Solved

Windows Small Business Server 2003 w/SP2 WMI Errors

Posted on 2008-06-20
38
1,115 Views
Last Modified: 2011-10-19
I have recently started receiving, on logon, numerous messages stating "WMI encountered a problem and needed to close.  In my event logs I am receiving error messages every few seconds.  I have tried a few different actions, however I am, and have been unable to fix this.  The errors and eventlogs are as follows;
(I get these every 10 seconds approximately)
Event 1000
Faulting application exwmi.dll, version 6.5.7638.1, stamp 430e7361, faulting module ntdll.dll, version 5.2.3790.3959, stamp 45d70ad8, debug? 0, fault address 0x0001a379.

(I get these every 2 minutes)
Event 1000
Faulting application wmiprvse.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.3959, fault address 0x0001a379.

(I get these every 2 minutes)
Event 9102
The MAD Monitoring thread was unable to read the state of cluster resources, error '0x800706be'.

followed by the following 2 messages
Event 9095
The MAD Monitoring thread is initializing.

Event 9096
The MAD Monitoring thread is initialized.

Any suggestions or help would be greatly appreciated.
0
Comment
Question by:thebside
  • 17
  • 8
  • 2
38 Comments
 
LVL 28

Accepted Solution

by:
Michael Pfister earned 500 total points
ID: 21846827
0
 

Author Comment

by:thebside
ID: 21861624
Ok, well the first item you gave me in this list didn't pertain to me as I didn't have that error.  However, I followed it through in case there was something that you thought may help me overall.  No Change...

I have run the diagnosis utility and I am attaching the report, as well as the log file.

I am unsure as to how to correct the errors that it is showing.  
WMIDiag.xls
WMIDIAG-V2.0-2003-.SRV.RTM.32-IS.TXT
0
 

Author Comment

by:thebside
ID: 22016462
Well, this is killing me!  Is there no one on this forum that has ever seen this, or could point me in a direction?
0
 
LVL 28

Expert Comment

by:Michael Pfister
ID: 22023515
What makes me nervous is:

34406 09:54:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34407 09:54:50 (0) ** Windows Server 2003 - No service pack - 32-bit (3790) - User 'INTEGRATED\ADMINISTRATOR' on computer 'ISSVR01'.
34408 09:54:50 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

No service pack? Is the tool lying?
0
 

Author Comment

by:thebside
ID: 22241440
Sorry for the long break from this question, I have been unavailable.
mpfister, yes the tool is lying as this system is upto date with service pack 2.  Also Exchange is up to date with the most current service pack.  I saw that also, just didn't know what to make of it.
0
 

Author Comment

by:thebside
ID: 22382652
Anyone?  
0
 
LVL 28

Expert Comment

by:Michael Pfister
ID: 22385015
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 22585499
If you still haven't resolved this, please see this newsgroup post about this error:
http://groups.google.com/group/microsoft.public.windows.server.sbs/msg/17fba053e482d2ea

Basically you might need to re-register WMI.

Jeff
TechSoEasy
0
 

Author Comment

by:thebside
ID: 22671485
I appreciate the suggestion, however I have already done this.  I will give it another whirl.
0
 

Author Comment

by:thebside
ID: 22850730
This question is not abandoned, I just haven't received any help.  My server is still having the same issues.  I will close the question, though, as it appears no one can answer it.
0
 
LVL 28

Assisted Solution

by:Michael Pfister
Michael Pfister earned 500 total points
ID: 22860480
Last shot: maybe its a memory problem in WMI.
See
http://blogs.technet.com/askperf/archive/2008/09/16/memory-and-handle-quotas-in-the-wmi-provider-service.aspx
on how to increase the available memory for WMI Provider Service.
0
 

Author Comment

by:thebside
ID: 22905432
Sorry for the absence again, I was away for a bit.  
mpfister, I am going to take a look at your suggestion.

Tech So Easy;
Although the comment that I accepted didn't answer my overall question, they did in fact help me immensely along the way.  I apologize if I mishandled the way these questions are suppose to be closed, and cleaned up.
0
 

Author Comment

by:thebside
ID: 22905794
Rebooting now, so I guess we will see whether increasing the available Memory helps.
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:thebside
ID: 22906261
Ok, I cleared my event logs and rebooted the server.  I received;

4 Events - Category (100)  Event ID: 1004
Reporting queued error: faulting application wmiprvse.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.3959, fault address 0x0001a379.

Event ID: 1000
Faulting application exwmi.dll, version 6.5.7638.1, stamp 430e7361, faulting module ntdll.dll, version 5.2.3790.3959, stamp 45d70ad8, debug? 0, fault address 0x0001a379.

Event ID: 1000
Faulting application wmiprvse.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.3959, fault address 0x0001a379.

Event ID: 5603
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the HostingModel property.  This provider will be run using the LocalSystem account.  This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.  Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Event ID: 1000
Faulting application wmiprvse.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.3959, fault address 0x0001a379.


0
 
LVL 28

Expert Comment

by:Michael Pfister
ID: 22917353
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/SBS_Small_Business_Server/Q_23240771.html
Have you configured your AV software to exclude the Exchange databases?
0
 
LVL 28

Expert Comment

by:Michael Pfister
ID: 22929951
Vee_Mod, can you keep the question open for another couple of days?
0
 

Author Comment

by:thebside
ID: 22932275
I am still here, I just travel quite a bit for work so I just got back to my office and I will be catching up on these.  Sorry for the delay.
0
 

Author Comment

by:thebside
ID: 22932347
Well, I can definitely say that not all of these were excluded from the Anti virus software.  I am going to go through and make the changes needed and we will go from there.  This has been mind boggling, and again I apologize to all of you that have been trying to help me with this for my late responses.
0
 

Author Comment

by:thebside
ID: 22934246
Ok,
So I have not made these changes to the Antivirus Software and ran a Scan. The scan did find a few bugs, so now would I start over with the steps that I ran in the post from: http:#21846827

thanks.
0
 

Author Comment

by:thebside
ID: 22935236
Will do, thanks.
0
 
LVL 28

Assisted Solution

by:Michael Pfister
Michael Pfister earned 500 total points
ID: 22937135
If your system is infected with a virus, I'd recommend to scan it with at least one scanner of a different brand (with current signatures of course). Best a scanner with root kit detecion capabilities or a seperate root kit scanner (i.e. Blacklight from F-Secure).
Also run a Spybot S&D (www.spybot.com) scan. After cleaning run a Hijackthis report http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php and post the resulting log file.
0
 

Author Comment

by:thebside
ID: 22955811
Will do.  I am starting the Scan tonight and will post the Hijack this in the morning.
0
 

Author Comment

by:thebside
ID: 23100527
Ok,
So here is the skinny.  Being that there are so many good deals going on, we abandoned this server and have migrated everything from a Small Business Server to a Windows 2003 R2 Server.  

mpfister - We did run several scans on the machine and they all came up with nothing.  No rootkits, not anything.  I would have posted a Hijack this Log, however we took the time that we were using to run these tests and put it towards migrating off of Small Business Server.

How can I go about awarding my points to mpfister as they have stuck this thing through with me, even with no solution.

thanks.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 23102495
You don't award points when a solution wasn't provided.  The proper thing to do in this case is request that the question be deleted since you basically abandonded the initial issue.

Jeff
TechSoEasy

0
 

Author Comment

by:thebside
ID: 23152381
Jeff,
Thanks for you help.  It appears that the options I have are to accept and award points, or delete the question.  I would hate to delete the question as there are numerous items in here that may be of help to someone else.  

Is there a way to close it without deleting?  
Sorry to be such a pain with this, this project was a nightmare.  Thank you TechSoEasy, and MPFISTER for all your help.  

thanks again,
Brian
0
 

Author Comment

by:thebside
ID: 23152560
The resolution was that the CIO decided to upgrade all the servers to Windows Server 2003 R2, however there in invaluable suggestions in the following comments.  Regardless of if this completely solved my issue, it definitely had me going in the right direction.

21846827
22860480
22937135

Had our CIO not decided what he did while I was away from the team I am sure that we would have been able to reconcile this.  

Either way,
I can't say thank you enough to all of you for all your help.  And if the question has to be deleted, that is the way it goes.
0
 
LVL 28

Expert Comment

by:Michael Pfister
ID: 23155224
Thanks for the nice words, Brian. And don't worry, there are enough points to earn ...

Michael
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
You may have discovered the 'Compatibility View Settings' workaround for making your SBS 2008 Remote Web Workplace 'connect to a computer' section stops 'working around' after a Windows 10 client upgrade.  That can be fixed so it 'works around' agai…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now