The Repair List for WMI Problems

WMI is a comprehensive and versatile system for monitoring nearly all aspects of a Windows computer. However, as it is very complex and based on a complex communications protocol (DCOM), it tends to be more error-prone than everyone would like it to be. Here is what you can do if you keep getting errors that indicate problems with the WMI system itself.

IMPORTANT

As WMI is primarily a Windows function set, the problems described here should be solved by Microsoft - however, we know how frustrating a search for solutions for WMI problems can be, so we offer you these suggestions here. Although these procedures are successfully tested and used in many cases, we by no means take any responsibility for their outcome and/or negative side effects.

USE AT OWN RISK! IF IN DOUBT, ASK MICROSOFT.

Please read our General Introduction to WMI and PRTG first! This compilation is gathered from many resources, mainly Microsoft websites.

Understanding the Use of WMI by PRTG for Monitoring Windows Computers

First of all, you should be aware that PRTG uses high-level Windows functions for accessing WMI - so very often an error is caused in the Windows parts of WMI and not in PRTG.

You should also know that basically three parts are involved in the process of monitoring via WMI:

• The WMI system on the computer with the PRTG probe,
• the WMI system on the target computer (host), and
• the network between them.

To determine on which side the problems occur and where action needs to be taken, check these criteria:

• If many/all hosts suddenly show inexplicable WMI errors, it is very likely the WMI system on the computer with the PRTG probe has become corrupted.
• If the WMI sensors of one host suddenly show inexplicable WMI errors, it is very likely the WMI system on the host computer has become corrupted.
• If you encounter connection-/credential-based errors, the firewalls/access rights/domain policies/routers/switches/cables in the network between both sides might interfere with the DCOM communication.
• If the target computer is running Windows 7 or Windows 2008 R2, Microsoft might just have induced problems for which they fortunately seem to have a hotfix.

This article tries to offer some help for the first two cases, the network problems are discussed in What are the most common errors when monitoring WMI?, section "WMI Connection based errors", and in PRTG WMI error messages, section "WMI timeout errors".

The Reboot Option

The easiest way to get WMI back on track is to reboot the computer, very often this already helps to get the monitoring back up and running again. As PRTG uses the WMI systems on both sides of a connection, you have these two options:

1. Rebooting the PRTG Probe Computer

If many/all host computers show inexplicable WMI errors, the WMI system on the computer with the PRTG probe might have become corrupted. Reboot the probe computer and see if that helps.

2. Rebooting the Target Computer

If the WMI sensors of one host suddenly show inexplicable WMI errors, it is very likely the WMI system on the host computer has become corrupted. Reboot the host computer and see if that helps.

The WMI Diag Option

A very good start to approaching WMI problems is the use of Microsoft's very own diagnosis tool, WMIDiag. You can find it in Microsoft's download center (or search Microsoft's website for "WMIDiag", should the download ID have been altered in the meantime).

The Restart Management Services Option

If you encounter problems with non-existing counters after installing/restarting software products or virtual machines, a restart of the WMI services might help (example service names shown here for problems with HyperV virtual machines):

net stop iphlpsvc
net stop nvspwmi
net stop vhdsvc
net stop vmms
net stop winmgmt

net start winmgmt
net start vmms
net start vhdsvc
net start nvspwmi
net start iphlpsvc

The Rebuild Windows System Files Option

On Windows Vista and above, the sfc /scannow command repairs Windows system files. This might help with WMI problems. See also the Microsoft article Use the System File Checker tool to repair missing or corrupted system files

The Re-Enable Performance Counters Option

Apparently, performance counters can be disabled via the Windows registry. Should this happen after a Windows Update or the installation of a software package, search in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services branch for "Disable Performance Counters". If you find one or more entries set to "1", set them to "0".

One case where this has helped is the Windows Process Sensor, where setting this key in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance branch brought red sensors back online.

Note: Working with the registry is for advanced users only.

The Refresh Performance Counters Option

This will probably fix many problems regarding performance data and is much less intrusive than almost every other suggested method.

Full details about the WMIADAP command can be found in the Microsoft article wmiadap

Usage :

wmiadap /f

The /f switch still forces an update of the WMI classes from the performance libraries.

wmiadap /r

The /r switch parses the Windows Driver Model drivers to create performance objects.

The Resync Performance Counters Option

The winmgmt console program offers another way of getting corrupted performance counters back on track.

1. Open a command prompt window (Run as Administrator) and enter the following lines.

2. On older Windows systems up to 2003, you have to clear earlier resnyc attempts (on newer systems this will not work): winmgmt /clearadap

3. Then do the resynchronization: winmgmt /resyncperf

The Reload Performance Counters Option

As pointed out in the Microsoft article Event ID 3002 — Performance Counter Loading, you can reload the performance counters if you run the following command in an administrator-run command line: lodctr /r

Note: When using MS SQL Server, this might not be enough. In this case, you may need to load all non-default instances via the command lodctr as described in the SQL Authority blog SQL SERVER – Performance Counter Missing: How to Get Them Back?, section "To load counter". Afterwards, do not forget to restart the SQL Server.

The Rebuild Performance Counters Option

One customer whose WMI sensors failed even on the local probe device with a 8002802B: Element not found error successfully got WMI back to working after he executed the following script:

net stop winmgmt
c:
cd %systemroot%\system32\wbem
rd /S /Q repository
 

regsvr32 /s %systemroot%\system32\scecli.dll
regsvr32 /s %systemroot%\system32\userenv.dll
 

mofcomp cimwin32.mof
mofcomp cimwin32.mfl
mofcomp rsop.mof
mofcomp rsop.mfl
for /f %%s in ('dir /b /s *.dll') do regsvr32 /s %%s
for /f %%s in ('dir /b *.mof') do mofcomp %%s
for /f %%s in ('dir /b *.mfl') do mofcomp %%s

The Re-Register WMI Components Option

1. Open a command prompt window (Run as Administrator) and change the directory (cd) to %windir%\System32\wbem on Windows 32 Bit or %windir%\SysWOW64\wbem on Windows 64 Bit.
2. Enter the following commands:

    for %i in (*.dll) do RegSvr32 -s %i
    for %i in (*.exe) do %i /RegServer

The Re-Install the Latest Service Pack Option

There is no guarantee that it will help, but it is worth a try anyway: Install the latest service pack again.

The Recompile MOFs Option

All WMI counters are defined in text files, the so-called MOFs. If rebooting the respective computer did not help, you could try to rebuild the counters by compiling the MOFs anew. This can be done by standard Windows means:

1. Open a command prompt window (Run as Administrator) and change the directory (cd) to %windir%\System32\wbem on Windows 32 Bit or %windir%\SysWOW64\wbem on Windows 64 Bit.
2. Enter the following commands: FOR /f %s in ('dir /b /s *.dll') do regsvr32 /s %s Net stop /y winmgmt FOR /f %s in ('dir /b *.mof *.mfl') do mofcomp %s Net start winmgmt

The Rebuild Repository Option

This should be the very last resort. If your probe computer's WMI is behaving badly and you have the possibility of moving the PRTG probe to a different computer, you should try that first!

1. Open a command prompt window (Run as Administrator)
2. Enter the following command: net stop winmgmt
3. With a Windows Explorer rename the directory %windir%\System32\wbem\repository on a Windows 32 Bit to %windir%\System32\wbem\repository_old (or %windir%\SysWOW64\wbem\repository respectively).
4. In the command prompt, enter: net start winmgmt
5. Repair the repository depending on your Windows version with the following commands in the command prompt:
   • Windows XP: rundll32 wbemupgd, UpgradeRepository
   • Windows Server 2003: rundll32 wbemupgd, RepairWMISetup
   • Windows Vista and above: winmgmt /salvagerepository

The Rebuild Performance Counter Library Values Option

A pretty lengthy procedure can be found in Microsoft's Knowledgebase: How to manually rebuild Performance Counter Library values. Be sure to read and understand the Important section in that article before you start.

The Re-Install Specific Software Option

As software that features its own WMI performance counters, PRTG adds these counters dynamically during its setup process to the WMI system. Some of these counters, however, might get lost. So one possible solution might be to re-install this specific software.

Again, there is no guarantee that this will work, and you should ensure that you have made a proper backup of your system so that none of your settings are in danger by this re-installation of our software.

USE AT YOUR OWN RISK!

The Rebuild Everything Option

We have not tested this yet, so we cannot say if this works with your specific system.
Remember:USE AT YOUR OWN RISK!
If your probe computer's WMI is behaving badly and you have the possibility of moving the PRTG probe to a different computer, you should try that first! Basically this option reinstalls everything that is needed for WMI, so you very probably need the installation discs / folders of your Windows version, or a slipstreamed disc, if a service pack has been installed.

1. Open a command prompt window (Run as Administrator)
2. Enter the following command: rundll32.exe setupapi,InstallHinfSection WBEM 132 %windir%\inf\wbemoc.inf

The WMI Re-Configuration Option

If you encounter the error message WMI: Generic failure., the WMI repository might be corrupted, or some other system files are corrupted. Try to restore a previous backup first, if possible, and see if this helps. Otherwise, configure WMI on the target device anew:

1. Open a command line tool.
2. Disable and stop the WMI service: sc config winmgmt start= disabled net stop winmgmt
3. Run the following commands: Winmgmt /salvagerepository %windir%\System32\wbem Winmgmt /resetrepository %windir%\System32\wbem
4. Re-enable the WMI service: sc config winmgmt start= auto
5. Reboot the server.
6. Restart the PRTG core server and try adding WMI sensors anew.

For details, see the Microsoft TechNet WMI corrupt - how to reinstall/repair?.