This article applies as of PRTG 22

The repair list for WMI problems

WMI is a comprehensive and versatile system for monitoring nearly all aspects of a Windows system. However, as it is very complex and based on a complex communications protocol (DCOM), it tends to be more error prone. Here is what you can do if you keep getting errors that indicate problems with the WMI system itself.

Use at your own risk. If in doubt, contact Microsoft.

Read My WMI sensors don't work. What can I do? first. This compilation is gathered from many resources, mainly Microsoft websites.

Understanding the use of WMI by PRTG for monitoring Windows systems

First of all, you should be aware that PRTG uses high-level Windows functions for accessing WMI. This means that, very often, an error is caused in the Windows parts of WMI and not in PRTG.

You should also know that basically three parts are involved in the process of monitoring via WMI:

• The WMI system on the probe system,
• the WMI system on the target system (host), and
• the network between them.

To determine on which side the problems occur and where action needs to be taken, check these criteria:

• If many/all hosts suddenly show inexplicable WMI errors, it is very likely that the WMI system on the probe system has become corrupted.
• If the WMI sensors of one host suddenly show inexplicable WMI errors, it is very likely the WMI system on the host system has become corrupted.
• If you encounter connection-based or credential-based errors, the firewalls/access rights/domain policies/routers/switches/cables in the network between both sides might interfere with the DCOM communication.
• If the target system runs Windows 7 or Windows Server 2008 R2, Microsoft might just have induced problems for which they fortunately seem to have a hotfix.

This article tries to offer some help for the first two cases, the network problems are discussed in What are the most common errors when monitoring WMI?, section "WMI Connection-Based Errors", and in PRTG WMI error messages, section "WMI Timeout Errors".

Restart system

The easiest way to get WMI back on track is to restart the system. Very often, this helps to get the monitoring up and running again. As PRTG uses the WMI systems on both sides of a connection, you have these two options:

1. Restart probe system

If many/all host systems show inexplicable WMI errors, the WMI system on the probe system might have become corrupted. Restart the probe system and see if that helps.

2. Restart target system

If the WMI sensors of one host suddenly show inexplicable WMI errors, it is very likely that the WMI system on the target system has become corrupted. Restart the target system and see if that helps.

Restart management services

If you encounter problems with non-existing counters after installing/restarting software products or virtual machines, a restart of the WMI services might help. In the example, we use example service names for problems with Hyper-V virtual machines.

net stop iphlpsvc
net stop nvspwmi
net stop vhdsvc
net stop vmms
net stop winmgmt

net start winmgmt
net start vmms
net start vhdsvc
net start nvspwmi
net start iphlpsvc

Rebuild Windows system files

As of Windows Vista, the

sfc /scannow

command repairs Windows system files. This might help with WMI problems. See also the Microsoft article Use the System File Checker tool to repair missing or corrupted system files

Reenable performance counters

Performance counters can be disabled via the Windows registry. Should this happen after a Windows update or the installation of a software package, search in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services branch for Disable Performance Counters. If you find one or more entries set to "1", set them to "0".

One case where this helped is with the Windows Process sensor, where setting this key in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance branch brought sensors in the Down status back online.

Note: Working with the registry is for advanced users only.

Refresh performance counters

This will probably fix many problems regarding performance data and is much less intrusive than almost every other suggested method.

Full details about the WMIADAP command can be found in the Microsoft article wmiadap

Usage

wmiadap /f

The /f switch still forces an update of the WMI classes from the performance libraries.

wmiadap /r

The /r switch parses the Windows Driver Model drivers to create performance objects.

Resynchronize performance counters

The winmgmt console program offers another way of getting corrupted performance counters back on track.

1. Open a command prompt as administrator and enter the following lines.

2. On older Windows systems up to 2003, you must clear earlier resynchronization attempts (on newer systems, this will not work): winmgmt /clearadap

3. Then do the resynchronization: winmgmt /resyncperf

Reload performance counters

As pointed out in the Microsoft article Event ID 3002 — Performance Counter Loading, you can reload the performance counters if you run the following command in an administrator-run command line: lodctr /r

Note: When using Microsoft SQL Server, this might not be enough. In this case, you may need to load all non-default instances via the command lodctr as described in the SQL Authority blog SQL SERVER – Performance Counter Missing: How to Get Them Back?, section To load counter. Afterwards, do not forget to restart the SQL server.

Rebuild performance counters

One customer whose WMI sensors failed even on the local probe device with the error 8002802B: Element not found successfully got WMI working again after executing the following script:

net stop winmgmt
c:
cd %systemroot%\system32\wbem
rd /S /Q repository
 

regsvr32 /s %systemroot%\system32\scecli.dll
regsvr32 /s %systemroot%\system32\userenv.dll
 

mofcomp cimwin32.mof
mofcomp cimwin32.mfl
mofcomp rsop.mof
mofcomp rsop.mfl
for /f %%s in ('dir /b /s *.dll') do regsvr32 /s %%s
for /f %%s in ('dir /b *.mof') do mofcomp %%s
for /f %%s in ('dir /b *.mfl') do mofcomp %%s

Reregister WMI components

1. Open a command prompt as administrator and change the directory (cd) to %windir%\System32\wbem on Windows 32 bit or %windir%\SysWOW64\wbem on Windows 64 bit.
2. Enter the following commands:

    for %i in (*.dll) do RegSvr32 -s %i
    for %i in (*.exe) do %i /RegServer

Reinstall the latest service pack

There is no guarantee that it will help, but it is worth a try anyway: Install the latest service pack again.

Recompile MOFs

All WMI counters are defined in text files, the so-called MOFs. If restarting the respective system did not help, you could try to rebuild the counters by compiling the MOFs anew. This can be done via standard Windows means:

1. Open a command prompt as administrator and change the directory (cd) to %windir%\System32\wbem on Windows 32 bit or %windir%\SysWOW64\wbem on Windows 64 bit.
2. Enter the following commands: FOR /f %s in ('dir /b /s *.dll') do regsvr32 /s %s Net stop /y winmgmt FOR /f %s in ('dir /b *.mof *.mfl') do mofcomp %s Net start winmgmt

Rebuild repository

1. Open a command prompt as administrator.
2. Enter the following command: net stop winmgmt
3. In Windows Explorer, rename the directory %windir%\System32\wbem\repository on a Windows 32 bit to %windir%\System32\wbem\repository_old (or %windir%\SysWOW64\wbem\repository respectively).
4. In the command prompt, enter: net start winmgmt
5. Repair the repository depending on your Windows version with the following commands:
   • Windows XP: rundll32 wbemupgd, UpgradeRepository
   • Windows Server 2003: rundll32 wbemupgd, RepairWMISetup
   • as of Windows Vista: winmgmt /salvagerepository

Rebuild performance counter library values

A pretty lengthy procedure can be found in Microsoft's knowledge base: Manually rebuild performance counter library values. Make sure that you read and understand the Important section in the article before you start.

Reinstall specific software

As software that features its own WMI performance counters, PRTG dynamically adds these counters during its setup process to the WMI system. Some of these counters, however, might get lost. So, one possible solution might be to re-install this specific software.

Rebuild everything

We have not tested this, so we cannot say if this works with your specific system.

Basically, this option reinstalls everything that is needed for WMI, so you very likely need the installation disks / folders of your Windows version, or a slipstreamed disc, if a service pack has been installed.

1. Open a command prompt as administrator.
2. Enter the following command: rundll32.exe setupapi,InstallHinfSection WBEM 132 %windir%\inf\wbemoc.inf

The WMI reconfiguration option

If you encounter the error message WMI: Generic failure., the WMI repository might be corrupted, or some other system files are corrupted. Try to restore a previous backup first, if possible, and see if this helps.

Otherwise, configure WMI on the target device anew:

1. Open a command line.
2. Disable and stop the WMI service: sc config winmgmt start= disabled net stop winmgmt
3. Run the following commands: Winmgmt /salvagerepository %windir%\System32\wbem Winmgmt /resetrepository %windir%\System32\wbem
4. Reenable the WMI service: sc config winmgmt start= auto
5. Restart the server.
6. Restart the PRTG core server.
7. Try to add WMI sensors anew.

For details, see the Microsoft TechNet WMI corrupt - how to reinstall/repair?.