Solved

Event ID: 1090 - couldn't log the RSoP session status causes loss of mapped drive and VM failure

Posted on 2009-04-14
18
10,444 Views
Last Modified: 2012-08-14
I have noticed that my 2 guest VM's (XP Pro) running on my XP Pro Host randomly turned off.  Users would report that it was suddenly unavailable.  They would restart just fine and then disappear a few days later with no apparent pattern.

Upon checking the Event Log I see that the failure has the following pattern:  first, event ID: 1090 occurs - Windows couldn't log the RSoP session status. Source - userenv User: NT AUTHORITY\SYSTEM.  This is followed after a few seconds by - Event ID: 100 (User: N/A) (Source: vmauthd) - Cannot connect to VMX R:\VMDataStore1\RDP-Court\RDP-Court.vmx

That is the path to the data store and the corresponding vmx file.  The data store is mapped to the R:\ drive letter.  This error is followed by matching errors for all the other VMs and after that I get several more RSoP failures.

So how do I get the PSoP failures to stop?  What more info is needed to troubleshoot this?  I assume the RSoP failure is causing the mapped drive problem.
0
Comment
Question by:wintensivetech
  • 10
  • 6
18 Comments
 
LVL 35

Expert Comment

by:torimar
ID: 24152920
Are those machines XP SP2? Then try this hotfix: http://support.microsoft.com/kb/894794

Another way that is reported to fix the issue is this procedure from a command prompt:

cd /d %windir%\system32
regsvr32 /n /I userenv.dll
cd wbem
mofcomp scersop.mof
gpupdate /force

Then reboot the machine twice.

Alternatively, you could also temporarily stop the WMI (Windows Management Instrumentation) service, then delete all files that are in the %SystemRoot%\System32\Wbem\Repository folder, and restart. The files will be recreated.
0
 

Author Comment

by:wintensivetech
ID: 24154630
torimar - thanks for the input:

the hotfix was not precisely related to my situation so I wanted to avoid that.

I tried the commands from the command prompt and the first one returned the following:
Dllinstall in userenv.dll failed. Return code was 0X8004100e
I also noted that gpupdate "is not a recognized internal or external command"  It is important to note I have had problems with all gpedit related commands  - I even have a whole question related to just getting gpedit installed on my XP Pro SP2 system:

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_24275368.html

Is this gpupdate probably related?

Finally - I used the third suggestion, and was able to complete those steps and restart. The files were rtecreated and the services all started themselves.  So now we'll wait to see if the RSoP error persists.  If not you get the points - Thanks!!  

In the meantime could you give me your input on why the regsvr32 commands failed and why I have no gpupdate (and is it related to my otehr gpedit problem)
0
 
LVL 35

Expert Comment

by:torimar
ID: 24154754
Hi,
I just lost my almost completed answer because I inadvertently closed the browser window. Fatigue, I guess - it's 7 o'clock in the morning here and I haven't been to bed yet.

So in short terms:
- Yes, the gpupdate and gpedit issues most likely are related to each other.
Gpupdate.exe is not a part of an external tool/resource kit, it is part of XP (http://technet.microsoft.com/en-us/library/bb490983.aspx) and should reside in your \windows\system32 folder.

- I have no idea why the regsvr32 command failed. It seems that more people trying the exact same command chain you were issuing had this, but in no case was the issue resolved.
0
 

Author Comment

by:wintensivetech
ID: 24159814
OK, overnight the userenv error shows up a dozen times in the event manager.  RSoP error.  And as expected it was followed by the vmauthd error and the Virtual Machines were disconnected because they couldn't find the datastore where they reside, which is a LOCAL hard drive on the host.  "Cannot connect to VMX r:\VMDataStore1\....

So I still have the RSop error, and I think its somehow related to the failure(shutdown) of the VM which occurs right after when vmauthd cannot access the hard drive with the datastore in it.

And even though I was able to get gpedit to work in the other question I asked (referred to above) there appears to still be trouble with gpupdate....and we never did find out why my version of XP Pro had the problem anyway.

So I still need to find a way to attempt your second suggestion using regsvr32 if we can work through those errors.  mmaybe after you get some sleep you'll be up for tackling this again!

Thanks for your willingness to help with this! I'm looking in to the link in your last post to see where that leads.
0
 

Author Comment

by:wintensivetech
ID: 24159829
as an aside:

attempting the secedit /refreshpolicy command give the following error:

cannot open the file: secedit.chm
0
 
LVL 35

Expert Comment

by:torimar
ID: 24163996
How did you get gpedit to work? Did you expand the required files from a Windows Install CD?
You could do the same for gpupdate:
expand <CDROM-Drive>:\i386\GPUPDATE.EX_  c:\windows\system32\gpupdate.exe


I've been researching this strange userenv.dll error. It is not listed as a known error code from Regsvr32.exe: http://support.microsoft.com/kb/249873 (Explanation of Regsvr32 usage and error messages). Instead it is somehow connected to the WMI service.

All I can come up with at this moment are two tiny suggestions...:
1. before attempting my second suggestion again, disable the WMI service
2. use "regsvr32 /n /i userenv.dll" instead of "regsvr32 /n /I userenv.dll"

... and two quick questions:
3. are you sure 'userenv.dll' actually exists in your \system32 folder? The internet seems to be filled with people who "lost" it somehow.
4. does gpedit work alright, or are there still strange problems with it?
0
 

Author Comment

by:wintensivetech
ID: 24164970
I fixed gpedit in the link I placed in the my second comment which outlines what I did.  Here it is again:

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_24275368.html

No gpedit files were on my computer or on my version of the VLK 1.0 version of Windows XP Pro I had....that was wierd and I have never figured that out. I'm going to have to figure out how to reach Microsoft about that.  So in the same way I had "lost" gpedit and had to manually reinstall it, I suspect I have "lost" or never had gpupdate.  Can I manually install that as well?

I do have userenv.dll in system32 directory.  version 5.1.2600.2180
But I had not stopped the WMI service when attempting your second suggestion (I did for the third one though). the /L command didn't work...I realized you must have meant /i.

I did successfully get gpedit installed and working, but I do not have GPupdate,and the needed file is not on my XP disk. So I' back to the last question of whether there is a way to install it manually (need source for that) like I did the gpedit?  Thanks again for your help!

Jason



0
 

Author Comment

by:wintensivetech
ID: 24164994
running

regsvr32 userenv.dll

with no switches successfully registers userenv.dll.  However mofcomp command yields - File scersop.mof not found!  and gpupdate is not recognized as an internal or external command, operable program or batch file
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 35

Expert Comment

by:torimar
ID: 24165191
-- On your installation CD, did you look for "gpupdate.ex_"? Because that is the name it has before you expand it, not .exe.
I'm sure you can manually add this executable, it may even run out of the box without any additional files needed. I'd share mine with you but that won't help because it is not an English language one. You need to get the file from another XP Pro (SP2) installation.
You said you are running 2 XP Pro VMs on an XP Pro box: none of these three systems has the file? Isn't there another computer or laptop around?

-- regsvr32 should not be run without switches in this case. The /n /i switches prevent DLLRegisterServer and call DLLInstall instead.
You didn't break anything because the Userenv.dll also has to be registered, I guess, but you also did not achieve what you were trying to do.

-- There should be a whole load of .mof files in \windows\system32\wbem\ and about just as many in \windows\system32\wbem\AutoRecovery. Are they all missing or is it only scersop.mof? If they are all missing, then manually adding the gpupdate.exe certainly will not fix your broken GP install, I'm afraid.

0
 

Author Comment

by:wintensivetech
ID: 24165430
I don't have the gpupdate.ex_ file on the install disk or any systems I have because they were all installed using the Volume License copy of Windows XP Pro SP1 that I have (10 licenses).  And I suspect the gpupdate is missing for the same reason that gpedit was missing (which I actually don't know why...still a mystery until I can get someone at MS to explain what the deal is with my VLK 1.0 version of Windows)

So I can't expand the needed files from my XP source.

And as for the switches...it still gives the errors mentioned above when I try to run the commands you mentioned with the appropriate switches.

There are lots of .mof files....just not the one we need.  So wierd situation. What gives?  I wonder how to contact Microsoft about my Volume License version?
0
 

Author Comment

by:wintensivetech
ID: 24233478
I got a copy of the missing files and installed them on my system so I could retry the command you suggested: scersop.mof and gpupdate.exe
I tried running the command again with the following results:

regsvr32 command returns:
Dllinstall in userenv.dll failed. Return code was 0X8004100e

mofcomp command returns the following info :
Parsing mof file: scersop.mof
MOF file has been successfully parsed
Storing data in the repository....
An error occurred while creating object 3 defined on lines 27 - 31:
0X80041002 Class, instance or property 'RSOP_PolicySetting' was not found.
Compiler returned error 0X80041001

gpupdate actually worked - Group Policy was successfully updated.

So I guess that means that 2 of 3 command failed to work
0
 

Author Comment

by:wintensivetech
ID: 24233517
Also, now I've got 2 RSoP messages in the event manager.  In addition to the main one about WMI, the new one is:

Event ID: 1089 Source: userenv
Windows couldn't set the RSoP session status for Group Policy Engine. (The operation completed successfully) No more logging will be done for this application of policy.

Bizarre - the message seems to contradict itself...
0
 
LVL 35

Expert Comment

by:torimar
ID: 24236080
Yes, bizarre indeed. But I think there is no doubt that this new error is caused by one of the two failures you describe in the post above.

I've searched high and low for answers to these questions, but I could only come up with a couple of assumptions:

- the userenv error could be caused because WMI was still running
- the userenv error could probably also be caused because you registered the dll, whereas it has to be installed; maybe it needs to be unregistered first
- the mofcomp error could be caused because you only compiled scersop.mof. As I already pointed out, there are loads of .mof files in that folder; maybe some others contain policy settings that have to be set for scersop to be compiling correctly. I checked, and indeed: the class "RSOP_PolicySetting" is defined in rsop.mof.

I attached a .zip file with all .mofs that are in my WBEM folder; it's from a German version XP SP3 system. I'm sure the language doesn't matter, but I don't know about the SP. If you could find the files somewhere else, the better. Make sure to put at least the rsop.mof in your \wbem folder.
(Note: I had to rename the files from .mof to .txt to be able to attach them; of course, you need to rename them back.)

Now I suggest you do the following step by step:
1) Disable and stop the Windows Management  Instrumenta tion service
2) Delete contents of "C:\window s\system32\w bem\Reposito ry" folder
3) Enable and start the Windows Management  Instrumenta tion service again
4) Wait for "C:\window s\system32\w bem\Reposito ry" to populate (this can take a few minutes)
5) Reboot the server

6) Disable WMI again
7) Open command prompt
8) cd /d %windir%\system32
9) regsvr32 /n /i userenv.dll
10) cd wbem
11) mofcomp rsop.mof
12) mofcomp scersop.mof
13) gpupdate /force

NOTE: if in step 9) you receive the dllinstall error again, do not continue, but try:
regsvr32 /u userenv.dll
regsvr32 /n /i userenv.dll

Good luck!
wbem.zip
0
 
LVL 35

Accepted Solution

by:
torimar earned 500 total points
ID: 24236090
Sorry, there are some irritating line breaks in the instructions, here they come again, better readable:

1) Disable and stop the Windows Management  Instrumentation service
2) Delete contents of "C:\windows\system32\wbem\Repository" folder
3) Enable and start the Windows Management Instrumentation service again
4) Wait for "C:\windows\system32\wbem\Repository" to populate (this can take a few minutes)
5) Reboot the server

6) Disable WMI again
7) Open command prompt
8) cd /d %windir%\system32
9) regsvr32 /n /i userenv.dll
10) cd wbem
11) mofcomp rsop.mof
12) mofcomp scersop.mof
13) gpupdate /force

NOTE: if in step 9) you receive the dllinstall error again, do not continue, but try:
regsvr32 /u userenv.dll
regsvr32 /n /i userenv.dll
0
 

Author Comment

by:wintensivetech
ID: 24236827
OK Great! I will try this.  First I'll see which of your files I am missing. Maybe I don't need all of them.  Also, I have updated everything to SP3 so we are the same Service Pack level now. I will get back once all is completed to let you know the results.
0
 

Expert Comment

by:techguyjohn
ID: 24453175
I have been getting a ton of these errors as well, I found this article but have yet to try it.

http://forums.techarena.in/small-business-server/540394.htm
0
 

Author Closing Comment

by:wintensivetech
ID: 31570279
Torimar was extremely helpful.  At each point his suggestions solved a problem, and then my situation presented a new problem.  In the end, I still have the RSoP error once in awhile, but mostly it has been replaced with a new RSoP type error.  I'm not totally sure I've completely repaired the gpedit stuff.  I should probably start over and go through and retry all steps here, but in fairness, I have had some other wierd things on this system lately and I may just need a reinstall.  Finally, the main problem was that the VMs turning off, and since performing these steps, those have been more stable - they rarely, if ever, turn off randomly anymore.  Thanks!
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

In this article, I will show you HOW TO: Suppress Configuration Issues and Warnings Alert displayed in Summary status for ESXi 6.5 after enabling SSH or ESXi Shell.
In this article, I show you step by step with screenshots to assist you - HOW TO: Deploy and Install the VMware vCenter Server Appliance 6.5 (VCSA 6.5), with some helpful tips along the way.
Teach the user how to rename, unmount, delete and upgrade VMFS datastores. Open vSphere Web Client: Rename VMFS and NFS datastores: Upgrade VMFS-3 volume to VMFS-5: Unmount VMFS datastore: Delete a VMFS datastore:
Teach the user how to use create log bundles for vCenter Server or ESXi hosts Open vSphere Web Client: Generate vCenter Server and ESXi host log bundle:  Open vCenter Server Appliance Web Management interface and generate log bundle: Open vCenter Se…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now