My WMI sensors keep returning with errors that should not occur. What can I do? I don't want to reinstall Windows on that computer.
I have tried a lot of things to fix my WMI. What else can I try to avoid reinstalling Windows?
11 Replies
The Repair List for WMI Problems
WMI is a comprehensive and versatile system for monitoring nearly all aspects of a Windows computer. However, as it is very complex and based on a complex communications protocol (DCOM), it tends to be more error-prone than everyone would like it to be. Here is what you can do if you keep getting errors that indicate problems with the WMI system itself.
IMPORTANT
As WMI is primarily a Windows function set, the problems described here should be solved by Microsoft - however, we know how frustrating a search for solutions for WMI problems can be, so we offer you these suggestions here. Although these procedures are successfully tested and used in many cases, we by no means take any responsibility for their outcome and/or negative side effects.
USE AT OWN RISK! IF IN DOUBT, ASK MICROSOFT.
Please read our General Introduction to WMI and PRTG first! This compilation is gathered from many resources, mainly Microsoft websites.
Understanding the Use of WMI by PRTG for Monitoring Windows Computers
First of all, you should be aware that PRTG uses high-level Windows functions for accessing WMI - so very often an error is caused in the Windows parts of WMI and not in PRTG.
You should also know that basically three parts are involved in the process of monitoring via WMI:
- The WMI system on the computer with the PRTG probe,
- the WMI system on the target computer (host), and
- the network between them.
To determine on which side the problems occur and where action needs to be taken, check these criteria:
- If many/all hosts suddenly show inexplicable WMI errors, it is very likely the WMI system on the computer with the PRTG probe has become corrupted.
- If the WMI sensors of one host suddenly show inexplicable WMI errors, it is very likely the WMI system on the host computer has become corrupted.
- If you encounter connection-/credential-based errors, the firewalls/access rights/domain policies/routers/switches/cables in the network between both sides might interfere with the DCOM communication.
- If the target computer is running Windows 7 or Windows 2008 R2, Microsoft might just have induced problems for which they fortunately seem to have a hotfix.
This article tries to offer some help for the first two cases, the network problems are discussed in What are the most common errors when monitoring WMI?, section "WMI Connection based errors", and in PRTG WMI error messages, section "WMI timeout errors".
The Reboot Option
The easiest way to get WMI back on track is to reboot the computer, very often this already helps to get the monitoring back up and running again. As PRTG uses the WMI systems on both sides of a connection, you have these two options:
1. Rebooting the PRTG Probe Computer
If many/all host computers show inexplicable WMI errors, the WMI system on the computer with the PRTG probe might have become corrupted. Reboot the probe computer and see if that helps.
2. Rebooting the Target Computer
If the WMI sensors of one host suddenly show inexplicable WMI errors, it is very likely the WMI system on the host computer has become corrupted. Reboot the host computer and see if that helps.
The Restart Management Services Option
If you encounter problems with non-existing counters after installing/restarting software products or virtual machines, a restart of the WMI services might help (example service names shown here for problems with HyperV virtual machines):
net stop iphlpsvc net stop nvspwmi net stop vhdsvc net stop vmms net stop winmgmt net start winmgmt net start vmms net start vhdsvc net start nvspwmi net start iphlpsvc
The Rebuild Windows System Files Option
On Windows Vista and above, the
sfc /scannow
command repairs Windows system files. This might help with WMI problems. See also the Microsoft article Use the System File Checker tool to repair missing or corrupted system files
The Re-Enable Performance Counters Option
Apparently, performance counters can be disabled via the Windows registry. Should this happen after a Windows Update or the installation of a software package, search in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services branch for "Disable Performance Counters". If you find one or more entries set to "1", set them to "0".
One case where this has helped is the Windows Process Sensor, where setting this key in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance branch brought red sensors back online.
Note: Working with the registry is for advanced users only.
The Refresh Performance Counters Option
This will probably fix many problems regarding performance data and is much less intrusive than almost every other suggested method.
Full details about the WMIADAP command can be found in the Microsoft article wmiadap
Usage :
wmiadap /f
The /f switch still forces an update of the WMI classes from the performance libraries.
wmiadap /r
The /r switch parses the Windows Driver Model drivers to create performance objects.
The Resync Performance Counters Option
The winmgmt console program offers another way of getting corrupted performance counters back on track.
1. Open a command prompt window (Run as Administrator) and enter the following lines.
2. On older Windows systems up to 2003, you have to clear earlier resnyc attempts (on newer systems this will not work):
winmgmt /clearadap
3. Then do the resynchronization:
winmgmt /resyncperf
The Reload Performance Counters Option
As pointed out in the Microsoft article Event ID 3002 — Performance Counter Loading, you can reload the performance counters if you run the following command in an administrator-run command line:
lodctr /r
Note: When using MS SQL Server, this might not be enough. In this case, you may need to load all non-default instances via the command lodctr as described in the SQL Authority blog SQL SERVER – Performance Counter Missing: How to Get Them Back?, section "To load counter". Afterwards, do not forget to restart the SQL Server.
The Rebuild Performance Counters Option
One customer whose WMI sensors failed even on the local probe device with a 8002802B: Element not found error successfully got WMI back to working after he executed the following script:
net stop winmgmt c: cd %systemroot%\system32\wbem rd /S /Q repository regsvr32 /s %systemroot%\system32\scecli.dll regsvr32 /s %systemroot%\system32\userenv.dll mofcomp cimwin32.mof mofcomp cimwin32.mfl mofcomp rsop.mof mofcomp rsop.mfl for /f %%s in ('dir /b /s *.dll') do regsvr32 /s %%s for /f %%s in ('dir /b *.mof') do mofcomp %%s for /f %%s in ('dir /b *.mfl') do mofcomp %%s
The Re-Register WMI Components Option
- Open a command prompt window (Run as Administrator) and change the directory (cd) to %windir%\System32\wbem on Windows 32 Bit or %windir%\SysWOW64\wbem on Windows 64 Bit.
- Enter the following commands:
for %i in (*.dll) do RegSvr32 -s %i for %i in (*.exe) do %i /RegServer
The Re-Install the Latest Service Pack Option
There is no guarantee that it will help, but it is worth a try anyway: Install the latest service pack again.
The Recompile MOFs Option
All WMI counters are defined in text files, the so-called MOFs. If rebooting the respective computer did not help, you could try to rebuild the counters by compiling the MOFs anew. This can be done by standard Windows means:
- Open a command prompt window (Run as Administrator) and change the directory (cd) to %windir%\System32\wbem on Windows 32 Bit or %windir%\SysWOW64\wbem on Windows 64 Bit.
- Enter the following commands:
FOR /f %s in ('dir /b /s *.dll') do regsvr32 /s %s Net stop /y winmgmt FOR /f %s in ('dir /b *.mof *.mfl') do mofcomp %s Net start winmgmt
The Rebuild Repository Option
This should be the very last resort. If your probe computer's WMI is behaving badly and you have the possibility of moving the PRTG probe to a different computer, you should try that first!
- Open a command prompt window (Run as Administrator)
- Enter the following command:
net stop winmgmt
- With a Windows Explorer rename the directory %windir%\System32\wbem\repository on a Windows 32 Bit to %windir%\System32\wbem\repository_old (or %windir%\SysWOW64\wbem\repository respectively).
- In the command prompt, enter:
net start winmgmt
- Repair the repository depending on your Windows version with the following commands in the command prompt:
- Windows XP:
rundll32 wbemupgd, UpgradeRepository
- Windows Server 2003:
rundll32 wbemupgd, RepairWMISetup
- Windows Vista and above:
winmgmt /salvagerepository
- Windows XP:
The Rebuild Performance Counter Library Values Option
A pretty lengthy procedure can be found in Microsoft's Knowledgebase: How to manually rebuild Performance Counter Library values. Be sure to read and understand the Important section in that article before you start.
The Re-Install Specific Software Option
As software that features its own WMI performance counters, PRTG adds these counters dynamically during its setup process to the WMI system. Some of these counters, however, might get lost. So one possible solution might be to re-install this specific software.
Again, there is no guarantee that this will work, and you should ensure that you have made a proper backup of your system so that none of your settings are in danger by this re-installation of our software.
USE AT YOUR OWN RISK!
The Rebuild Everything Option
We have not tested this yet, so we cannot say if this works with your specific system.
Remember:USE AT YOUR OWN RISK!
If your probe computer's WMI is behaving badly and you have the possibility of moving the PRTG probe to a different computer, you should try that first!
Basically this option reinstalls everything that is needed for WMI, so you very probably need the installation discs / folders of your Windows version, or a slipstreamed disc, if a service pack has been installed.
- Open a command prompt window (Run as Administrator)
- Enter the following command:
rundll32.exe setupapi,InstallHinfSection WBEM 132 %windir%\inf\wbemoc.inf
The WMI Re-Configuration Option
If you encounter the error message WMI: Generic failure., the WMI repository might be corrupted, or some other system files are corrupted. Try to restore a previous backup first, if possible, and see if this helps. Otherwise, configure WMI on the target device anew:
- Open a command line tool.
- Disable and stop the WMI service:
sc config winmgmt start= disabled net stop winmgmt
- Run the following commands:
Winmgmt /salvagerepository %windir%\System32\wbem Winmgmt /resetrepository %windir%\System32\wbem
- Re-enable the WMI service:
sc config winmgmt start= auto
- Reboot the server.
- Restart the PRTG core server and try adding WMI sensors anew.
For details, see the Microsoft TechNet WMI corrupt - how to reinstall/repair?.
Created on Apr 12, 2010 5:01:27 PM by
Volker Uffelmann [Paessler Support]
Last change on Dec 9, 2020 3:25:10 PM by
Brandy Greger [Paessler Support]
I have had very good luck with using 'wmiadap /f' to fix problems with IIS performance counters being inaccessible via WMI after first installing IIS on a new server.
This will probably fix many other problems with WMI gets of performance data and is much less intrusive than almost every other suggested method.
Full details about the WMIADAP command here :
http://msdn.microsoft.com/en-us/library/aa394528(VS.85).aspx
Usage :
wmiadap /f
The /f switch still forces an update of the WMI classes from the performance libraries.
wmiadap /r
The /r switch to parse the Windows Driver Model drivers to create performance objects.
Thanks for this information, we've added it to the main article above.
Kind regards, - Volker
None of the above worked for me. Then I found this, and it worked!
winmgmt /clearadap winmgmt /resyncperf
Created on Dec 7, 2010 11:01:45 PM by
John Bowen
(0)
Last change on Dec 8, 2010 9:46:11 AM by
Daniel Zobel [Product Manager]
Thanks, we've added this as well!
Kind regards, - Volker
Hi,
the following hotfix resolved our WMI problems (WMI stops working after a few days): http://support.microsoft.com/kb/2547244
Thanks, that's added too! :)
Kind regards, - Volker
Hint: The hotfix doesn't fix a already "broken" WMI instance. You have to wipe the wbem\Repositroy directory.
Having worked through a few of the suggested fixes above, I could turn up no errors with WMI on the host in question.
Yet, a sensor created by my colleague to monitor free disk space was still reporting that invalid data was being returned by WMI.
The fix in my case was to simply remove the sensor and recreate it. It is now reporting correct disk space utilization.
Check the following Registry Key and ensure the value is set to 0 and not 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance] "Disable Performance Counters"=dword:00000000
Also just check that there is no empty line in the following location [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM] "Autorecover MOFs"
As this can cause the Counters to not work. This has been tested on Windows Server 2012 R2
Rename folder Repository on C:\Windows\System32\wbem\. The system will recreate it automatically. This will revolve lots of WMI issues.
Please log in or register to enter your reply.
Add comment