Has there been any more progress on a process to fix error PE017?

Hello there,

Please have a look at this article. It contains different PE error code explanations regarding WMI based sensors.

Error Code PE017

WMI returned too much data while PRTG expected only a single result. This means that the result contained more than one row. Unfortunately, there is no apparent reason for this behavior.

Please note that we are not able to answer the question why the WMI interface specifically return more data than expected, sorry.

Best,
Sebastian

Hello. this is quite significant for us as we use the WMI Security Sensor to record the fact that workstations have an AV product installed and that it is up-to-date etc. As of March 2020 we started to get the PE017 error. I initially put it down to a one-off glitch. I now have a lot more work stations reporting this same error. My guess is a Windows 10 update. Although not all Win10 boxes are reporting this issue and no Win7 boxes has of yet either.

I agree. I just had another Win 10 Pro machine go down with this same problem.

Hi there,

Thank you very much for your message.
Unfortunately, there is not much we can do here. The targeted system responds the query other than expected, Windows Updates and different behavior of different Windows versions can definitely have a negative impact here.

Checking the regular WMI troubleshooting guides or installing a Remote Probe directly on one of the targeted devices for test purposes are the steps that I'd suggest at this point.

Best,
Sebastian

Same here, while trying to setup a WMI Security Sensor this error comes up:

"The WMI query returns an ambiguous result set. It returns too much data while PRTG expects only a single result. For more information, see https://kb.paessler.com/en/topic/1093. (code: PE017)"

This comes from an endpoint running Windows 10 Pro 20H2 with ESET Endpoints Security. This sensor works fine on another machines running previous Builds of Win10 with the same ESET program, so something probably changed on the WMI side.

Running Get-WmiObject -Namespace root\SecurityCenter2 -Class AntivirusProduct on this affected machine does indeed return multiple valid data (regardingWindows Defender and ESET), but somehow it's probably not exactly in the format/structure that the PRTG security sensor expects it to be presented.

@Paessler Team: what queries does the WMI Security Sensor does exactly? We would like to try to get to the bottom of this problem and pin-point the causes, so that we can replicate the same functionality through a custom sensor without triggering this PE017 error.

Thanks in advance and best regards

Hi there,

Please have a look at the following post and search for "WMI Security Center sensor" (don't open the link that leads to the manual ;) )
Which WQL queries are used by the PRTG WMI sensors?

Best,
Sebastian

I had this issue appear today on a number of machines, now resolved.

Confirmed Sophos AV running.
Get-WmiObject -Namespace root\SecurityCenter2 -Class AntivirusProduct - returned two entries for Sophos AV. Checked prgs/features for Sophos to ensure not an older version hanging around. Noticed install date of yesterday.

Confirmed not rebooted since 'install' / update of AV Rebooted and now sensor is reading properly and shows AV up to date

I came across this issue recently with Sophos Antivirus appearing twice in the result of the Get-WmiObject -Namespace root\SecurityCenter2 -Class AntivirusProduct command.

I found that rebooting the device did not clear the duplicate entry, so i used this guide to manually delete the older, incorrect entry.

https://support.cloudradial.com/hc/en-us/articles/360049084271-Removing-Old-Antivirus-Listings-from-Security-Center

Hello Bryan,

Thank you for your message. Glad to see that you find a solution to remove the duplicated entry.

If I can be of any assistance, do no hesitate.

Have a nice day.

Regards.