the other DC's for WMI / WINMGMT logs.

Regards

Guy_Adams

well, if it does have your sbs servername, then perhaps there is some other wmi monitoring program running on the server?

Jeff
TechSoEasy

I have just located the WMI logs manual and found the following:

(Fri Jun 16 07:39:06 2006.221793968) : Received Event
(Fri Jun 16 07:39:14 2006.221802296) : Received Event
(Fri Jun 16 07:46:42 2006.209812) : WDM call returned error: 4200
(Fri Jun 16 07:46:43 2006.210812) : Received Event
(Fri Jun 16 07:46:43 2006.210828) : CreateFile FAILED for filename:
(Fri Jun 16 07:46:43 2006.210859) : inetinfo.exe(Fri Jun 16 07:46:43 2006.210859) :
(Fri Jun 16 07:46:43 2006.210859) : : GetlastError returned 2
(Fri Jun 16 07:46:49 2006.217453) : Received Event
(Fri Jun 16 07:49:09 2006.357484) : Impersonation failed - Access denied
(Fri Jun 16 07:49:39 2006.387171) : WDM call returned error: 4200
(Fri Jun 16 07:49:40 2006.387750) : CreateFile FAILED for filename:
(Fri Jun 16 07:49:40 2006.387765) : inetinfo.exe(Fri Jun 16 07:49:40 2006.387765) :
(Fri Jun 16 07:49:40 2006.387765) : : GetlastError returned 2
(Fri Jun 16 07:53:12 2006.600062) : CreateFile FAILED for filename:
(Fri Jun 16 07:53:12 2006.600062) : inetinfo.exe(Fri Jun 16 07:53:12 2006.600078) :
(Fri Jun 16 07:53:12 2006.600078) : : GetlastError returned 2
(Fri Jun 16 07:53:12 2006.600078) : WDM call returned error: 4200
(Fri Jun 16 08:06:40 2006.1407625) : Received Event
(Fri Jun 16 08:06:40 2006.1408156) : CreateFile FAILED for filename:
(Fri Jun 16 08:06:40 2006.1408156) : inetinfo.exe(Fri Jun 16 08:06:40 2006.1408171) :
(Fri Jun 16 08:06:40 2006.1408171) : : GetlastError returned 2
(Fri Jun 16 08:06:40 2006.1408171) : CreateFile FAILED for filename:
(Fri Jun 16 08:06:40 2006.1408187) : inetinfo.exe(Fri Jun 16 08:06:40 2006.1408187) :
(Fri Jun 16 08:06:40 2006.1408187) : : GetlastError returned 2
(Fri Jun 16 08:32:53 2006.208484) : WDM call returned error: 4200
(Fri Jun 16 08:32:55 2006.210078) : CreateFile FAILED for filename:
(Fri Jun 16 08:32:55 2006.210078) : inetinfo.exe(Fri Jun 16 08:32:55 2006.210093) :
(Fri Jun 16 08:32:55 2006.210093) : : GetlastError returned 2
(Fri Jun 16 08:32:59 2006.213953) : Received Event
(Fri Jun 16 08:33:08 2006.223453) : Received Event
(Fri Jun 16 08:35:53 2006.388234) : CreateFile FAILED for filename:
(Fri Jun 16 08:35:53 2006.388250) : inetinfo.exe(Fri Jun 16 08:35:53 2006.388250) :
(Fri Jun 16 08:35:53 2006.388250) : : GetlastError returned 2
(Fri Jun 16 08:35:53 2006.388265) : WDM call returned error: 4200
(Fri Jun 16 08:51:32 2006.1326687) : Received Event
(Fri Jun 16 10:21:00 2006.6695265) : Received Event
(Fri Jun 16 10:21:02 2006.6697093) : Received Event
(Fri Jun 16 10:21:02 2006.6697093) : CreateFile FAILED for filename:
(Fri Jun 16 10:21:02 2006.6697109) : CreateFile FAILED for filename:
(Fri Jun 16 10:21:02 2006.6697109) : inetinfo.exe(Fri Jun 16 10:21:02 2006.6697109) :
(Fri Jun 16 10:21:02 2006.6697109) : : GetlastError returned 2
(Fri Jun 16 10:21:02 2006.6697140) : inetinfo.exe(Fri Jun 16 10:21:02 2006.6697140) :
(Fri Jun 16 10:21:02 2006.6697140) : : GetlastError returned 2
(Fri Jun 16 10:32:22 2006.7377593) : Received Event
(Fri Jun 16 10:57:56 2006.8911578) : Received Event
(Fri Jun 16 10:58:22 2006.8936765) : WDM call returned error: 4200
(Fri Jun 16 10:59:11 2006.8985906) : Received Event
(Fri Jun 16 11:04:34 2006.9309500) : Received Event
(Fri Jun 16 11:07:02 2006.9457484) : Impersonation failed - Access denied
(Fri Jun 16 11:08:03 2006.9518171) : WDM call returned error: 4200
(Fri Jun 16 11:08:04 2006.9519625) : Impersonation failed - Access denied
(Fri Jun 16 11:08:06 2006.9521593) : WDM call returned error: 4200
(Fri Jun 16 11:12:07 2006.9762328) : WDM call returned error: 4200
(Fri Jun 16 11:14:30 2006.9905656) : Impersonation failed - Access denied
(Fri Jun 16 11:15:14 2006.9949734) : WDM call returned error: 4200
(Fri Jun 16 11:16:01 2006.9995906) : Received Event
(Fri Jun 16 11:16:06 2006.10001093) : CreateFile FAILED for filename:
(Fri Jun 16 11:16:06 2006.10001093) : inetinfo.exe(Fri Jun 16 11:16:06 2006.10001093) : Received Event
(Fri Jun 16 11:16:06 2006.10001187) :
(Fri Jun 16 11:16:06 2006.10001593) : : GetlastError returned 2
(Fri Jun 16 11:16:06 2006.10001640) : CreateFile FAILED for filename:
(Fri Jun 16 11:16:06 2006.10001640) : inetinfo.exe(Fri Jun 16 11:16:06 2006.10001640) :
(Fri Jun 16 11:16:06 2006.10001656) : : GetlastError returned 2
(Fri Jun 16 11:16:23 2006.10017890) : Received Event
(Fri Jun 16 11:16:24 2006.10019062) : Received Event
(Fri Jun 16 11:19:50 2006.10225468) : Impersonation failed - Access denied
(Fri Jun 16 11:23:17 2006.10431937) : WDM call returned error: 4200
(Fri Jun 16 11:23:47 2006.10462156) : Impersonation failed - Access denied
(Fri Jun 16 11:24:11 2006.10486281) : WDM call returned error: 4200
(Fri Jun 16 11:25:07 2006.10542046) : Received Event
(Fri Jun 16 11:25:12 2006.10547453) : Received Event
(Fri Jun 16 11:25:12 2006.10547453) : CreateFile FAILED for filename:
(Fri Jun 16 11:25:12 2006.10547468) : CreateFile FAILED for filename:
(Fri Jun 16 11:25:12 2006.10547468) : inetinfo.exe(Fri Jun 16 11:25:12 2006.10547468) :
(Fri Jun 16 11:25:12 2006.10547468) : : GetlastError returned 2
(Fri Jun 16 11:25:12 2006.10547500) : inetinfo.exe(Fri Jun 16 11:25:12 2006.10547500) :
(Fri Jun 16 11:25:12 2006.10547500) : : GetlastError returned 2
(Fri Jun 16 11:25:25 2006.10560609) : Received Event
(Fri Jun 16 11:25:26 2006.10561718) : Received Event
(Fri Jun 16 11:29:02 2006.10777281) : Received Event
(Fri Jun 16 11:29:03 2006.10778000) : Received Event
(Fri Jun 16 11:29:03 2006.10778234) : Received Event
(Fri Jun 16 11:29:03 2006.10778765) : Received Event
(Fri Jun 16 11:34:05 2006.11080250) : Received Event
(Fri Jun 16 11:34:05 2006.11080250) : CreateFile FAILED for filename:
(Fri Jun 16 11:34:05 2006.11080265) : CreateFile FAILED for filename:
(Fri Jun 16 11:34:05 2006.11080265) : inetinfo.exe(Fri Jun 16 11:34:05 2006.11080281) : inetinfo.exe(Fri Jun 16 11:34:05 2006.11080281) :
(Fri Jun 16 11:34:05 2006.11080296) :
(Fri Jun 16 11:34:05 2006.11080296) : : GetlastError returned 2
(Fri Jun 16 11:34:05 2006.11080312) : : GetlastError returned 2
(Fri Jun 16 11:34:10 2006.11085531) : Received Event
(Fri Jun 16 11:37:12 2006.11266843) : Received Event
(Fri Jun 16 11:37:16 2006.11270953) : Received Event
(Fri Jun 16 14:42:03 2006.22358390) : Impersonation failed - Access denied
(Fri Jun 16 14:42:18 2006.22373453) : WDM call returned error: 4200
(Fri Jun 16 14:42:18 2006.22373812) : CreateFile FAILED for filename:
(Fri Jun 16 14:42:18 2006.22373812) : inetinfo.exe(Fri Jun 16 14:42:18 2006.22373828) :
(Fri Jun 16 14:42:18 2006.22373828) : : GetlastError returned 2
(Fri Jun 16 14:46:07 2006.22602796) : CreateFile FAILED for filename:
(Fri Jun 16 14:46:07 2006.22602812) : inetinfo.exe(Fri Jun 16 14:46:07 2006.22602812) :
(Fri Jun 16 14:46:07 2006.22602812) : : GetlastError returned 2
(Fri Jun 16 14:46:07 2006.22602828) : WDM call returned error: 4200
(Fri Jun 16 15:23:46 2006.24861421) : Received Event
(Fri Jun 16 15:23:46 2006.24861500) : CreateFile FAILED for filename:
(Fri Jun 16 15:23:46 2006.24861515) : inetinfo.exe(Fri Jun 16 15:23:46 2006.24861531) :
(Fri Jun 16 15:23:46 2006.24861531) : : GetlastError returned 2
(Fri Jun 16 15:23:46 2006.24861546) : CreateFile FAILED for filename:
(Fri Jun 16 15:23:46 2006.24861546) : inetinfo.exe(Fri Jun 16 15:23:46 2006.24861562) :
(Fri Jun 16 15:23:46 2006.24861562) : : GetlastError returned 2
(Fri Jun 16 15:23:47 2006.24862890) : Received Event
(Fri Jun 16 15:26:10 2006.25005890) : Received Event
(Fri Jun 16 15:26:11 2006.25006031) : CreateFile FAILED for filename:
(Fri Jun 16 15:26:11 2006.25006031) : inetinfo.exe(Fri Jun 16 15:26:11 2006.25006046) : CreateFile FAILED for filename:
(Fri Jun 16 15:26:11 2006.25006046) : inetinfo.exe(Fri Jun 16 15:26:11 2006.25006046) :
(Fri Jun 16 15:26:11 2006.25006046) : : GetlastError returned 2
(Fri Jun 16 15:26:11 2006.25006078) :
(Fri Jun 16 15:26:11 2006.25006078) : : GetlastError returned 2
(Fri Jun 16 15:56:47 2006.26842328) : Received Event
(Fri Jun 16 15:56:47 2006.26842531) : CreateFile FAILED for filename:
(Fri Jun 16 15:56:47 2006.26842531) : CreateFile FAILED for filename:
(Fri Jun 16 15:56:47 2006.26842531) : inetinfo.exe(Fri Jun 16 15:56:47 2006.26842531) :
(Fri Jun 16 15:56:47 2006.26842546) : : GetlastError returned 2
(Fri Jun 16 15:56:47 2006.26842562) : inetinfo.exe(Fri Jun 16 15:56:47 2006.26842562) :
(Fri Jun 16 15:56:47 2006.26842562) : : GetlastError returned 2
(Fri Jun 16 15:56:50 2006.26844984) : Received Event
(Fri Jun 16 15:59:38 2006.27013812) : Received Event
(Fri Jun 16 15:59:38 2006.27013812) : CreateFile FAILED for filename:
(Fri Jun 16 15:59:38 2006.27013812) : CreateFile FAILED for filename:
(Fri Jun 16 15:59:38 2006.27013812) : inetinfo.exe(Fri Jun 16 15:59:38 2006.27013828) :
(Fri Jun 16 15:59:38 2006.27013828) : : GetlastError returned 2
(Fri Jun 16 15:59:38 2006.27013843) : inetinfo.exe(Fri Jun 16 15:59:38 2006.27013843) :
(Fri Jun 16 15:59:38 2006.27013843) : : GetlastError returned 2
(Fri Jun 16 16:24:41 2006.28516515) : Received Event
(Fri Jun 16 16:24:41 2006.28516593) : CreateFile FAILED for filename:
(Fri Jun 16 16:24:41 2006.28516609) : CreateFile FAILED for filename:
(Fri Jun 16 16:24:41 2006.28516609) : inetinfo.exe(Fri Jun 16 16:24:41 2006.28516609) :
(Fri Jun 16 16:24:41 2006.28516609) : : GetlastError returned 2
(Fri Jun 16 16:24:41 2006.28516640) : inetinfo.exe(Fri Jun 16 16:24:41 2006.28516640) :
(Fri Jun 16 16:24:41 2006.28516640) : : GetlastError returned 2
(Fri Jun 16 16:24:42 2006.28517140) : Received Event
(Fri Jun 16 16:38:30 2006.29345328) : Received Event
(Fri Jun 16 16:38:30 2006.29345343) : CreateFile FAILED for filename:
(Fri Jun 16 16:38:30 2006.29345390) : CreateFile FAILED for filename:
(Fri Jun 16 16:38:30 2006.29345390) : inetinfo.exe(Fri Jun 16 16:38:30 2006.29345406) : inetinfo.exe(Fri Jun 16 16:38:30 2006.29345406) :
(Fri Jun 16 16:38:30 2006.29345421) :
(Fri Jun 16 16:38:30 2006.29345437) : : GetlastError returned 2
(Fri Jun 16 16:38:30 2006.29345453) : : GetlastError returned 2
(Sun Jun 18 18:36:54 2006.209251250) : Received Event
(Sun Jun 18 18:56:41 2006.210438281) : Received Event
(Sun Jun 18 19:04:35 2006.210911968) : Received Event
(Sun Jun 18 21:11:55 2006.218552437) : Received Event
(Sun Jun 18 21:12:00 2006.218557421) : Received Event

What do you think? There are several WMI logs, most of which have an issue from friday. (IIS reinstall) I'm hoping to have the SBS SP1 reapplied in the next hour I will keep you posted.

Jeff, really appreciate your help.

Regards

Guy_Adams

Ok, I will consult the logs abit further.

SBS SP1 has been reapplied just need to restart.

I usually get 1 or 2 WMI emails a day. So I will have a look through the logs while I wait to see if the reapplied SP has made a difference.

I have accepted your last answer as I appreciate the time and effort you have put into this question.

Regards

Guy_Adams

No Problem... good luck!

Jeff
TechSoEasy