Solved

MAD Monitoring Errors in Event Viewer

Posted on 2010-09-03
43
2,658 Views
Last Modified: 2012-05-10
Hello

I am receiving these 3 errors in my Event Viewer and i can not seem to resolve them. All come from "MSExchangeSA"

The MAD Monitoring thread was unable to read the state of cluster resources, error '0x80041013'.

and

The MAD Monitoring thread was unable to read its configuration from the DS, error '0x80041013'.

and

The MAD Monitoring thread was unable to connect to WMI, error '0x8004100e'.

Exchange BPA reports only one error on the heath check. That error is:

"Cannot connect to the routing master on port 691. Server SVR01 is a routing group master but a connection to port 691 cannot be established from the workstation where this tool is running."

Any advice would be greatly appreciated.

Server is running SBS 2003 with Exchange SP2
0
Comment
Question by:VCSLI
  • 22
  • 21
43 Comments
 
LVL 13

Expert Comment

by:George Sas
ID: 33600888
Please check this article on Microsoft site :
http://support.microsoft.com/kb/810861

0
 
LVL 13

Expert Comment

by:George Sas
ID: 33600936
0
 

Author Comment

by:VCSLI
ID: 33601136
http://support.microsoft.com/?id=288590

I have already gone through this process in the article. :(

http://support.microsoft.com/kb/810861
I have attached a screenshot of my having connected with the connectivity tester (Wbemtest). It seems to be ok. I didn't touch anything in this panel, all i clicked was connect with it opened. Was i supposed to do anything else?

Please have patience, i'm very new to troubleshooting Exchange.

Screen-shot-2010-09-03-at-6.34.3.jpg
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33601162
It's your error comming often in the eventlog ?
Do you "experience any actual problems with your exchange ?


Here it's a small tutorial on how to use it :
http://www.computerperformance.co.uk/vbscript/wmi_wbemtest.htm
0
 

Author Comment

by:VCSLI
ID: 33601196
Some users are randomly disconnected from the server. The network is completely trashed and needs to be redone. I'm just hoping to get things semi stable until my upgrade proposal goes through. I'm not sure if this issue would cause server disconnects though.

The error comes about every 5 mins

It always the following events that come up one after the other in the same order.

1 The MAD Monitoring thread is initializing.
2 The MAD Monitoring thread is initialized.
3 The MAD Monitoring thread was unable to read the state of cluster resources, error '0x80041013'.
4 The MAD Monitoring thread was unable to read its configuration from the DS, error '0x80041013'.

Those same 4, every 5 mins in that order.

Thank you for the link to the tutorial. What do i do with it though? What am i testing?
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33601248
Just test if your WMI responds and works.
I have also seen an article where 2 dll files needed to be re-registered.

- Error code: 0x80041013 = wbemErrProviderLoadFailure - As per Microsoft: "COM cannot locate a provider referenced in the schema. This error may be caused by any of the following:
1. The provider is using a WMI DLL that does not match the .lib fileused when the provider was built.
2. The provider's DLL or any of the DLLs on which it depends is corrupt.
3. The provider failed to export DllRegisterServer.
4. An in-process provider was not registered using /regsvr32.
5. An out-of-process provider was not registered using /regserver". See WMI Errors List for more details.

You might also wanna try :

1. run : services.msc

2.  Then stop the Windows Management Instrumentation service.

3. Make a backup and delete all of the files that are in the
%SystemRoot%\System32\Wbem\Repository folder.

4. Restart the computer. The files are recreated when the computer
restarts.
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33601263
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33601277
As an ultimate option try to re-install SP2 on exchange.
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33601288
0
 

Author Comment

by:VCSLI
ID: 33601357
http://www.tideway.com/community/forum/viewthread/180/

All this checked out OK.

http://www.mrtweak.com/windows-servers/exchange-wmi-errors-wmi-repository-clear-reinstall-script/
This looked REALLY GOOD.

But it hasn't worked. I havent restarted the server though but. It says in the article that you shouldn't have to.
0
 

Author Comment

by:VCSLI
ID: 33601391
Ok, it seems that 1 of the 2 errors has gone.

Now i am only stuck with

The MAD Monitoring thread was unable to read its configuration from the DS, error '0x80041010'.

Progress!
0
 

Author Comment

by:VCSLI
ID: 33601461
I restarted the server and have gotten

The MAD Monitoring thread was unable to connect to WMI, error '0x8004100e'.

I also cant connect with Webemtest using root\microsoftexchangev2

Check screenshot

Screen-shot-2010-09-03-at-8.10.4.jpg
0
 

Author Comment

by:VCSLI
ID: 33601473
I have rerun that script again, just to see and here is the output...


C:\Documents and Settings\Administrator\Desktop>net stop winmgmt
The Windows Management Instrumentation service is not started.

More help is available by typing NET HELPMSG 3521. << ---- I shut down the service myself, this is fine.


C:\Documents and Settings\Administrator\Desktop>c:

C:\Documents and Settings\Administrator\Desktop>cd C:\WINDOWS\system32\wbem

C:\WINDOWS\system32\wbem>rd /S /Q repository

C:\WINDOWS\system32\wbem>regsvr32 /s C:\WINDOWS\system32\scecli.dll

C:\WINDOWS\system32\wbem>regsvr32 /s C:\WINDOWS\system32\userenv.dll

C:\WINDOWS\system32\wbem>mofcomp cimwin32.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: cimwin32.mof
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>mofcomp cimwin32.mfl
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: cimwin32.mfl
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>mofcomp rsop.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: rsop.mof
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>mofcomp rsop.mfl
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: rsop.mfl
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>for /F %s in (Ædir /b /s *.dllÆ) do regsvr32 /s %s
The system cannot find the file Ædir.

C:\WINDOWS\system32\wbem>for /F %s in (Ædir /b *.mofÆ) do mofcomp %s
The system cannot find the file Ædir.

C:\WINDOWS\system32\wbem>for /F %s in (Ædir /b *.mflÆ) do mofcomp %s
The system cannot find the file Ædir.

C:\WINDOWS\system32\wbem>mofcomp -n:root\cimv2\applications\exchange wbemcons.mo
f
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: wbemcons.mof
MOF file has been successfully parsed
Storing data in the repository...
An error occurred while opening the namespace for object 1 defined on lines 3 -
10:
Error Number: 0x8004100e, Facility: WMI
Description: Invalid namespace
Compiler returned error 0x8004100e
C:\WINDOWS\system32\wbem>mofcomp -n:root\cimv2\applications\exchange smtpcons.mo
f
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: smtpcons.mof
MOF file has been successfully parsed
Storing data in the repository...
An error occurred while opening the namespace for object 1 defined on lines 4 -
16:
Error Number: 0x8004100e, Facility: WMI
Description: Invalid namespace
Compiler returned error 0x8004100e
C:\WINDOWS\system32\wbem>mofcomp exmgmt.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: exmgmt.mof
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>mofcomp exwmi.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: exwmi.mof
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>net start winmgmt
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\WINDOWS\system32\wbem>pause
Press any key to continue . . .
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33602300
C:\WINDOWS\system32\wbem>for /F %s in (Ædir /b /s *.dllÆ) do regsvr32 /s %s
The system cannot find the file Ædir.

You fired up the command wrong ... look at the character .. Ædir??? The script is like :


net stop winmgmt
c:
cd %windir%\system32\wbem
rd /S /Q repository
regsvr32 /s %systemroot%\system32\scecli.dll
regsvr32 /s %systemroot%\system32\userenv.dll
mofcomp cimwin32.mof
mofcomp cimwin32.mfl
mofcomp rsop.mof
mofcomp rsop.mfl
for /f %%s in (’dir /b /s *.dll’) do regsvr32 /s %%s
for /f %%s in (’dir /b *.mof’) do mofcomp %%s
for /f %%s in (’dir /b *.mfl’) do mofcomp %%s
mofcomp -n:root\cimv2\applications\exchange wbemcons.mof
mofcomp -n:root\cimv2\applications\exchange smtpcons.mof
mofcomp exmgmt.mof
mofcomp exwmi.mof
net start winmgmt

Open in new window

0
 

Author Comment

by:VCSLI
ID: 33604577
I've copied the script you've posted for me, thank you. i created a new patch file and pasted it in there. I looked over the script and didn't find any æ's. Below is the output after it was run. I have also sttatched a screenshot of the notepad file containing the script.


C:\Documents and Settings\Administrator\Desktop>net stop winmgmt
The following services are dependent on the Windows Management Instrumentation s
ervice.
Stopping the Windows Management Instrumentation service will also stop these ser
vices.

   Microsoft Exchange Management

Do you want to continue this operation? (Y/N) [N]: y
The Microsoft Exchange Management service is stopping.
The Microsoft Exchange Management service was stopped successfully.

The Windows Management Instrumentation service is stopping.
The Windows Management Instrumentation service was stopped successfully.


C:\Documents and Settings\Administrator\Desktop>c:

C:\Documents and Settings\Administrator\Desktop>cd C:\WINDOWS\system32\wbem

C:\WINDOWS\system32\wbem>rd /S /Q repository

C:\WINDOWS\system32\wbem>regsvr32 /s C:\WINDOWS\system32\scecli.dll

C:\WINDOWS\system32\wbem>regsvr32 /s C:\WINDOWS\system32\userenv.dll

C:\WINDOWS\system32\wbem>mofcomp cimwin32.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: cimwin32.mof
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>mofcomp cimwin32.mfl
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: cimwin32.mfl
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>mofcomp rsop.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: rsop.mof
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>mofcomp rsop.mfl
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: rsop.mfl
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>for /F %s in (Ædir /b /s *.dllÆ) do regsvr32 /s %s
The system cannot find the file Ædir.

C:\WINDOWS\system32\wbem>for /F %s in (Ædir /b *.mofÆ) do mofcomp %s
The system cannot find the file Ædir.

C:\WINDOWS\system32\wbem>for /F %s in (Ædir /b *.mflÆ) do mofcomp %s
The system cannot find the file Ædir.

C:\WINDOWS\system32\wbem>mofcomp -n:root\cimv2\applications\exchange wbemcons.mo
f
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: wbemcons.mof
MOF file has been successfully parsed
Storing data in the repository...
An error occurred while opening the namespace for object 1 defined on lines 3 -
10:
Error Number: 0x8004100e, Facility: WMI
Description: Invalid namespace
Compiler returned error 0x8004100e
C:\WINDOWS\system32\wbem>mofcomp -n:root\cimv2\applications\exchange smtpcons.mo
f
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: smtpcons.mof
MOF file has been successfully parsed
Storing data in the repository...
An error occurred while opening the namespace for object 1 defined on lines 4 -
16:
Error Number: 0x8004100e, Facility: WMI
Description: Invalid namespace
Compiler returned error 0x8004100e
C:\WINDOWS\system32\wbem>mofcomp exmgmt.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: exmgmt.mof
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>mofcomp exwmi.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: exwmi.mof
MOF file has been successfully parsed
Storing data in the repository...
Done!

C:\WINDOWS\system32\wbem>net start winmgmt
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\WINDOWS\system32\wbem>pause
Press any key to continue . . .
Screen-shot-2010-09-04-at-4.17.3.jpg
0
 

Author Comment

by:VCSLI
ID: 33604582
Wow, made a few typos there, sorry. Please excuse that.
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33604745
To initiate an auto recovery, run one of the following commands:

Regsvr32 %Windir%\System32\Wbem\wbemupgd.dll
or
Rundll %Windir%\System32\Wbem\wbemupgd.dll, RUNDLLENTRY

To perform a manual rebuild of the repository, run the following series of
commands:

net stop winmgmt /y
C:
cd %windir%\system32\wbem
if exist %windir%\system32\wbem\repository.old rmdir /s /q repository.old
rename %windir%\system32\wbem\repository repository.old
for /f %s in ('dir /b *.dll') do regsvr32 /s %s
for /f %s in ('dir /b *.mof *.mfl') do mofcomp %s
net start winmgmt
wmiprvse /regserver
To perform a more thorough manual rebuild, then run the following series of
commands:

%windir%\system32\wbem\winmgmt /clearadap
%windir%\system32\wbem\winmgmt /kill
%windir%\system32\wbem\winmgmt /unregserver
%windir%\system32\wbem\winmgmt /reserver
%windir%\system32\wbem\winmgmt /resyncperf
net stop winmgmt /y
if exist %windir%\system32\wbem\repository.old rmdir /s /q
%windir%\system32\wbem\repository.old
rename %windir%\system32\wbem\repository
%windir%\system32\wbem\repository.old
regsvr32 /s %systemroot%\system32\scecli.dll
regsvr32 /s %systemroot%\system32\userenv.dll
mofcomp %windir%\system32\wbem\cimwin32.mof
mofcomp %windir%\system32\wbem\cimwin32.mfl
mofcomp %windir%\system32\wbem\rsop.mof
mofcomp %windir%\system32\wbem\rsop.mfl
for /f %s in ('dir /b /s %windir%\system32\wbem\*.dll') do regsvr32 /s %s
for /f %s in ('dir /b /s %windir%\system32\wbem\*.mof') do mofcomp %s
for /f %s in ('dir /b %windir%\system32\wbem\*.mfl') do mofcomp %s
net start winmgmt
%windir%\system32\wbem\wmiprvse /regserver
start other services which were stopped when winmgmt stopped
************************************************** *****
Try it. Good luck.
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33604753
If that does not work try :


net stop winmgmt

pause

c:

cd c:\windows\system32\wbem

rd /S /Q repository

regsvr32 /s %systemroot%\system32\scecli.dll

regsvr32 /s %systemroot%\system32\userenv.dll

mofcomp cimwin32.mof

mofcomp cimwin32.mfl

mofcomp rsop.mof

mofcomp rsop.mfl

for /f %%s in ('dir /b /s *.dll') do regsvr32 /s %%s

for /f %%s in ('dir /b *.mof') do mofcomp %%s

for /f %%s in ('dir /b *.mfl') do mofcomp %%s

mofcomp exwmi.mof

mofcomp -n:root\cimv2\applications\exchange wbemcons.mof

mofcomp -n:root\cimv2\applications\exchange smtpcons.mof

mofcomp exmgmt.mof

Open in new window

0
 
LVL 13

Expert Comment

by:George Sas
ID: 33604775
IF all this fails try to re-install Exchange SP2.

If even that fails then you should try re-installing WMI or copy the repository from a working 2003 machine.
   1. Stop the WMI service (winmgmt.exe) on the problem server. This action usually also stops the Microsoft Exchange Management service. If not, stop that service.
   2. On the problem server, rename the %systemroot%\system32\wbem\Repository folder to %systemroot%\system32\wbem\Repository\Repository.bak.
   3. Copy the %systemroot%\system32\wbem\Repository folder from a known good Exchange 2003 or Exchange 2000 Server machine to the problem server.
   4. Start the WMI and Microsoft Exchange Management services.
   5. Test WMI by using WBEMTest to open the Win32_PerfRawData_SMTP SVC_SMTPServer class in the root\cimv2 namespace.
0
 

Author Comment

by:VCSLI
ID: 33605418
i've rerun the new script you've posted. I get the same output as before.

I'm reinstalling Exchange SP2 now. Will post back what happens...

I dont have another exchange server on hand to copy files from :(
0
 

Author Comment

by:VCSLI
ID: 33605431
Nope, Still stuck with

The MAD Monitoring thread was unable to read its configuration from the DS, error '0x80041010'.

after SP2 reinstall.
0
Want to promote your upcoming event?

Attending an event? Speaking at a conference? Or exhibiting at a tradeshow? Easily inform your contacts by using a promotional banner in your email signature. This will ensure your organization’s most important contacts are in the know.

 
LVL 13

Expert Comment

by:George Sas
ID: 33606501
Have you tried to copy the repository from a working Windows 2003 ?
Do you have any OTHER errors in the eventlog beside this ?
0
 

Author Comment

by:VCSLI
ID: 33606613
I have attached a screenshot with the event log. This error is the only one i have.

I dont have another 2003 box to copy the repository from.


Screen-shot-2010-09-05-at-10.26..jpg
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33607269
Argh ... your server is also a DC....
Can the other machines see the DC ? Any errors in the system events ?

Here is a worfking repository from a 2003. Make a backup of yours before replacing. Stop WMI service and then copy the files.
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33607290
Cant upload so download it from here :
http://www.evosoft.dk/repos.zip
0
 

Author Comment

by:VCSLI
ID: 33608666
Are you danish? :D

Yes it is a DC. It's SBS 2003.

The only errors in the System category is this one:

Source Netlogon
The session setup from the computer DCW09 failed to authenticate. The name(s) of the account(s) referenced in the security database is DCW09$.  The following error occurred:
Access is denied.

It only comes from this one machine. I think this error is a wrong password?

Other than that it's clean.

After replacing the files, Now i'm getting all sorts of angry responses in the event viewer.

WinMgmt could not open the repository file.  This could be due to insufficient security access to the "<%SystemRoot%>\System32\WBEM\Repository", insufficient disk space or insufficient memory.

The MAD Monitoring thread was unable to connect to WMI, error '0x80041014'.

Windows cannot perform filter check for Group Policy object CN={D7C22EBA-C75D-46C7-8C2C-9F29FCE3F189},CN=Policies,CN=System,DC=DCW,DC=LOCAL. Group Policy processing aborted.

Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

I moved the Repository folder to the desktop, created a new folder in the "C:\WINDOWS\system32\wbem\" directory named Repository and put your files in there. Then i got the above errs.

0
 

Author Comment

by:VCSLI
ID: 33608696
Ok.

I put the ORIGINAL Repository back. I then copied your files to that folder and restarted WMI. Same silly err with your new files. No other err's other than that one.

The MAD Monitoring thread was unable to read its configuration from the DS, error '0x80041010'.
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33609482
Well , I'm out of ideas ... something else might be gone wrong but without hands-on the system I really don't know what else could be. Maybe a fresh perspective from someone else can help.
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33609493
Is your DC functioning correctly ? Is this the only DC in the domain ?
What DC is used on the exchange ? Check the Directory Access tab under your Exchange server properties in ESM.
What does "dcdiag" say ?
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33609513
run this from a command prompt:

MOFCOMP.EXE -N:root\cimv2\applications\exchange wbemcons.mof
MOFCOMP.EXE -N:root\cimv2\applications\exchange exwmi.mof
MOFCOMP.EXE -N:root\cimv2\applications\exchange exmgmt.mof
MOFCOMP.EXE -N:root\cimv2\applications\exchange msgtrk.mof

MOFCOMP.EXE -N:root\cimv2\applications\exchange smtpcons.mof

 

Wait 5 minutes and verify that the 9098 events don't reappear.
0
 

Author Comment

by:VCSLI
ID: 33612402
Yes it is the only DC in the domain.

The DC is functioning properly from what i can tell. Everything is just slow and was never maintained.

I've tried to run "dcdiag" in a command window, it says it cant find the file.

One thing i notice is when i click on Status in EMS, i get an err. Screenshot attached.

I can't find the "Directory Access" tab in ESM. Screenshot attached.

Included is the output for the code you attached above.


C:\Documents and Settings\Administrator\Desktop>MOFCOMP.EXE -N:root\cimv2\applic
ations\exchange wbemcons.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
File 'wbemcons.mof' not found!

C:\Documents and Settings\Administrator\Desktop>MOFCOMP.EXE -N:root\cimv2\applic
ations\exchange exwmi.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
File 'exwmi.mof' not found!

C:\Documents and Settings\Administrator\Desktop>MOFCOMP.EXE -N:root\cimv2\applic
ations\exchange exmgmt.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
File 'exmgmt.mof' not found!

C:\Documents and Settings\Administrator\Desktop>MOFCOMP.EXE -N:root\cimv2\applic
ations\exchange msgtrk.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
File 'msgtrk.mof' not found!

C:\Documents and Settings\Administrator\Desktop>MOFCOMP.EXE -N:root\cimv2\applic
ations\exchange smtpcons.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.1830
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
File 'smtpcons.mof' not found!

C:\Documents and Settings\Administrator\Desktop>pause
Press any key to continue . . .

Open in new window

Screen-shot-2010-09-06-at-12.29..jpg
Screen-shot-2010-09-06-at-12.32..jpg
0
 
LVL 13

Expert Comment

by:George Sas
ID: 33612869
The Dcdiag command-line tool is included when you install Windows Server 2003 Support Tools from the product CD or from the Microsoft Download Center (http://go.microsoft.com/fwlink/?LinkId=100114). For more information about how to install Windows Support Tools, see Install Windows Support Tools (http://go.microsoft.com/fwlink/?LinkId=62270).

http://technet.microsoft.com/en-us/library/cc773199%28WS.10%29.aspx
0
 

Author Comment

by:VCSLI
ID: 33612973
Here is the output.
C:\Program Files\Support Tools>dcdiag

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\DCWDC01
      Starting test: Connectivity
         ......................... DCWDC01 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\DCWDC01
      Starting test: Replications
         ......................... DCWDC01 passed test Replications
      Starting test: NCSecDesc
         ......................... DCWDC01 passed test NCSecDesc
      Starting test: NetLogons
         ......................... DCWDC01 passed test NetLogons
      Starting test: Advertising
         ......................... DCWDC01 passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... DCWDC01 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... DCWDC01 passed test RidManager
      Starting test: MachineAccount
         ......................... DCWDC01 passed test MachineAccount
      Starting test: Services
            IsmServ Service is stopped on [DCWDC01]
         ......................... DCWDC01 failed test Services
      Starting test: ObjectsReplicated
         ......................... DCWDC01 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... DCWDC01 passed test frssysvol
      Starting test: frsevent
         ......................... DCWDC01 passed test frsevent
      Starting test: kccevent
         ......................... DCWDC01 passed test kccevent
      Starting test: systemlog
         ......................... DCWDC01 passed test systemlog
      Starting test: VerifyReferences
         ......................... DCWDC01 passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : DCW
      Starting test: CrossRefValidation
         ......................... DCW passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DCW passed test CheckSDRefDom

   Running enterprise tests on : DCW.LOCAL
      Starting test: Intersite
         ......................... DCW.LOCAL passed test Intersite
      Starting test: FsmoCheck
         ......................... DCW.LOCAL passed test FsmoCheck

C:\Program Files\Support Tools>

Open in new window

0
 
LVL 13

Expert Comment

by:George Sas
ID: 33613853
K , your DC is ok.
The only problem still remains with the WMI which is gone bad.

http://windowsxp.mvps.org/repairwmi.htm

It applies also for Windows 2003.

Question : Do you have ANY files here : C:\WINDOWS\system32\wbem ???

REMEMBER , all the batch files , scripts etc you must run them on C:\WINDOWS\system32\wbem !! Is there where all the necessary files are and I can see some "file not found" on your script running !!!
Please review and do it in the right folder !
0
 

Author Comment

by:VCSLI
ID: 33623645
I have not had a chance to test this solution. I will try it tomorrow. Thanks so much for all your help. I'll replay soon.
0
 

Author Comment

by:VCSLI
ID: 33638910
I ran the attached script and that didn't work.

yes there are files in the wbem folder.


im running though the sets in that link you posted to me now. i'll post back in a bit.
net stop winmgmt
c:
cd %windir%\system32\wbem

MOFCOMP.EXE -C:root\cimv2\applications\exchange wbemcons.mof

MOFCOMP.EXE -C:root\cimv2\applications\exchange exwmi.mof

MOFCOMP.EXE -C:root\cimv2\applications\exchange exmgmt.mof

MOFCOMP.EXE -C:root\cimv2\applications\exchange msgtrk.mof

MOFCOMP.EXE -C:root\cimv2\applications\exchange smtpcons.mof

pause

Open in new window

0
 

Author Comment

by:VCSLI
ID: 33639009
Here is th log fromt the WMIDiag script in the link.
25395 12:55:51 (0) ** WMIDiag v2.0 started on Thursday, September 09, 2010 at 12:49.
25396 12:55:51 (0) ** 
25397 12:55:51 (0) ** Copyright (c) Microsoft Corporation. All rights reserved - January 2007.
25398 12:55:51 (0) ** 
25399 12:55:51 (0) ** This script is not supported under any Microsoft standard support program or service.
25400 12:55:51 (0) ** The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
25401 12:55:51 (0) ** implied warranties including, without limitation, any implied warranties of merchantability
25402 12:55:51 (0) ** or of fitness for a particular purpose. The entire risk arising out of the use or performance
25403 12:55:51 (0) ** of the scripts and documentation remains with you. In no event shall Microsoft, its authors,
25404 12:55:51 (0) ** or anyone else involved in the creation, production, or delivery of the script be liable for
25405 12:55:51 (0) ** any damages whatsoever (including, without limitation, damages for loss of business profits,
25406 12:55:51 (0) ** business interruption, loss of business information, or other pecuniary loss) arising out of
25407 12:55:51 (0) ** the use of or inability to use the script or documentation, even if Microsoft has been advised
25408 12:55:51 (0) ** of the possibility of such damages.
25409 12:55:51 (0) ** 
25410 12:55:51 (0) ** 
25411 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
25412 12:55:51 (0) ** ----------------------------------------------------- WMI REPORT: BEGIN ----------------------------------------------------------
25413 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
25414 12:55:51 (0) ** 
25415 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
25416 12:55:51 (0) ** Windows Server 2003 - No service pack - 32-bit (3790) - User 'DCW\ADMINISTRATOR' on computer 'DCWDC01'.
25417 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
25418 12:55:51 (0) ** INFO: Environment: .................................................................................................. 1 ITEM(S)!
25419 12:55:51 (0) ** INFO: => 5 incorrect shutdown(s) detected on:
25420 12:55:51 (0) **          - Shutdown on 05 November 2009 10:16:56 (GMT+4).
25421 12:55:51 (0) **          - Shutdown on 05 November 2009 10:30:26 (GMT+4).
25422 12:55:51 (0) **          - Shutdown on 15 April 2010 09:00:34 (GMT+4).
25423 12:55:51 (0) **          - Shutdown on 15 April 2010 09:13:14 (GMT+4).
25424 12:55:51 (0) **          - Shutdown on 24 August 2010 09:23:45 (GMT+4).
25425 12:55:51 (0) ** 
25426 12:55:51 (0) ** System drive: ....................................................................................................... C: (Disk #0 Partition #1).
25427 12:55:51 (0) ** Drive type: ......................................................................................................... SCSI (DELL Array SCSI Disk Device).
25428 12:55:51 (0) ** There are no missing WMI system files: .............................................................................. OK.
25429 12:55:51 (0) ** There are no missing WMI repository files: .......................................................................... OK.
25430 12:55:51 (0) ** WMI repository state: ............................................................................................... N/A.
25431 12:55:51 (0) ** BEFORE running WMIDiag:
25432 12:55:51 (0) ** The WMI repository has a size of: ................................................................................... 7 MB.
25433 12:55:51 (0) ** - Disk free space on 'C:': .......................................................................................... 117565 MB.
25434 12:55:51 (0) **   - INDEX.BTR,                     1335296 bytes,      9/9/2010 12:43:42 PM
25435 12:55:51 (0) **   - MAPPING.VER,                   4 bytes,            9/9/2010 12:48:23 PM
25436 12:55:51 (0) **   - MAPPING1.MAP,                  3416 bytes,         9/9/2010 12:43:42 PM
25437 12:55:51 (0) **   - MAPPING2.MAP,                  3416 bytes,         9/9/2010 12:48:23 PM
25438 12:55:51 (0) **   - OBJECTS.DATA,                  5562368 bytes,      9/9/2010 12:48:23 PM
25439 12:55:51 (0) ** AFTER running WMIDiag:
25440 12:55:51 (0) ** The WMI repository has a size of: ................................................................................... 7 MB.
25441 12:55:51 (0) ** - Disk free space on 'C:': .......................................................................................... 117562 MB.
25442 12:55:51 (0) **   - INDEX.BTR,                     1335296 bytes,      9/9/2010 12:43:42 PM
25443 12:55:51 (0) **   - MAPPING.VER,                   4 bytes,            9/9/2010 12:48:23 PM
25444 12:55:51 (0) **   - MAPPING1.MAP,                  3416 bytes,         9/9/2010 12:43:42 PM
25445 12:55:51 (0) **   - MAPPING2.MAP,                  3416 bytes,         9/9/2010 12:48:23 PM
25446 12:55:51 (0) **   - OBJECTS.DATA,                  5562368 bytes,      9/9/2010 12:48:23 PM
25447 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
25448 12:55:51 (0) ** Windows Firewall: ................................................................................................... NOT INSTALLED.
25449 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
25450 12:55:51 (2) !! WARNING: DCOM Status: ............................................................................................... WARNING!
25451 12:55:51 (2) !! WARNING: => The DCOM Default Impersonation is NOT set to 'Identify'.
25452 12:55:51 (0) **    This could prevent WMI to work correctly.
25453 12:55:51 (0) **    You can fix the DCOM configuration by:
25454 12:55:51 (0) **    - Executing the 'DCOMCNFG.EXE' command.
25455 12:55:51 (0) **    - Expanding 'Component Services' and 'Computers' nodes.
25456 12:55:51 (0) **    - Editing properties of 'My Computer' node.
25457 12:55:51 (0) **    - Editing the 'Default properties' tab.
25458 12:55:51 (0) **    - Set the 'Default Impersonation level' listbox to 'Identify'.
25459 12:55:51 (0) **    From the command line, the DCOM configuration can be corrected with the following command:
25460 12:55:51 (0) **    i.e. 'REG.EXE Add HKLM\SOFTWARE\Microsoft\Ole /v LegacyImpersonationLevel /t REG_DWORD /d 2 /f'
25461 12:55:51 (0) ** 
25462 12:55:51 (0) ** WMI registry setup: ................................................................................................. OK.
25463 12:55:51 (0) ** INFO: WMI service has dependents: ................................................................................... 1 SERVICE(S)!
25464 12:55:51 (0) ** - Exchange Management Service (MSEXCHANGEMGMT, StartMode='Automatic')
25465 12:55:51 (0) ** => If the WMI service is stopped, the listed service(s) will have to be stopped as well.
25466 12:55:51 (0) **    Note: If the service is marked with (*), it means that the service/application uses WMI but
25467 12:55:51 (0) **          there is no hard dependency on WMI. However, if the WMI service is stopped,
25468 12:55:51 (0) **          this can prevent the service/application to work as expected.
25469 12:55:51 (0) ** 
25470 12:55:51 (0) ** RPCSS service: ...................................................................................................... OK (Already started).
25471 12:55:51 (0) ** WINMGMT service: .................................................................................................... OK (Already started).
25472 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
25473 12:55:51 (0) ** WMI service DCOM setup: ............................................................................................. OK.
25474 12:55:51 (0) ** WMI components DCOM registrations: .................................................................................. OK.
25475 12:55:51 (0) ** WMI ProgID registrations: ........................................................................................... OK.
25476 12:55:51 (2) !! WARNING: WMI provider DCOM registrations missing for the following provider(s): ..................................... 3 WARNING(S)!
25477 12:55:51 (0) ** - ROOT/CIMV2/APPLICATIONS/EXCHANGE, ExchangeQueueProvider ({747F7C18-CB12-4A21-93AB-D5AC42A72226}) (i.e. WMI Class 'ExchangeLink')
25478 12:55:51 (0) **   Provider DLL: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'
25479 12:55:51 (0) ** - ROOT/CIMV2/APPLICATIONS/EXCHANGE, ExchangeRoutingTableProvider ({8AD3A98C-9C40-4D83-BB43-FE40665958B9}) (i.e. WMI Class 'ExchangeServerState')
25480 12:55:51 (0) **   Provider DLL: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'
25481 12:55:51 (0) ** - ROOT/CIMV2/APPLICATIONS/EXCHANGE, ExchangeClusterProvider ({59AA3CFC-DB22-455B-85DA-125F5A7CEDFB}) (i.e. WMI Class 'ExchangeClusterResource')
25482 12:55:51 (0) **   Provider DLL: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'
25483 12:55:51 (0) ** => This is an issue because there are still some WMI classes referencing this list of providers
25484 12:55:51 (0) **    while the DCOM registration is wrong or missing. This can be due to:
25485 12:55:51 (0) **    - a de-installation of the software.
25486 12:55:51 (0) **    - a deletion of some registry key data.
25487 12:55:51 (0) **    - a registry corruption.
25488 12:55:51 (0) ** => You can correct the DCOM configuration by:
25489 12:55:51 (0) **    - Executing the 'REGSVR32.EXE <Provider.DLL>' command.
25490 12:55:51 (0) **    Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.
25491 12:55:51 (0) **          (This list can be built on a similar and working WMI Windows installation)
25492 12:55:51 (0) **          The following command line must be used:
25493 12:55:51 (0) **          i.e. 'WMIDiag CorrelateClassAndProvider'
25494 12:55:51 (2) !! WARNING: Re-registering with REGSVR32.EXE all DLL from 'C:\WINDOWS\SYSTEM32\WBEM\'
25495 12:55:51 (0) **          may not solve the problem as the DLL supporting the WMI class(es)
25496 12:55:51 (0) **          can be located in a different folder.
25497 12:55:51 (0) **          You must refer to the class name to determine the software delivering the related DLL.
25498 12:55:51 (0) ** => If the software has been de-installed intentionally, then this information must be
25499 12:55:51 (0) **    removed from the WMI repository. You can use the 'WMIC.EXE' command to remove
25500 12:55:51 (0) **    the provider registration data.
25501 12:55:51 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\CIMV2\APPLICATIONS\EXCHANGE path __Win32Provider Where Name='ExchangeClusterProvider' DELETE'
25502 12:55:51 (0) ** => If the namespace was ENTIRELY dedicated to the intentionally de-installed software,
25503 12:55:51 (0) **    the namespace and ALL its content can be ENTIRELY deleted.
25504 12:55:51 (0) **    i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\CIMV2\APPLICATIONS path __NAMESPACE Where Name='EXCHANGE' DELETE'
25505 12:55:51 (0) **    - Re-installing the software.
25506 12:55:51 (0) ** 
25507 12:55:51 (0) ** WMI provider CIM registrations: ..................................................................................... OK.
25508 12:55:51 (0) ** WMI provider CLSIDs: ................................................................................................ OK.
25509 12:55:51 (0) ** WMI providers EXE/DLL availability: ................................................................................. OK.
25510 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
25511 12:55:51 (0) ** WMI namespace security for 'ROOT/PERFMON': .......................................................................... MODIFIED.
25512 12:55:51 (1) !! ERROR: Default trustee 'BUILTIN\PERFORMANCE LOG USERS' has been REMOVED!
25513 12:55:51 (0) **        - REMOVED ACE:
25514 12:55:51 (0) **          ACEType:  &h0
25515 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25516 12:55:51 (0) **          ACEFlags: &h12
25517 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25518 12:55:51 (0) **                    INHERITED_ACE
25519 12:55:51 (0) **          ACEMask:  &h23
25520 12:55:51 (0) **                    WBEM_ENABLE
25521 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25522 12:55:51 (0) **                    WBEM_REMOTE_ACCESS
25523 12:55:51 (0) ** 
25524 12:55:51 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
25525 12:55:51 (0) **    Removing default security will cause some operations to fail!
25526 12:55:51 (0) **    It is possible to fix this issue by editing the security descriptor and adding the ACE.
25527 12:55:51 (0) **    For WMI namespaces, this can be done with 'WMIMGMT.MSC'.
25528 12:55:51 (0) ** 
25529 12:55:51 (0) ** WMI namespace security for 'ROOT/RSOP': ............................................................................. MODIFIED.
25530 12:55:51 (1) !! ERROR: Actual trustee 'NT AUTHORITY\NETWORK SERVICE' DOES NOT match corresponding expected trustee rights (Actual->Default)
25531 12:55:51 (0) **        - ACTUAL ACE:
25532 12:55:51 (0) **          ACEType:  &h0
25533 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25534 12:55:51 (0) **          ACEFlags: &h12
25535 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25536 12:55:51 (0) **                    INHERITED_ACE
25537 12:55:51 (0) **          ACEMask:  &h13
25538 12:55:51 (0) **                    WBEM_ENABLE
25539 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25540 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25541 12:55:51 (0) **        - EXPECTED ACE:
25542 12:55:51 (0) **          ACEType:  &h0
25543 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25544 12:55:51 (0) **          ACEFlags: &h12
25545 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25546 12:55:51 (0) **                    INHERITED_ACE
25547 12:55:51 (0) **          ACEMask:  &h6003F
25548 12:55:51 (0) **                    WBEM_ENABLE
25549 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25550 12:55:51 (0) **                    WBEM_FULL_WRITE_REP
25551 12:55:51 (0) **                    WBEM_PARTIAL_WRITE_REP
25552 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25553 12:55:51 (0) **                    WBEM_REMOTE_ACCESS
25554 12:55:51 (0) **                    WBEM_WRITE_DAC
25555 12:55:51 (0) **                    WBEM_READ_CONTROL
25556 12:55:51 (0) ** 
25557 12:55:51 (0) ** => The actual ACE has the right(s) '&h6002C WBEM_FULL_WRITE_REP WBEM_PARTIAL_WRITE_REP WBEM_REMOTE_ACCESS WBEM_WRITE_DAC WBEM_READ_CONTROL' removed!
25558 12:55:51 (0) **    This will cause some operations to fail!
25559 12:55:51 (0) **    It is possible to fix this issue by editing the security descriptor and adding the removed right.
25560 12:55:51 (0) **    For WMI namespaces, this can be done with 'WMIMGMT.MSC'.
25561 12:55:51 (0) ** 
25562 12:55:51 (0) ** WMI namespace security for 'ROOT/RSOP': ............................................................................. MODIFIED.
25563 12:55:51 (1) !! ERROR: Default trustee 'NT AUTHORITY\SYSTEM' has been REMOVED!
25564 12:55:51 (0) **        - REMOVED ACE:
25565 12:55:51 (0) **          ACEType:  &h0
25566 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25567 12:55:51 (0) **          ACEFlags: &h12
25568 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25569 12:55:51 (0) **                    INHERITED_ACE
25570 12:55:51 (0) **          ACEMask:  &h6003F
25571 12:55:51 (0) **                    WBEM_ENABLE
25572 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25573 12:55:51 (0) **                    WBEM_FULL_WRITE_REP
25574 12:55:51 (0) **                    WBEM_PARTIAL_WRITE_REP
25575 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25576 12:55:51 (0) **                    WBEM_REMOTE_ACCESS
25577 12:55:51 (0) **                    WBEM_WRITE_DAC
25578 12:55:51 (0) **                    WBEM_READ_CONTROL
25579 12:55:51 (0) ** 
25580 12:55:51 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
25581 12:55:51 (0) **    Removing default security will cause some operations to fail!
25582 12:55:51 (0) **    It is possible to fix this issue by editing the security descriptor and adding the ACE.
25583 12:55:51 (0) **    For WMI namespaces, this can be done with 'WMIMGMT.MSC'.
25584 12:55:51 (0) ** 
25585 12:55:51 (0) ** WMI namespace security for 'ROOT/RSOP': ............................................................................. MODIFIED.
25586 12:55:51 (1) !! ERROR: Default trustee 'NT AUTHORITY\AUTHENTICATED USERS' has been REMOVED!
25587 12:55:51 (0) **        - REMOVED ACE:
25588 12:55:51 (0) **          ACEType:  &h0
25589 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25590 12:55:51 (0) **          ACEFlags: &h12
25591 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25592 12:55:51 (0) **                    INHERITED_ACE
25593 12:55:51 (0) **          ACEMask:  &h23
25594 12:55:51 (0) **                    WBEM_ENABLE
25595 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25596 12:55:51 (0) **                    WBEM_REMOTE_ACCESS
25597 12:55:51 (0) ** 
25598 12:55:51 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
25599 12:55:51 (0) **    Removing default security will cause some operations to fail!
25600 12:55:51 (0) **    It is possible to fix this issue by editing the security descriptor and adding the ACE.
25601 12:55:51 (0) **    For WMI namespaces, this can be done with 'WMIMGMT.MSC'.
25602 12:55:51 (0) ** 
25603 12:55:51 (0) ** WMI namespace security for 'ROOT/RSOP/USER': ........................................................................ MODIFIED.
25604 12:55:51 (1) !! ERROR: Actual trustee 'NT AUTHORITY\NETWORK SERVICE' DOES NOT match corresponding expected trustee rights (Actual->Default)
25605 12:55:51 (0) **        - ACTUAL ACE:
25606 12:55:51 (0) **          ACEType:  &h0
25607 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25608 12:55:51 (0) **          ACEFlags: &h12
25609 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25610 12:55:51 (0) **                    INHERITED_ACE
25611 12:55:51 (0) **          ACEMask:  &h13
25612 12:55:51 (0) **                    WBEM_ENABLE
25613 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25614 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25615 12:55:51 (0) **        - EXPECTED ACE:
25616 12:55:51 (0) **          ACEType:  &h0
25617 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25618 12:55:51 (0) **          ACEFlags: &h12
25619 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25620 12:55:51 (0) **                    INHERITED_ACE
25621 12:55:51 (0) **          ACEMask:  &h6003F
25622 12:55:51 (0) **                    WBEM_ENABLE
25623 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25624 12:55:51 (0) **                    WBEM_FULL_WRITE_REP
25625 12:55:51 (0) **                    WBEM_PARTIAL_WRITE_REP
25626 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25627 12:55:51 (0) **                    WBEM_REMOTE_ACCESS
25628 12:55:51 (0) **                    WBEM_WRITE_DAC
25629 12:55:51 (0) **                    WBEM_READ_CONTROL
25630 12:55:51 (0) ** 
25631 12:55:51 (0) ** => The actual ACE has the right(s) '&h6002C WBEM_FULL_WRITE_REP WBEM_PARTIAL_WRITE_REP WBEM_REMOTE_ACCESS WBEM_WRITE_DAC WBEM_READ_CONTROL' removed!
25632 12:55:51 (0) **    This will cause some operations to fail!
25633 12:55:51 (0) **    It is possible to fix this issue by editing the security descriptor and adding the removed right.
25634 12:55:51 (0) **    For WMI namespaces, this can be done with 'WMIMGMT.MSC'.
25635 12:55:51 (0) ** 
25636 12:55:51 (0) ** WMI namespace security for 'ROOT/RSOP/USER': ........................................................................ MODIFIED.
25637 12:55:51 (1) !! ERROR: Default trustee 'NT AUTHORITY\SYSTEM' has been REMOVED!
25638 12:55:51 (0) **        - REMOVED ACE:
25639 12:55:51 (0) **          ACEType:  &h0
25640 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25641 12:55:51 (0) **          ACEFlags: &h12
25642 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25643 12:55:51 (0) **                    INHERITED_ACE
25644 12:55:51 (0) **          ACEMask:  &h6003F
25645 12:55:51 (0) **                    WBEM_ENABLE
25646 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25647 12:55:51 (0) **                    WBEM_FULL_WRITE_REP
25648 12:55:51 (0) **                    WBEM_PARTIAL_WRITE_REP
25649 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25650 12:55:51 (0) **                    WBEM_REMOTE_ACCESS
25651 12:55:51 (0) **                    WBEM_WRITE_DAC
25652 12:55:51 (0) **                    WBEM_READ_CONTROL
25653 12:55:51 (0) ** 
25654 12:55:51 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
25655 12:55:51 (0) **    Removing default security will cause some operations to fail!
25656 12:55:51 (0) **    It is possible to fix this issue by editing the security descriptor and adding the ACE.
25657 12:55:51 (0) **    For WMI namespaces, this can be done with 'WMIMGMT.MSC'.
25658 12:55:51 (0) ** 
25659 12:55:51 (0) ** WMI namespace security for 'ROOT/RSOP/COMPUTER': .................................................................... MODIFIED.
25660 12:55:51 (1) !! ERROR: Actual trustee 'NT AUTHORITY\NETWORK SERVICE' DOES NOT match corresponding expected trustee rights (Actual->Default)
25661 12:55:51 (0) **        - ACTUAL ACE:
25662 12:55:51 (0) **          ACEType:  &h0
25663 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25664 12:55:51 (0) **          ACEFlags: &h12
25665 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25666 12:55:51 (0) **                    INHERITED_ACE
25667 12:55:51 (0) **          ACEMask:  &h13
25668 12:55:51 (0) **                    WBEM_ENABLE
25669 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25670 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25671 12:55:51 (0) **        - EXPECTED ACE:
25672 12:55:51 (0) **          ACEType:  &h0
25673 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25674 12:55:51 (0) **          ACEFlags: &h12
25675 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25676 12:55:51 (0) **                    INHERITED_ACE
25677 12:55:51 (0) **          ACEMask:  &h6003F
25678 12:55:51 (0) **                    WBEM_ENABLE
25679 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25680 12:55:51 (0) **                    WBEM_FULL_WRITE_REP
25681 12:55:51 (0) **                    WBEM_PARTIAL_WRITE_REP
25682 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25683 12:55:51 (0) **                    WBEM_REMOTE_ACCESS
25684 12:55:51 (0) **                    WBEM_WRITE_DAC
25685 12:55:51 (0) **                    WBEM_READ_CONTROL
25686 12:55:51 (0) ** 
25687 12:55:51 (0) ** => The actual ACE has the right(s) '&h6002C WBEM_FULL_WRITE_REP WBEM_PARTIAL_WRITE_REP WBEM_REMOTE_ACCESS WBEM_WRITE_DAC WBEM_READ_CONTROL' removed!
25688 12:55:51 (0) **    This will cause some operations to fail!
25689 12:55:51 (0) **    It is possible to fix this issue by editing the security descriptor and adding the removed right.
25690 12:55:51 (0) **    For WMI namespaces, this can be done with 'WMIMGMT.MSC'.
25691 12:55:51 (0) ** 
25692 12:55:51 (0) ** WMI namespace security for 'ROOT/RSOP/COMPUTER': .................................................................... MODIFIED.
25693 12:55:51 (1) !! ERROR: Default trustee 'NT AUTHORITY\SYSTEM' has been REMOVED!
25694 12:55:51 (0) **        - REMOVED ACE:
25695 12:55:51 (0) **          ACEType:  &h0
25696 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25697 12:55:51 (0) **          ACEFlags: &h12
25698 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25699 12:55:51 (0) **                    INHERITED_ACE
25700 12:55:51 (0) **          ACEMask:  &h6003F
25701 12:55:51 (0) **                    WBEM_ENABLE
25702 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25703 12:55:51 (0) **                    WBEM_FULL_WRITE_REP
25704 12:55:51 (0) **                    WBEM_PARTIAL_WRITE_REP
25705 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25706 12:55:51 (0) **                    WBEM_REMOTE_ACCESS
25707 12:55:51 (0) **                    WBEM_WRITE_DAC
25708 12:55:51 (0) **                    WBEM_READ_CONTROL
25709 12:55:51 (0) ** 
25710 12:55:51 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
25711 12:55:51 (0) **    Removing default security will cause some operations to fail!
25712 12:55:51 (0) **    It is possible to fix this issue by editing the security descriptor and adding the ACE.
25713 12:55:51 (0) **    For WMI namespaces, this can be done with 'WMIMGMT.MSC'.
25714 12:55:51 (0) ** 
25715 12:55:51 (0) ** WMI namespace security for 'ROOT/ASPNET': ........................................................................... MODIFIED.
25716 12:55:51 (1) !! ERROR: Actual trustee 'NT AUTHORITY\NETWORK SERVICE' DOES NOT match corresponding expected trustee rights (Actual->Default)
25717 12:55:51 (0) **        - ACTUAL ACE:
25718 12:55:51 (0) **          ACEType:  &h0
25719 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25720 12:55:51 (0) **          ACEFlags: &h12
25721 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25722 12:55:51 (0) **                    INHERITED_ACE
25723 12:55:51 (0) **          ACEMask:  &h13
25724 12:55:51 (0) **                    WBEM_ENABLE
25725 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25726 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25727 12:55:51 (0) **        - EXPECTED ACE:
25728 12:55:51 (0) **          ACEType:  &h0
25729 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25730 12:55:51 (0) **          ACEFlags: &h12
25731 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25732 12:55:51 (0) **                    INHERITED_ACE
25733 12:55:51 (0) **          ACEMask:  &h33
25734 12:55:51 (0) **                    WBEM_ENABLE
25735 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25736 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25737 12:55:51 (0) **                    WBEM_REMOTE_ACCESS
25738 12:55:51 (0) ** 
25739 12:55:51 (0) ** => The actual ACE has the right(s) '&h20 WBEM_REMOTE_ACCESS' removed!
25740 12:55:51 (0) **    This will cause some operations to fail!
25741 12:55:51 (0) **    It is possible to fix this issue by editing the security descriptor and adding the removed right.
25742 12:55:51 (0) **    For WMI namespaces, this can be done with 'WMIMGMT.MSC'.
25743 12:55:51 (0) ** 
25744 12:55:51 (0) ** WMI namespace security for 'ROOT/ASPNET': ........................................................................... MODIFIED.
25745 12:55:51 (1) !! ERROR: Actual trustee 'NT AUTHORITY\LOCAL SERVICE' DOES NOT match corresponding expected trustee rights (Actual->Default)
25746 12:55:51 (0) **        - ACTUAL ACE:
25747 12:55:51 (0) **          ACEType:  &h0
25748 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25749 12:55:51 (0) **          ACEFlags: &h12
25750 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25751 12:55:51 (0) **                    INHERITED_ACE
25752 12:55:51 (0) **          ACEMask:  &h13
25753 12:55:51 (0) **                    WBEM_ENABLE
25754 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25755 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25756 12:55:51 (0) **        - EXPECTED ACE:
25757 12:55:51 (0) **          ACEType:  &h0
25758 12:55:51 (0) **                    ACCESS_ALLOWED_ACE_TYPE
25759 12:55:51 (0) **          ACEFlags: &h12
25760 12:55:51 (0) **                    CONTAINER_INHERIT_ACE
25761 12:55:51 (0) **                    INHERITED_ACE
25762 12:55:51 (0) **          ACEMask:  &h33
25763 12:55:51 (0) **                    WBEM_ENABLE
25764 12:55:51 (0) **                    WBEM_METHOD_EXECUTE
25765 12:55:51 (0) **                    WBEM_WRITE_PROVIDER
25766 12:55:51 (0) **                    WBEM_REMOTE_ACCESS
25767 12:55:51 (0) ** 
25768 12:55:51 (0) ** => The actual ACE has the right(s) '&h20 WBEM_REMOTE_ACCESS' removed!
25769 12:55:51 (0) **    This will cause some operations to fail!
25770 12:55:51 (0) **    It is possible to fix this issue by editing the security descriptor and adding the removed right.
25771 12:55:51 (0) **    For WMI namespaces, this can be done with 'WMIMGMT.MSC'.
25772 12:55:51 (0) ** 
25773 12:55:51 (0) ** 
25774 12:55:51 (0) ** DCOM security warning(s) detected: .................................................................................. 0.
25775 12:55:51 (0) ** DCOM security error(s) detected: .................................................................................... 0.
25776 12:55:51 (0) ** WMI security warning(s) detected: ................................................................................... 0.
25777 12:55:51 (0) ** WMI security error(s) detected: ..................................................................................... 10.
25778 12:55:51 (0) ** 
25779 12:55:51 (0) ** Overall DCOM security status: ....................................................................................... OK.
25780 12:55:51 (1) !! ERROR: Overall WMI security status: ................................................................................. ERROR!
25781 12:55:51 (0) ** - Started at 'Root' --------------------------------------------------------------------------------------------------------------
25782 12:55:51 (0) ** INFO: WMI permanent SUBSCRIPTION(S): ................................................................................ 54.
25783 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA44".
25784 12:55:51 (0) **   'select * from MSMCAEvent_InvalidError where (type = 2147811432) and (LogToEventlog <> 0)'
25785 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA23".
25786 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553235) and (LogToEventlog <> 0)'
25787 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA32".
25788 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811420) and (LogToEventlog <> 0)'
25789 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA14".
25790 12:55:51 (0) **   'select * from MSMCAEvent_MemoryError where (type = 2147811402) and (LogToEventlog <> 0)'
25791 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA37".
25792 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553249) and (LogToEventlog <> 0)'
25793 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="SCM Event Log Consumer".
25794 12:55:51 (0) **   'select * from MSFT_SCMEventLogEvent'
25795 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA5".
25796 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553217) and (LogToEventlog <> 0)'
25797 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA18".
25798 12:55:51 (0) **   'select * from MSMCAEvent_SystemEventError where (type = 2147811406) and (LogToEventlog <> 0)'
25799 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA3".
25800 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553215) and (LogToEventlog <> 0)'
25801 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA41".
25802 12:55:51 (0) **   'select * from MSMCAEvent_SMBIOSError where (type = 3221553253) and (LogToEventlog <> 0)'
25803 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA26".
25804 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811414) and (LogToEventlog <> 0)'
25805 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA36".
25806 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811424) and (LogToEventlog <> 0)'
25807 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA9".
25808 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553221) and (LogToEventlog <> 0) and not ((MSSid = 0) and ((MsOp <> 3) or (MSOp <> 4)))'
25809 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA10".
25810 12:55:51 (0) **   'select * from MSMCAEvent_MemoryError where (type = 2147811398) and (LogToEventlog <> 0)'
25811 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA17".
25812 12:55:51 (0) **   'select * from MSMCAEvent_MemoryError where (type = 3221553229) and (LogToEventlog <> 0)'
25813 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA1".
25814 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553213) and (LogToEventlog <> 0)'
25815 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA42".
25816 12:55:51 (0) **   'select * from MSMCAEvent_PlatformSpecificError where (type = 2147811430) and (LogToEventlog <> 0)'
25817 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA4".
25818 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811392) and (LogToEventlog <> 0)'
25819 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA25".
25820 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553237) and (LogToEventlog <> 0)'
25821 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA49".
25822 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (MajorErrorType = 4) and (MSSid = 0) and (MSOp = 4) and (LogToEventlog <> 0)'
25823 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA27".
25824 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553239) and (LogToEventlog <> 0)'
25825 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA45".
25826 12:55:51 (0) **   'select * from MSMCAEvent_InvalidError where (type = 3221553257) and (LogToEventlog <> 0)'
25827 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA8".
25828 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811396) and (LogToEventlog <> 0) and not ((MSSid = 0) and ((MsOp <> 3) or (MSOp <> 4)))'
25829 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA40".
25830 12:55:51 (0) **   'select * from MSMCAEvent_SMBIOSError where (type = 2147811428) and (LogToEventlog <> 0)'
25831 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA39".
25832 12:55:51 (0) **   'select * from MSMCAEvent_PCIComponentError where (type = 3221553251) and (LogToEventlog <> 0)'
25833 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA29".
25834 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553241) and (LogToEventlog <> 0)'
25835 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA20".
25836 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811408) and (LogToEventlog <> 0)'
25837 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA48".
25838 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (MajorErrorType = 4) and (MSSid = 0) and (MSOp = 3) and (LogToEventlog <> 0)'
25839 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA28".
25840 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811416) and (LogToEventlog <> 0)'
25841 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA33".
25842 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553245) and (LogToEventlog <> 0)'
25843 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA7".
25844 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553219) and (LogToEventlog <> 0)'
25845 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA16".
25846 12:55:51 (0) **   'select * from MSMCAEvent_MemoryError where (type = 2147811404) and (LogToEventlog <> 0)'
25847 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA43".
25848 12:55:51 (0) **   'select * from MSMCAEvent_PlatformSpecificError where (type = 3221553255) and (LogToEventlog <> 0)'
25849 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA21".
25850 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553233) and (LogToEventlog <> 0)'
25851 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA6".
25852 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811394) and (LogToEventlog <> 0)'
25853 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA31".
25854 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553243) and (LogToEventlog <> 0)'
25855 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA12".
25856 12:55:51 (0) **   'select * from MSMCAEvent_MemoryError where (type = 2147811400) and (LogToEventlog <> 0)'
25857 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA46".
25858 12:55:51 (0) **   'select * from MSMCAEvent_InvalidError where (type = 2147811434) and (LogToEventlog <> 0)'
25859 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA47".
25860 12:55:51 (0) **   'select * from MSMCAEvent_InvalidError where (type = 3221553259) and (LogToEventlog <> 0)'
25861 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA35".
25862 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 3221553247) and (LogToEventlog <> 0)'
25863 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA0".
25864 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811388) and (LogToEventlog <> 0)'
25865 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA19".
25866 12:55:51 (0) **   'select * from MSMCAEvent_SystemEventError where (type = 3221553231) and (LogToEventlog <> 0)'
25867 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA11".
25868 12:55:51 (0) **   'select * from MSMCAEvent_MemoryError where (type = 3221553223) and (LogToEventlog <> 0)'
25869 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA52".
25870 12:55:51 (0) **   'select * from MSMCAEvent_MemoryPageRemoved'
25871 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA30".
25872 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811418) and (LogToEventlog <> 0)'
25873 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA15".
25874 12:55:51 (0) **   'select * from MSMCAEvent_MemoryError where (type = 3221553227) and (LogToEventlog <> 0)'
25875 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA38".
25876 12:55:51 (0) **   'select * from MSMCAEvent_PCIComponentError where (type = 2147811426) and (LogToEventlog <> 0)'
25877 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA34".
25878 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811422) and (LogToEventlog <> 0)'
25879 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA2".
25880 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811390) and (LogToEventlog <> 0)'
25881 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA22".
25882 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811410) and (LogToEventlog <> 0)'
25883 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA13".
25884 12:55:51 (0) **   'select * from MSMCAEvent_MemoryError where (type = 3221553225) and (LogToEventlog <> 0)'
25885 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA50".
25886 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 2147811441) and (LogToEventlog <> 0)'
25887 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA51".
25888 12:55:51 (0) **   'select * from MSMCAEvent_CPUError where (type = 3221553266) and (LogToEventlog <> 0)'
25889 12:55:51 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="MCA24".
25890 12:55:51 (0) **   'select * from MSMCAEvent_PCIBusError where (type = 2147811412) and (LogToEventlog <> 0)'
25891 12:55:51 (0) ** 
25892 12:55:51 (0) ** WMI TIMER instruction(s): ........................................................................................... NONE.
25893 12:55:51 (2) !! WARNING: WMI ADAP status: ........................................................................................... 0.
25894 12:55:51 (0) ** => The WMI ADAP process has never run on this computer (0).
25895 12:55:51 (0) **    You can start the WMI AutoDiscovery/AutoPurge (ADAP) process to resynchronize
25896 12:55:51 (0) **    the performance counters with the WMI performance classes with the following commands:
25897 12:55:51 (0) **    i.e. 'WINMGMT.EXE /CLEARADAP'
25898 12:55:51 (0) **    i.e. 'WINMGMT.EXE /RESYNCPERF'
25899 12:55:51 (0) **    The ADAP process logs informative events in the Windows NT event log.
25900 12:55:51 (0) **    More information can be found on MSDN at:
25901 12:55:51 (0) **    http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/wmi_adap_event_log_events.asp
25902 12:55:51 (0) ** INFO: WMI namespace(s) requiring PACKET PRIVACY: .................................................................... 1 NAMESPACE(S)!
25903 12:55:51 (0) ** - ROOT/SERVICEMODEL.
25904 12:55:51 (0) ** => When remotely connecting, the namespace(s) listed require(s) the WMI client to
25905 12:55:51 (0) **    use an encrypted connection by specifying the PACKET PRIVACY authentication level.
25906 12:55:51 (0) **    (RPC_C_AUTHN_LEVEL_PKT_PRIVACY or PktPrivacy flags)
25907 12:55:51 (0) **    i.e. 'WMIC.EXE /NODE:"DCWDC01" /AUTHLEVEL:Pktprivacy /NAMESPACE:\\ROOT\SERVICEMODEL Class __SystemSecurity'
25908 12:55:51 (0) ** 
25909 12:55:51 (0) ** WMI MONIKER CONNECTIONS: ............................................................................................ OK.
25910 12:55:51 (0) ** WMI CONNECTIONS: .................................................................................................... OK.
25911 12:55:51 (1) !! ERROR: WMI GET operation errors reported: ........................................................................... 27 ERROR(S)!
25912 12:55:51 (0) ** - Root/CIMv2, Win32_Perf, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25913 12:55:51 (0) **   MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'
25914 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25915 12:55:51 (0) **   MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'
25916 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_Tcpip_IPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25917 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25918 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_Tcpip_TCPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25919 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25920 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_Tcpip_UDPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25921 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25922 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_Tcpip_ICMP, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25923 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25924 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_PerfOS_Cache, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25925 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25926 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_PerfOS_Memory, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25927 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25928 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_PerfOS_Objects, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25929 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25930 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_PerfOS_PagingFile, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25931 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25932 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_PerfOS_Processor, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25933 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25934 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_PerfOS_System, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25935 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25936 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_PerfProc_Process, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25937 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25938 12:55:51 (0) ** - Root/CIMv2, Win32_PerfRawData_PerfProc_Thread, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25939 12:55:51 (0) **   MOF Registration: 'No located MOF file (exception)'
25940 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25941 12:55:51 (0) **   MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'
25942 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_Tcpip_IPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25943 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25944 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_Tcpip_TCPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25945 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25946 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_Tcpip_UDPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25947 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25948 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_Tcpip_ICMP, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25949 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25950 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_PerfOS_Cache, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25951 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25952 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_PerfOS_Memory, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25953 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25954 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_PerfOS_Objects, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25955 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25956 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_PerfOS_PagingFile, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25957 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25958 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_PerfOS_Processor, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25959 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25960 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_PerfOS_System, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25961 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25962 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_PerfProc_Process, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25963 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25964 12:55:51 (0) ** - Root/CIMv2, Win32_PerfFormattedData_PerfProc_Thread, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
25965 12:55:51 (0) **   MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
25966 12:55:51 (0) ** => When a WMI performance class is missing (i.e. 'Win32_PerfFormattedData_PerfProc_Thread'), it is generally due to
25967 12:55:51 (0) **    a synchronization issue between the performance counters and WMI.
25968 12:55:51 (0) **    The AutoDiscovery/AutoPurge (ADAP) process logs informative events in the Windows NT event log.
25969 12:55:51 (0) **    More information can be found on MSDN at:
25970 12:55:51 (0) **    http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/wmi_adap_event_log_events.asp
25971 12:55:51 (0) ** 
25972 12:55:51 (0) **    - The last time the ADAP process was STARTED was the '00 0000 00:00:00:000000 (GMT-0)'.
25973 12:55:51 (0) **    - The last time the ADAP process was STOPPED was the '00 0000 00:00:00:000000 (GMT-0)'.
25974 12:55:51 (0) **    - The latest ADAP process status is 'The WMI ADAP process has never run on this computer (0).'.
25975 12:55:51 (0) ** 
25976 12:55:51 (0) **    You can attempt to resynchronize the WMI performance classes with the existing Windows
25977 12:55:51 (0) **    performance counters with the following commands:
25978 12:55:51 (0) **    i.e. 'WINMGMT.EXE /CLEARADAP'
25979 12:55:51 (0) **    i.e. 'WINMGMT.EXE /RESYNCPERF'
25980 12:55:51 (0) ** 
25981 12:55:51 (0) ** WMI MOF representations: ............................................................................................ OK.
25982 12:55:51 (0) ** WMI QUALIFIER access operations: .................................................................................... OK.
25983 12:55:51 (0) ** WMI ENUMERATION operations: ......................................................................................... OK.
25984 12:55:51 (0) ** WMI EXECQUERY operations: ........................................................................................... OK.
25985 12:55:51 (0) ** WMI GET VALUE operations: ........................................................................................... OK.
25986 12:55:51 (0) ** WMI WRITE operations: ............................................................................................... NOT TESTED.
25987 12:55:51 (0) ** WMI PUT operations: ................................................................................................. NOT TESTED.
25988 12:55:51 (0) ** WMI DELETE operations: .............................................................................................. NOT TESTED.
25989 12:55:51 (0) ** WMI static instances retrieved: ..................................................................................... 1280.
25990 12:55:51 (0) ** WMI dynamic instances retrieved: .................................................................................... 0.
25991 12:55:51 (0) ** WMI instance request cancellations (to limit performance impact): ................................................... 0.
25992 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
25993 12:55:51 (0) ** # of Event Log events BEFORE WMIDiag execution since the last 20 day(s):
25994 12:55:51 (0) **   DCOM: ............................................................................................................. 4.
25995 12:55:51 (0) **   WINMGMT: .......................................................................................................... 0.
25996 12:55:51 (0) **   WMIADAPTER: ....................................................................................................... 0.
25997 12:55:51 (0) ** => Verify the WMIDiag LOG at line #24580 for more details.
25998 12:55:51 (0) ** 
25999 12:55:51 (0) ** # of additional Event Log events AFTER WMIDiag execution:
26000 12:55:51 (0) **   DCOM: ............................................................................................................. 0.
26001 12:55:51 (0) **   WINMGMT: .......................................................................................................... 0.
26002 12:55:51 (0) **   WMIADAPTER: ....................................................................................................... 0.
26003 12:55:51 (0) ** 
26004 12:55:51 (0) ** 27 error(s) 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found
26005 12:55:51 (0) ** => This error is typically a WMI error. This WMI error is due to:
26006 12:55:51 (0) **    - a missing WMI class definition or object.
26007 12:55:51 (0) **      (See any GET, ENUMERATION, EXECQUERY and GET VALUE operation failures).
26008 12:55:51 (0) **      You can correct the missing class definitions by:
26009 12:55:51 (0) **      - Manually recompiling the MOF file(s) with the 'MOFCOMP <FileName.MOF>' command.
26010 12:55:51 (0) **      Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.
26011 12:55:51 (0) **            (This list can be built on a similar and working WMI Windows installation)
26012 12:55:51 (0) **            The following command line must be used:
26013 12:55:51 (0) **            i.e. 'WMIDiag CorrelateClassAndProvider'
26014 12:55:51 (0) **      Note: When a WMI performance class is missing, you can manually resynchronize performance counters
26015 12:55:51 (0) **            with WMI by starting the ADAP process.
26016 12:55:51 (0) **    - a WMI repository corruption.
26017 12:55:51 (0) **      In such a case, you must rerun WMIDiag with 'WriteInRepository' parameter
26018 12:55:51 (0) **      to validate the WMI repository operations.
26019 12:55:51 (0) **    Note: ENSURE you are an administrator with FULL access to WMI EVERY namespaces of the computer before
26020 12:55:51 (0) **          executing the WriteInRepository command. To write temporary data from the Root namespace, use:
26021 12:55:51 (0) **          i.e. 'WMIDiag WriteInRepository=Root'
26022 12:55:51 (0) **    - If the WriteInRepository command fails, while being an Administrator with ALL accesses to ALL namespaces
26023 12:55:51 (0) **      the WMI repository must be reconstructed.
26024 12:55:51 (0) **    Note: The WMI repository reconstruction requires to locate all MOF files needed to rebuild the repository,
26025 12:55:51 (0) **          otherwise some applications may fail after the reconstruction.
26026 12:55:51 (0) **          This can be achieved with the following command:
26027 12:55:51 (0) **          i.e. 'WMIDiag ShowMOFErrors'
26028 12:55:51 (0) **    Note: The repository reconstruction must be a LAST RESORT solution and ONLY after executing
26029 12:55:51 (0) **          ALL fixes previously mentioned.
26030 12:55:51 (2) !! WARNING: Static information stored by external applications in the repository will be LOST! (i.e. SMS Inventory)
26031 12:55:51 (0) ** 
26032 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
26033 12:55:51 (0) ** WMI Registry key setup: ............................................................................................. OK.
26034 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
26035 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
26036 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
26037 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
26038 12:55:51 (0) ** 
26039 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
26040 12:55:51 (0) ** ------------------------------------------------------ WMI REPORT: END -----------------------------------------------------------
26041 12:55:51 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
26042 12:55:51 (0) ** 
26043 12:55:51 (0) ** ERROR: WMIDiag detected issues that could prevent WMI to work properly!.  Check 'C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\WMIDIAG-V2.0_2003_.SRV.RTM.32_DCWDC01_2010.09.09_12.49.06.LOG' for details.
26044 12:55:51 (0) ** 
26045 12:55:51 (0) ** WMIDiag v2.0 ended on Thursday, September 09, 2010 at 12:55 (W:121 E:48 S:1).

Open in new window

0
 

Author Comment

by:VCSLI
ID: 33639094
Actually, here is a download link for both files.

http://www.2shared.com/file/_ydTx771/Logs.html
0
 
LVL 13

Accepted Solution

by:
George Sas earned 500 total points
ID: 33641140
If you look carefully trough the logs you posted , the first log file give you a few nice tips that worth testing.

Then  try to read this link and see how to rebuild your WMI.
http://windowsxp.mvps.org/repairwmi.htm

Rirst look at the chapter : For Windows Server 2003

then
Look at the last post called : Comprehensive rebuild method
0
 

Author Comment

by:VCSLI
ID: 33651553
The company has approved my network overhaul. I've given up on this thing. I can't thank you enough for your help. You're the only one who's replied. You deserve much more than the 500 points.

Are you Danish? I ask because the website you uploaded the repository files to is a .DK domain. If you are Danish, I'm in Denmark quite often and would love to buy you an øl.

Please let me know, seriously. <3

email me at andrew@vcsli.com
0
 

Author Closing Comment

by:VCSLI
ID: 33651569
GeoSs provided me with both amazing advice and instruction. I can't thank him enough. While MY issue wasn't fixed (not the fault of Mr. GeoSs) i have selected this to be added to the knowledge base as the information and tips provided were very well written and informativ. Others should benefit from it.

0
 
LVL 13

Expert Comment

by:George Sas
ID: 33654139
Yep , I live in DK.
Thx for the points and sorry you did not solve the problem.
I guess this is a production environment and I am not sure how big your service window is , else I would have proposed a more drastic measure.
From your log files I can see that you don't have any SP applied to the system but I think maybe a SP applied on the system would maybe cure it. If not , then fully backup exchange , install an extra DC and move the roles , backup the exchange databases , wipe the system and install exchange with disaster recovery switch.
This would solve your problem for sure within 4-5 hours.
0
 

Author Comment

by:VCSLI
ID: 33654193
I dont think this error is causing anything serious... Like i said the network is a complete disaster and regardless of anything else, needs to be redone. Printers are shared at the computer level, there is no GP for users, most are set as local admin. It was never set up correctly.

This became an issue when a woman at the office went through the event viewer and called me screaming "ERRRRS!!!!!!!". It doesn't seem to matter what the errors mean or the fact that things are being redone in less than 10 days, just the fact that there are angry reds in the event viewer is enough to cause an uproar.

The issue is they really aren't using exchange for anything other then Public Folders. Some users are using IMAP directly to their web host, others are using POP, some users use the Exchange Calendar / Contacts. Nothing is consistant from user to user. 9 of the 14 users have over 9 gigs of email and are wondering why IMAP cant keep pace. It's taken equally as much time to understand what / where the problems are as it has to fix his one issue. It's a mess.

If it wasn't for the free coffee and cookies i dont know what i'd do with them.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now