Link to home
Start Free TrialLog in
Avatar of wintensivetech
wintensivetech

asked on

Event ID: 1090 - couldn't log the RSoP session status causes loss of mapped drive and VM failure

I have noticed that my 2 guest VM's (XP Pro) running on my XP Pro Host randomly turned off.  Users would report that it was suddenly unavailable.  They would restart just fine and then disappear a few days later with no apparent pattern.

Upon checking the Event Log I see that the failure has the following pattern:  first, event ID: 1090 occurs - Windows couldn't log the RSoP session status. Source - userenv User: NT AUTHORITY\SYSTEM.  This is followed after a few seconds by - Event ID: 100 (User: N/A) (Source: vmauthd) - Cannot connect to VMX R:\VMDataStore1\RDP-Court\RDP-Court.vmx

That is the path to the data store and the corresponding vmx file.  The data store is mapped to the R:\ drive letter.  This error is followed by matching errors for all the other VMs and after that I get several more RSoP failures.

So how do I get the PSoP failures to stop?  What more info is needed to troubleshoot this?  I assume the RSoP failure is causing the mapped drive problem.
Avatar of torimar
torimar
Flag of Germany image

Are those machines XP SP2? Then try this hotfix: http://support.microsoft.com/kb/894794

Another way that is reported to fix the issue is this procedure from a command prompt:

cd /d %windir%\system32
regsvr32 /n /I userenv.dll
cd wbem
mofcomp scersop.mof
gpupdate /force

Then reboot the machine twice.

Alternatively, you could also temporarily stop the WMI (Windows Management Instrumentation) service, then delete all files that are in the %SystemRoot%\System32\Wbem\Repository folder, and restart. The files will be recreated.
Avatar of wintensivetech
wintensivetech

ASKER

torimar - thanks for the input:

the hotfix was not precisely related to my situation so I wanted to avoid that.

I tried the commands from the command prompt and the first one returned the following:
Dllinstall in userenv.dll failed. Return code was 0X8004100e
I also noted that gpupdate "is not a recognized internal or external command"  It is important to note I have had problems with all gpedit related commands  - I even have a whole question related to just getting gpedit installed on my XP Pro SP2 system:

https://www.experts-exchange.com/questions/24275368/Windows-XP-Pro-VLM-1-0-has-NO-Group-Policy-Editor-gpedit-msc.html

Is this gpupdate probably related?

Finally - I used the third suggestion, and was able to complete those steps and restart. The files were rtecreated and the services all started themselves.  So now we'll wait to see if the RSoP error persists.  If not you get the points - Thanks!!  

In the meantime could you give me your input on why the regsvr32 commands failed and why I have no gpupdate (and is it related to my otehr gpedit problem)
Hi,
I just lost my almost completed answer because I inadvertently closed the browser window. Fatigue, I guess - it's 7 o'clock in the morning here and I haven't been to bed yet.

So in short terms:
- Yes, the gpupdate and gpedit issues most likely are related to each other.
Gpupdate.exe is not a part of an external tool/resource kit, it is part of XP (http://technet.microsoft.com/en-us/library/bb490983.aspx) and should reside in your \windows\system32 folder.

- I have no idea why the regsvr32 command failed. It seems that more people trying the exact same command chain you were issuing had this, but in no case was the issue resolved.
OK, overnight the userenv error shows up a dozen times in the event manager.  RSoP error.  And as expected it was followed by the vmauthd error and the Virtual Machines were disconnected because they couldn't find the datastore where they reside, which is a LOCAL hard drive on the host.  "Cannot connect to VMX r:\VMDataStore1\....

So I still have the RSop error, and I think its somehow related to the failure(shutdown) of the VM which occurs right after when vmauthd cannot access the hard drive with the datastore in it.

And even though I was able to get gpedit to work in the other question I asked (referred to above) there appears to still be trouble with gpupdate....and we never did find out why my version of XP Pro had the problem anyway.

So I still need to find a way to attempt your second suggestion using regsvr32 if we can work through those errors.  mmaybe after you get some sleep you'll be up for tackling this again!

Thanks for your willingness to help with this! I'm looking in to the link in your last post to see where that leads.
as an aside:

attempting the secedit /refreshpolicy command give the following error:

cannot open the file: secedit.chm
How did you get gpedit to work? Did you expand the required files from a Windows Install CD?
You could do the same for gpupdate:
expand <CDROM-Drive>:\i386\GPUPDATE.EX_  c:\windows\system32\gpupdate.exe


I've been researching this strange userenv.dll error. It is not listed as a known error code from Regsvr32.exe: http://support.microsoft.com/kb/249873 (Explanation of Regsvr32 usage and error messages). Instead it is somehow connected to the WMI service.

All I can come up with at this moment are two tiny suggestions...:
1. before attempting my second suggestion again, disable the WMI service
2. use "regsvr32 /n /i userenv.dll" instead of "regsvr32 /n /I userenv.dll"

... and two quick questions:
3. are you sure 'userenv.dll' actually exists in your \system32 folder? The internet seems to be filled with people who "lost" it somehow.
4. does gpedit work alright, or are there still strange problems with it?
I fixed gpedit in the link I placed in the my second comment which outlines what I did.  Here it is again:

https://www.experts-exchange.com/questions/24275368/Windows-XP-Pro-VLM-1-0-has-NO-Group-Policy-Editor-gpedit-msc.html

No gpedit files were on my computer or on my version of the VLK 1.0 version of Windows XP Pro I had....that was wierd and I have never figured that out. I'm going to have to figure out how to reach Microsoft about that.  So in the same way I had "lost" gpedit and had to manually reinstall it, I suspect I have "lost" or never had gpupdate.  Can I manually install that as well?

I do have userenv.dll in system32 directory.  version 5.1.2600.2180
But I had not stopped the WMI service when attempting your second suggestion (I did for the third one though). the /L command didn't work...I realized you must have meant /i.

I did successfully get gpedit installed and working, but I do not have GPupdate,and the needed file is not on my XP disk. So I' back to the last question of whether there is a way to install it manually (need source for that) like I did the gpedit?  Thanks again for your help!

Jason



running

regsvr32 userenv.dll

with no switches successfully registers userenv.dll.  However mofcomp command yields - File scersop.mof not found!  and gpupdate is not recognized as an internal or external command, operable program or batch file
-- On your installation CD, did you look for "gpupdate.ex_"? Because that is the name it has before you expand it, not .exe.
I'm sure you can manually add this executable, it may even run out of the box without any additional files needed. I'd share mine with you but that won't help because it is not an English language one. You need to get the file from another XP Pro (SP2) installation.
You said you are running 2 XP Pro VMs on an XP Pro box: none of these three systems has the file? Isn't there another computer or laptop around?

-- regsvr32 should not be run without switches in this case. The /n /i switches prevent DLLRegisterServer and call DLLInstall instead.
You didn't break anything because the Userenv.dll also has to be registered, I guess, but you also did not achieve what you were trying to do.

-- There should be a whole load of .mof files in \windows\system32\wbem\ and about just as many in \windows\system32\wbem\AutoRecovery. Are they all missing or is it only scersop.mof? If they are all missing, then manually adding the gpupdate.exe certainly will not fix your broken GP install, I'm afraid.

I don't have the gpupdate.ex_ file on the install disk or any systems I have because they were all installed using the Volume License copy of Windows XP Pro SP1 that I have (10 licenses).  And I suspect the gpupdate is missing for the same reason that gpedit was missing (which I actually don't know why...still a mystery until I can get someone at MS to explain what the deal is with my VLK 1.0 version of Windows)

So I can't expand the needed files from my XP source.

And as for the switches...it still gives the errors mentioned above when I try to run the commands you mentioned with the appropriate switches.

There are lots of .mof files....just not the one we need.  So wierd situation. What gives?  I wonder how to contact Microsoft about my Volume License version?
I got a copy of the missing files and installed them on my system so I could retry the command you suggested: scersop.mof and gpupdate.exe
I tried running the command again with the following results:

regsvr32 command returns:
Dllinstall in userenv.dll failed. Return code was 0X8004100e

mofcomp command returns the following info :
Parsing mof file: scersop.mof
MOF file has been successfully parsed
Storing data in the repository....
An error occurred while creating object 3 defined on lines 27 - 31:
0X80041002 Class, instance or property 'RSOP_PolicySetting' was not found.
Compiler returned error 0X80041001

gpupdate actually worked - Group Policy was successfully updated.

So I guess that means that 2 of 3 command failed to work
Also, now I've got 2 RSoP messages in the event manager.  In addition to the main one about WMI, the new one is:

Event ID: 1089 Source: userenv
Windows couldn't set the RSoP session status for Group Policy Engine. (The operation completed successfully) No more logging will be done for this application of policy.

Bizarre - the message seems to contradict itself...
Yes, bizarre indeed. But I think there is no doubt that this new error is caused by one of the two failures you describe in the post above.

I've searched high and low for answers to these questions, but I could only come up with a couple of assumptions:

- the userenv error could be caused because WMI was still running
- the userenv error could probably also be caused because you registered the dll, whereas it has to be installed; maybe it needs to be unregistered first
- the mofcomp error could be caused because you only compiled scersop.mof. As I already pointed out, there are loads of .mof files in that folder; maybe some others contain policy settings that have to be set for scersop to be compiling correctly. I checked, and indeed: the class "RSOP_PolicySetting" is defined in rsop.mof.

I attached a .zip file with all .mofs that are in my WBEM folder; it's from a German version XP SP3 system. I'm sure the language doesn't matter, but I don't know about the SP. If you could find the files somewhere else, the better. Make sure to put at least the rsop.mof in your \wbem folder.
(Note: I had to rename the files from .mof to .txt to be able to attach them; of course, you need to rename them back.)

Now I suggest you do the following step by step:
1) Disable and stop the Windows Management  Instrumenta tion service
2) Delete contents of "C:\window s\system32\w bem\Reposito ry" folder
3) Enable and start the Windows Management  Instrumenta tion service again
4) Wait for "C:\window s\system32\w bem\Reposito ry" to populate (this can take a few minutes)
5) Reboot the server

6) Disable WMI again
7) Open command prompt
8) cd /d %windir%\system32
9) regsvr32 /n /i userenv.dll
10) cd wbem
11) mofcomp rsop.mof
12) mofcomp scersop.mof
13) gpupdate /force

NOTE: if in step 9) you receive the dllinstall error again, do not continue, but try:
regsvr32 /u userenv.dll
regsvr32 /n /i userenv.dll

Good luck!
wbem.zip
ASKER CERTIFIED SOLUTION
Avatar of torimar
torimar
Flag of Germany image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
OK Great! I will try this.  First I'll see which of your files I am missing. Maybe I don't need all of them.  Also, I have updated everything to SP3 so we are the same Service Pack level now. I will get back once all is completed to let you know the results.
I have been getting a ton of these errors as well, I found this article but have yet to try it.

http://forums.techarena.in/small-business-server/540394.htm
Torimar was extremely helpful.  At each point his suggestions solved a problem, and then my situation presented a new problem.  In the end, I still have the RSoP error once in awhile, but mostly it has been replaced with a new RSoP type error.  I'm not totally sure I've completely repaired the gpedit stuff.  I should probably start over and go through and retry all steps here, but in fairness, I have had some other wierd things on this system lately and I may just need a reinstall.  Finally, the main problem was that the VMs turning off, and since performing these steps, those have been more stable - they rarely, if ever, turn off randomly anymore.  Thanks!