• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1142
  • Last Modified:

Windows Small Business Server 2003 w/SP2 WMI Errors

I have recently started receiving, on logon, numerous messages stating "WMI encountered a problem and needed to close.  In my event logs I am receiving error messages every few seconds.  I have tried a few different actions, however I am, and have been unable to fix this.  The errors and eventlogs are as follows;
(I get these every 10 seconds approximately)
Event 1000
Faulting application exwmi.dll, version 6.5.7638.1, stamp 430e7361, faulting module ntdll.dll, version 5.2.3790.3959, stamp 45d70ad8, debug? 0, fault address 0x0001a379.

(I get these every 2 minutes)
Event 1000
Faulting application wmiprvse.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.3959, fault address 0x0001a379.

(I get these every 2 minutes)
Event 9102
The MAD Monitoring thread was unable to read the state of cluster resources, error '0x800706be'.

followed by the following 2 messages
Event 9095
The MAD Monitoring thread is initializing.

Event 9096
The MAD Monitoring thread is initialized.

Any suggestions or help would be greatly appreciated.
0
thebside
Asked:
thebside
  • 17
  • 8
  • 2
3 Solutions
 
Michael PfisterCommented:
0
 
thebsideAuthor Commented:
Ok, well the first item you gave me in this list didn't pertain to me as I didn't have that error.  However, I followed it through in case there was something that you thought may help me overall.  No Change...

I have run the diagnosis utility and I am attaching the report, as well as the log file.

I am unsure as to how to correct the errors that it is showing.  
WMIDiag.xls
WMIDIAG-V2.0-2003-.SRV.RTM.32-IS.TXT
0
 
thebsideAuthor Commented:
Well, this is killing me!  Is there no one on this forum that has ever seen this, or could point me in a direction?
0
Cloud Class® Course: Microsoft Azure 2017

Azure has a changed a lot since it was originally introduce by adding new services and features. Do you know everything you need to about Azure? This course will teach you about the Azure App Service, monitoring and application insights, DevOps, and Team Services.

 
Michael PfisterCommented:
What makes me nervous is:

34406 09:54:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34407 09:54:50 (0) ** Windows Server 2003 - No service pack - 32-bit (3790) - User 'INTEGRATED\ADMINISTRATOR' on computer 'ISSVR01'.
34408 09:54:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

No service pack? Is the tool lying?
0
 
thebsideAuthor Commented:
Sorry for the long break from this question, I have been unavailable.
mpfister, yes the tool is lying as this system is upto date with service pack 2.  Also Exchange is up to date with the most current service pack.  I saw that also, just didn't know what to make of it.
0
 
thebsideAuthor Commented:
Anyone?  
0
 
Michael PfisterCommented:
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
If you still haven't resolved this, please see this newsgroup post about this error:
http://groups.google.com/group/microsoft.public.windows.server.sbs/msg/17fba053e482d2ea

Basically you might need to re-register WMI.

Jeff
TechSoEasy
0
 
thebsideAuthor Commented:
I appreciate the suggestion, however I have already done this.  I will give it another whirl.
0
 
thebsideAuthor Commented:
This question is not abandoned, I just haven't received any help.  My server is still having the same issues.  I will close the question, though, as it appears no one can answer it.
0
 
Michael PfisterCommented:
Last shot: maybe its a memory problem in WMI.
See
http://blogs.technet.com/askperf/archive/2008/09/16/memory-and-handle-quotas-in-the-wmi-provider-service.aspx 
on how to increase the available memory for WMI Provider Service.
0
 
thebsideAuthor Commented:
Sorry for the absence again, I was away for a bit.  
mpfister, I am going to take a look at your suggestion.

Tech So Easy;
Although the comment that I accepted didn't answer my overall question, they did in fact help me immensely along the way.  I apologize if I mishandled the way these questions are suppose to be closed, and cleaned up.
0
 
thebsideAuthor Commented:
Rebooting now, so I guess we will see whether increasing the available Memory helps.
0
 
thebsideAuthor Commented:
Ok, I cleared my event logs and rebooted the server.  I received;

4 Events - Category (100)  Event ID: 1004
Reporting queued error: faulting application wmiprvse.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.3959, fault address 0x0001a379.

Event ID: 1000
Faulting application exwmi.dll, version 6.5.7638.1, stamp 430e7361, faulting module ntdll.dll, version 5.2.3790.3959, stamp 45d70ad8, debug? 0, fault address 0x0001a379.

Event ID: 1000
Faulting application wmiprvse.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.3959, fault address 0x0001a379.

Event ID: 5603
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the HostingModel property.  This provider will be run using the LocalSystem account.  This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.  Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Event ID: 1000
Faulting application wmiprvse.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.3959, fault address 0x0001a379.


0
 
Michael PfisterCommented:
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/SBS_Small_Business_Server/Q_23240771.html
Have you configured your AV software to exclude the Exchange databases?
0
 
Michael PfisterCommented:
Vee_Mod, can you keep the question open for another couple of days?
0
 
thebsideAuthor Commented:
I am still here, I just travel quite a bit for work so I just got back to my office and I will be catching up on these.  Sorry for the delay.
0
 
thebsideAuthor Commented:
Well, I can definitely say that not all of these were excluded from the Anti virus software.  I am going to go through and make the changes needed and we will go from there.  This has been mind boggling, and again I apologize to all of you that have been trying to help me with this for my late responses.
0
 
thebsideAuthor Commented:
Ok,
So I have not made these changes to the Antivirus Software and ran a Scan. The scan did find a few bugs, so now would I start over with the steps that I ran in the post from: http:#21846827

thanks.
0
 
thebsideAuthor Commented:
Will do, thanks.
0
 
Michael PfisterCommented:
If your system is infected with a virus, I'd recommend to scan it with at least one scanner of a different brand (with current signatures of course). Best a scanner with root kit detecion capabilities or a seperate root kit scanner (i.e. Blacklight from F-Secure).
Also run a Spybot S&D (www.spybot.com) scan. After cleaning run a Hijackthis report http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php and post the resulting log file.
0
 
thebsideAuthor Commented:
Will do.  I am starting the Scan tonight and will post the Hijack this in the morning.
0
 
thebsideAuthor Commented:
Ok,
So here is the skinny.  Being that there are so many good deals going on, we abandoned this server and have migrated everything from a Small Business Server to a Windows 2003 R2 Server.  

mpfister - We did run several scans on the machine and they all came up with nothing.  No rootkits, not anything.  I would have posted a Hijack this Log, however we took the time that we were using to run these tests and put it towards migrating off of Small Business Server.

How can I go about awarding my points to mpfister as they have stuck this thing through with me, even with no solution.

thanks.
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
You don't award points when a solution wasn't provided.  The proper thing to do in this case is request that the question be deleted since you basically abandonded the initial issue.

Jeff
TechSoEasy

0
 
thebsideAuthor Commented:
Jeff,
Thanks for you help.  It appears that the options I have are to accept and award points, or delete the question.  I would hate to delete the question as there are numerous items in here that may be of help to someone else.  

Is there a way to close it without deleting?  
Sorry to be such a pain with this, this project was a nightmare.  Thank you TechSoEasy, and MPFISTER for all your help.  

thanks again,
Brian
0
 
thebsideAuthor Commented:
The resolution was that the CIO decided to upgrade all the servers to Windows Server 2003 R2, however there in invaluable suggestions in the following comments.  Regardless of if this completely solved my issue, it definitely had me going in the right direction.

21846827
22860480
22937135

Had our CIO not decided what he did while I was away from the team I am sure that we would have been able to reconcile this.  

Either way,
I can't say thank you enough to all of you for all your help.  And if the question has to be deleted, that is the way it goes.
0
 
Michael PfisterCommented:
Thanks for the nice words, Brian. And don't worry, there are enough points to earn ...

Michael
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Introducing Cloud Class® training courses

Tech changes fast. You can learn faster. That’s why we’re bringing professional training courses to Experts Exchange. With a subscription, you can access all the Cloud Class® courses to expand your education, prep for certifications, and get top-notch instructions.

  • 17
  • 8
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now