The Repair List for WMI problems

WMI is a comprehensive and versatile system for monitoring nearly all apects of a Windows computer. However, as it is very complex and based on a complex communications protocol (DCOM) it tends to be more error-prone than everyone would like it to be. Here is what you can do if you keep getting errors that indicate problems with the WMI system itself.

IMPORTANT

As WMI is primarily a Windows function set, the problems described here should be solved by Microsoft - however, we know how frustrating a search for solutions for WMI problems can be so we offer you these suggestions here. Although these procedures are tested and used sucessfully in many cases we by no means take any responsibility for their outcome and/or negative side effects.

USE AT OWN RISK! IF IN DOUBT ASK MICROSOFT!

Please read our General introduction to WMI and PRTG first! This compilation is gathered from many resources, mainly Microsoft web sites.

Understanding PRTG's use of WMI for monitoring Windows computers

First of all you should be aware that PRTG uses high-level Windows-functions for accessing WMI - so very often an error is caused in the Windows parts of WMI and not in PRTG.

Then you should know that basically three parts are involved in the process of monitoring via WMI:

• the WMI system on the computer with PRTG's probe
• the WMI system on the target computer (host).
• the network between them

In order to determine on which side the problems occur and action needs to be taken, check these criteria:

• if many/all hosts suddenly show inexplicable WMI errors, it is very likely the WMI system on the computer with the PRTG probe has become corrupted.
• if the WMI sensors of one host suddenly show inexplicable WMI errors, it is very likely the WMI system on the host computer has become corrupted.
• if you encounter connection/credential based errors, the firewalls/access rights/domain policies/routers/switches/cables in the network between both sides might interfere with the DCOM communication.
• if the target computer is running Windows 7 or Windows 2008 R2 Microsoft just might have introduced problems for which they fortunately seem to have a hotfix.

This article tries to offer some help for the first two cases, the network problems are discussed in The most common WMI errors, section "WMI Connection based errors", and in PRTG WMI error messages, section "WMI timeout errors".

The reboot option

The easiest way to get WMI back on the track is to reboot the computer, very often this already helps to get the monitoring back up and running again. As PRTG uses the WMI systems on both sides of a connection you have these two options:

Rebooting the PRTG probe computer

If many/all host computers show inexplicable WMI errors, the WMI system on the computer with the PRTG probe might have become corrupted. Reboot the probe computer and see if that helps.

Rebooting the target computer

if the WMI sensors of one host suddenly show inexplicable WMI errors, it is very likely the WMI system on the host computer has become corrupted. Reboot the host computer and see if that helps.

The WMI diag option

A very good start to approaching WMI problems is the use of Microsoft's very own diagnosis tool, WMIDiag, of course. You can find it in Microsoft's download center (or search Microsoft's website for "WMIDiag", should the download ID have been altered in the meantime).

The restart management services option

If you encounter problems with non-existing counters after installing/restarting software products or virtual machines, a restart of the WMI services might help (example service names shown here for problems with HyperV virtual machines):

net stop iphlpsvc
net stop nvspwmi
net stop vhdsvc
net stop vmms
net stop winmgmt

net start winmgmt
net start vmms
net start vhdsvc
net start nvspwmi
net start iphlpsvc

The rebuild Windows system files option

On Windows Vista and above, the sfc /scannow command repairs Windows system files. This might help with WMI problems. http://support.microsoft.com/kb/929833/en

The re-enable performance counters option

Apparently performance counters can be disabled via the Windows registry. Should this happen after a Windows Update or the installation of some software package, search in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services branch for "Disable Performance Counters". If you find one or more entries set to "1", set them to "0".

One case where this has helped is the WMI Process sensor, where setting this key in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance branch brought red sensors back online.

NOTE: Working with the registry is for advanced users only.

The refresh performance counters option

This will probably fix many problems concerning performance data and is much less intrusive than almost every other suggested method.

Full details about the WMIADAP command here :

http://msdn.microsoft.com/en-us/library/aa394528(VS.85).aspx

Usage :

wmiadap /f

The /f switch still forces an update of the WMI classes from the performance libraries.

wmiadap /r

The /r switch to parse the Windows Driver Model drivers to create performance objects.

The resync performance counters option

The winmgmt console program offers another way of getting corrupted performance counters back on track.

1. Open a command prompt window (Run as Administrator) and enter the following lines.

2. On older Windows systems up to 2003 you have to clear earlier resnyc attempts (on newer systems this will not work): winmgmt /clearadap

3. Then do the resynchronization: winmgmt /resyncperf

The reload performance counters option

As pointed out in this technet article, you can reload the performance counters if you run the folowing command in a administrator-run command line: lodctr /r

The rebuild performance counters option

One customer whose WMI sensors failed even on the local probe device with a 8002802B: Element not found error successfully got WMI working after he executed the following script:

net stop winmgmt
c:
cd %systemroot%\system32\wbem
rd /S /Q repository
 

regsvr32 /s %systemroot%\system32\scecli.dll
regsvr32 /s %systemroot%\system32\userenv.dll
 

mofcomp cimwin32.mof
mofcomp cimwin32.mfl
mofcomp rsop.mof
mofcomp rsop.mfl
for /f %%s in ('dir /b /s *.dll') do regsvr32 /s %%s
for /f %%s in ('dir /b *.mof') do mofcomp %%s
for /f %%s in ('dir /b *.mfl') do mofcomp %%s

The re-register WMI components option

1. Open a command prompt window (Run as Administrator) and change directory (cd) to %windir%\System32\wbem on 32bit Windows or %windir%\SysWOW64\wbem on 64bit Windows
2. Enter the following commands:

    for %i in (*.dll) do RegSvr32 -s %i
    for %i in (*.exe) do %i /RegServer

The reinstall the latest service pack option

There's no guarantee it helps, but it's worth a try anyway: install the latest service pack again.

The recompile MOFs option

All WMI counters are defined in text files, the so called MOFs. If rebooting the respective computer didn't help, you could try to rebuild the counters by compiling the MOFs anew. This can be done with standard Windows means:

1. Open a command prompt window (Run as Administrator) and change directory (cd) to %windir%\System32\wbem on 32bit Windows or %windir%\SysWOW64\wbem on 64bit Windows
2. Enter the following commands: FOR /f %s in ('dir /b /s *.dll') do regsvr32 /s %s Net stop /y winmgmt FOR /f %s in ('dir /b *.mof *.mfl') do mofcomp %s Net start winmgmt

The rebuild repository option

This should be the very last resort. If your probe computer's WMI is behaving badly and you have the possibility of moving the PRTG probe to a different computer, you should try that first!

1. Open a command prompt window (Run as Administrator)
2. Enter the following command: net stop winmgmt
3. With a Windows Explorer rename the directory %windir%\System32\wbem\repository on a 32bit Windows to %windir%\System32\wbem\repository_old (or %windir%\SysWOW64\wbem\repostiory respectively).
4. Enter at the command prompt: net start winmgmt
5. repair the repository depending on your Windows version with the following commands at the command prompt:
   • Windows XP: rundll32 wbemupgd, UpgradeRepository
   • Windows Server 2003: rundll32 wbemupgd, RepairWMISetup
   • Windows Vista and above: winmgmt /salvagerepository

The rebuild Performance Counter Library values option

A pretty lengthy procedure is found in Microsoft's Knowledgebase: How to manually rebuild Performance Counter Library values. Please be sure to read and understand the Important section in that article before you start doing things.

The re-install specific software option

As software that features its own cool WMI performance counters, adds these counters dynamically during its setup process to the WMI system, some of these counters may get lost. So one possible solution might be to re-install this specific software.

Again, there is no guarantee that this will work, and you should ensure that you have backupped your system properly so that none of your settings are in danger by this re-installation of our software.

USE AT YOUR OWN RISK!

The rebuild everything option

We haven't tested this yet, so we can't say if this works with your specific system. Please remember:
USE AT YOUR OWN RISK!
If your probe computer's WMI is behaving badly and you have the possibility of moving the PRTG probe to a different computer, you should try that first! Basically this option reinstalls everything that is needed for WMI, so you very probably need the installation discs / folders of your Windows version. Or a slipstreamed disc, if a service pack has been installed.

1. Open a command prompt window (Run as Administrator)
2. Enter the following command: rundll32.exe setupapi,InstallHinfSection WBEM 132 %windir%\inf\wbemoc.inf

The WMI Re-Configuration Option

If you encounter the error message WMI: Generic failure., the WMI repository might be corrupted, or some other system files are corrupted. Try to restore a previous backup first if possible and see if this helps. Otherwise, configure WMI on the target device anew:

1. Open a command line tool.
2. Disable and stop the WMI service: sc config winmgmt start= disabled net stop winmgmt
3. Run the following commands: Winmgmt /salvagerepository %windir%\System32\wbem Winmgmt /resetrepository %windir%\System32\wbem
4. Re-enable the WMI service: sc config winmgmt start= auto
5. Reboot the server.
6. Restart the PRTG core server and try adding WMI sensors anew.

For details, please see this thread on Microsoft TechNet.