We're experiencing an issue with one of our Windows Server 2008R2 Standard Edition SP1 servers where an Application error occurs at least twice, and sometimes up to 5 or 6 times per day. The following error is what we see. Any help would be greatly appreciated, and I'll be checking back frequently to check for updates and provide more info whenever needed. Thanks! General: Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79d42 Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c8f9 Exception code: 0xc0000374 Fault offset: 0x00000000000c40f2 Faulting process id: 0x1bbc Faulting application start time: 0x01cd5d65dbeb2e7c Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll Details: - - System - Provider [ Name] Application Error - EventID 1000 [ Qualifiers] 0 Level 2 Task 100 Keywords 0x80000000000000 - TimeCreated [ SystemTime] 2012-07-09T08:34:39.000000000Z EventRecordID 6812 Channel Application Computer {FQDN} Security - EventData wmiprvse.exe 6.1.7601.17514 4ce79d42 ntdll.dll 6.1.7601.17514 4ce7c8f9 c0000374 00000000000c40f2 1bbc 01cd5d65dbeb2e7c C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\SYSTEM32\ntdll.dll ebe1621c-c9a0-11e1-a1d4-5cf3fce8cef6 ETA: I also ran the wmidiag.exe tool from Microsoft. I saw it as a suggestion on another forum and ran it. I don't know if it has any bearing here, but this is the log in case it's helpful show 06604 14:51:25 (0) ** WMIDiag v2.1 started on Tuesday, July 10, 2012 at 14:40. 06605 14:51:25 (0) ** 06606 14:51:25 (0) ** Copyright (c) Microsoft Corporation. All rights reserved - July 2007. 06607 14:51:25 (0) ** 06608 14:51:25 (0) ** This script is not supported under any Microsoft standard support program or service. 06609 14:51:25 (0) ** The script is provided AS IS without warranty of any kind. Microsoft further disclaims all 06610 14:51:25 (0) ** implied warranties including, without limitation, any implied warranties of merchantability 06611 14:51:25 (0) ** or of fitness for a particular purpose. The entire risk arising out of the use or performance 06612 14:51:25 (0) ** of the scripts and documentation remains with you. In no event shall Microsoft, its authors, 06613 14:51:25 (0) ** or anyone else involved in the creation, production, or delivery of the script be liable for 06614 14:51:25 (0) ** any damages whatsoever (including, without limitation, damages for loss of business profits, 06615 14:51:25 (0) ** business interruption, loss of business information, or other pecuniary loss) arising out of 06616 14:51:25 (0) ** the use of or inability to use the script or documentation, even if Microsoft has been advised 06617 14:51:25 (0) ** of the possibility of such damages. 06618 14:51:25 (0) ** 06619 14:51:25 (0) ** 06620 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06621 14:51:25 (0) ** ----------------------------------------------------- WMI REPORT: BEGIN ---------------------------------------------------------- 06622 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06623 14:51:25 (0) ** 06624 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06625 14:51:25 (0) ** Windows Server 2008 R2 - Service pack 1 - 64-bit (7601) - User {Username} on computer {ComputerName}. 06626 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06627 14:51:25 (0) ** Environment: ........................................................................................................ OK. 06628 14:51:25 (0) ** System drive: ....................................................................................................... C: (Disk #0 Partition #1). 06629 14:51:25 (0) ** Drive type: ......................................................................................................... SCSI (IBM ServeRAID M5015 SCSI Disk Device). 06630 14:51:25 (0) ** There are no missing WMI system files: .............................................................................. OK. 06631 14:51:25 (0) ** There are no missing WMI repository files: .......................................................................... OK. 06632 14:51:25 (0) ** WMI repository state: ............................................................................................... CONSISTENT. 06633 14:51:25 (0) ** AFTER running WMIDiag: 06634 14:51:25 (0) ** The WMI repository has a size of: ................................................................................... 90 MB. 06635 14:51:25 (0) ** - Disk free space on 'C:': .......................................................................................... 75295 MB. 06636 14:51:25 (0) ** - INDEX.BTR, 15818752 bytes, 7/10/2012 2:38:58 PM 06637 14:51:25 (0) ** - MAPPING1.MAP, 242388 bytes, 7/10/2012 2:33:33 PM 06638 14:51:25 (0) ** - MAPPING2.MAP, 242388 bytes, 7/10/2012 2:38:58 PM 06639 14:51:25 (0) ** - OBJECTS.DATA, 77570048 bytes, 7/10/2012 2:38:58 PM 06640 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06641 14:51:25 (2) !! WARNING: Windows Firewall: .......................................................................................... DISABLED. 06642 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06643 14:51:25 (0) ** DCOM Status: ........................................................................................................ OK. 06644 14:51:25 (0) ** WMI registry setup: ................................................................................................. OK. 06645 14:51:25 (0) ** INFO: WMI service has dependents: ................................................................................... 1 SERVICE(S)! 06646 14:51:25 (0) ** - Internet Connection Sharing (ICS) (SHAREDACCESS, StartMode='Disabled') 06647 14:51:25 (0) ** => If the WMI service is stopped, the listed service(s) will have to be stopped as well. 06648 14:51:25 (0) ** Note: If the service is marked with (*), it means that the service/application uses WMI but 06649 14:51:25 (0) ** there is no hard dependency on WMI. However, if the WMI service is stopped, 06650 14:51:25 (0) ** this can prevent the service/application to work as expected. 06651 14:51:25 (0) ** 06652 14:51:25 (0) ** RPCSS service: ...................................................................................................... OK (Already started). 06653 14:51:25 (0) ** WINMGMT service: .................................................................................................... OK (Already started). 06654 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06655 14:51:25 (0) ** WMI service DCOM setup: ............................................................................................. OK. 06656 14:51:25 (0) ** WMI components DCOM registrations: .................................................................................. OK. 06657 14:51:25 (0) ** WMI ProgID registrations: ........................................................................................... OK. 06658 14:51:25 (0) ** WMI provider DCOM registrations: .................................................................................... OK. 06659 14:51:25 (0) ** WMI provider CIM registrations: ..................................................................................... OK. 06660 14:51:25 (0) ** WMI provider CLSIDs: ................................................................................................ OK. 06661 14:51:25 (2) !! WARNING: Some WMI providers EXE/DLL file(s) are missing: ............................................................ 18 WARNING(S)! 06662 14:51:25 (0) ** - ROOT/QLOGIC_CMPI, QLogic_NIC_Provider, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{28A5F598-F699-4A6B-B9F9-8C7EB9B7359F}:QLogic_NIC_Provider 06663 14:51:25 (0) ** - ROOT/QLOGIC_CMPI, QLogic_FCHBA_Provider, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{0AE588DD-D2E9-41EB-BCD1-8BF474187EC5}:QLogic_FCHBA_Provider 06664 14:51:25 (0) ** - ROOT/IBMSD, ADPT_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{B007445E-6AF0-4CBD-9009-809F071FCE69}:ADPT_Module 06665 14:51:25 (0) ** - ROOT/IBMSD, IBM_PA_Providers, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{2244E0FA-D37A-4F6E-82FB-92F1DB78716D}:IBM_PA_Providers 06666 14:51:25 (0) ** - ROOT/IBMSD, EndpointRegistrationProviderModule, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{BF833E81-33AA-40ED-B74A-329F006DB4F8}:EndpointRegistrationProviderModule 06667 14:51:25 (0) ** - ROOT/CIMV2, SBLIM_Data_Gatherer, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{0D03AF80-A160-44EF-9E8B-318201F41693}:SBLIM_Data_Gatherer 06668 14:51:25 (0) ** - ROOT/ADPT, ADPT_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{B007445E-6AF0-4CBD-9009-809F071FCE69}:ADPT_Module 06669 14:51:25 (0) ** - ROOT/PG_INTEROP, SBLIM_Data_Gatherer, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{0D03AF80-A160-44EF-9E8B-318201F41693}:SBLIM_Data_Gatherer 06670 14:51:25 (0) ** - ROOT/PG_INTEROP, LSIESG_SMIS13_HHR_ProviderModule, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{E21064DD-757A-4F2D-B798-81CDFF03B48C}:LSIESG_SMIS13_HHR_ProviderModule 06671 14:51:25 (0) ** - ROOT/PG_INTEROP, emulex_fc_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{27734403-1E6C-4BC7-B97D-1FE9657B35EC}:emulex_fc_provider_Module 06672 14:51:25 (0) ** - ROOT/PG_INTEROP, emulex_ucna_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{68D3C192-F517-41CC-B852-BA74A8D05A85}:emulex_ucna_provider_Module 06673 14:51:25 (0) ** - ROOT/IBMSE, emulex_fc_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{27734403-1E6C-4BC7-B97D-1FE9657B35EC}:emulex_fc_provider_Module 06674 14:51:25 (0) ** - ROOT/IBMSE, IBM_PA_Providers, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{2244E0FA-D37A-4F6E-82FB-92F1DB78716D}:IBM_PA_Providers 06675 14:51:25 (0) ** - ROOT/IBMSE, emulex_ucna_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{68D3C192-F517-41CC-B852-BA74A8D05A85}:emulex_ucna_provider_Module 06676 14:51:25 (0) ** - ROOT/LSI_MR_1_3_0, LSIESG_SMIS13_HHR_ProviderModule, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{E21064DD-757A-4F2D-B798-81CDFF03B48C}:LSIESG_SMIS13_HHR_ProviderModule 06677 14:51:25 (0) ** - ROOT/EMULEX, emulex_fc_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{27734403-1E6C-4BC7-B97D-1FE9657B35EC}:emulex_fc_provider_Module 06678 14:51:25 (0) ** - ROOT/EMULEX, emulex_ucna_provider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{68D3C192-F517-41CC-B852-BA74A8D05A85}:emulex_ucna_provider_Module 06679 14:51:25 (0) ** - ROOT/BROCADE, brcdprovider_Module, C:\Program Files (x86)\Common Files\IBM\icc\cimom\bin\wmicpa.exe /G{48898EFD-0F9A-4657-B03D-FF400A7D2CDE}:brcdprovider_Module 06680 14:51:25 (0) ** => This will make any operations related to the WMI class supported by the provider(s) to fail. 06681 14:51:25 (0) ** This can be due to: 06682 14:51:25 (0) ** - the de-installation of the software. 06683 14:51:25 (0) ** - the deletion of some files. 06684 14:51:25 (0) ** => If the software has been de-installed intentionally, then this information must be 06685 14:51:25 (0) ** removed from the WMI repository. You can use the 'WMIC.EXE' command to remove 06686 14:51:25 (0) ** the provider registration data. 06687 14:51:25 (0) ** i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\BROCADE path __Win32Provider Where Name='brcdprovider_Module' DELETE' 06688 14:51:25 (0) ** => If not, you must restore a copy of the missing provider EXE/DLL file(s) as indicated by the path. 06689 14:51:25 (0) ** You can retrieve the missing file from: 06690 14:51:25 (0) ** - A backup. 06691 14:51:25 (0) ** - The Windows CD. 06692 14:51:25 (0) ** - Another Windows installation using the same version and service pack level of the examined system. 06693 14:51:25 (0) ** - The original CD or software package installing this WMI provider. 06694 14:51:25 (0) ** 06695 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06696 14:51:25 (0) ** INFO: User Account Control (UAC): ................................................................................... DISABLED. 06697 14:51:25 (0) ** INFO: Local Account Filtering: ...................................................................................... ENABLED. 06698 14:51:25 (0) ** => WMI tasks remotely accessing WMI information on this computer and requiring Administrative 06699 14:51:25 (0) ** privileges MUST use a DOMAIN account part of the Local Administrators group of this computer 06700 14:51:25 (0) ** to ensure that administrative privileges are granted. If a Local User account is used for remote 06701 14:51:25 (0) ** accesses, it will be reduced to a plain user (filtered token), even if it is part of the Local Administrators group. 06702 14:51:25 (0) ** 06703 14:51:25 (0) ** Overall DCOM security status: ....................................................................................... OK. 06704 14:51:25 (0) ** Overall WMI security status: ........................................................................................ OK. 06705 14:51:25 (0) ** - Started at 'Root' -------------------------------------------------------------------------------------------------------------- 06706 14:51:25 (0) ** INFO: WMI permanent SUBSCRIPTION(S): ................................................................................ 2. 06707 14:51:25 (0) ** - ROOT/SUBSCRIPTION, CommandLineEventConsumer.Name="BVTConsumer". 06708 14:51:25 (0) ** 'SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99' 06709 14:51:25 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="SCM Event Log Consumer". 06710 14:51:25 (0) ** 'select * from MSFT_SCMEventLogEvent' 06711 14:51:25 (0) ** 06712 14:51:25 (0) ** WMI TIMER instruction(s): ........................................................................................... NONE. 06713 14:51:25 (0) ** INFO: WMI namespace(s) requiring PACKET PRIVACY: .................................................................... 3 NAMESPACE(S)! 06714 14:51:25 (0) ** - ROOT/CIMV2/SECURITY/MICROSOFTTPM. 06715 14:51:25 (0) ** - ROOT/CIMV2/TERMINALSERVICES. 06716 14:51:25 (0) ** - ROOT/SERVICEMODEL. 06717 14:51:25 (0) ** => When remotely connecting, the namespace(s) listed require(s) the WMI client to 06718 14:51:25 (0) ** use an encrypted connection by specifying the PACKET PRIVACY authentication level. 06719 14:51:25 (0) ** (RPC_C_AUTHN_LEVEL_PKT_PRIVACY or PktPrivacy flags) 06720 14:51:25 (0) ** i.e. 'WMIC.EXE /NODE:"{ComputerName}" /AUTHLEVEL:Pktprivacy /NAMESPACE:\\ROOT\SERVICEMODEL Class __SystemSecurity' 06721 14:51:25 (0) ** 06722 14:51:25 (0) ** WMI MONIKER CONNECTIONS: ............................................................................................ OK. 06723 14:51:25 (0) ** WMI CONNECTIONS: .................................................................................................... OK. 06724 14:51:25 (1) !! ERROR: WMI GET operation errors reported: ........................................................................... 30 ERROR(S)! 06725 14:51:25 (0) ** - Root/CIMV2, MSFT_NetInvalidDriverDependency, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06726 14:51:25 (0) ** MOF Registration: '' 06727 14:51:25 (0) ** - Root/CIMV2, Win32_OsBaselineProvider, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06728 14:51:25 (0) ** MOF Registration: '' 06729 14:51:25 (0) ** - Root/CIMV2, Win32_OsBaseline, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06730 14:51:25 (0) ** MOF Registration: '' 06731 14:51:25 (0) ** - Root/CIMV2, Win32_DriverVXD, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06732 14:51:25 (0) ** MOF Registration: '' 06733 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_GenericIKEandAuthIP, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06734 14:51:25 (0) ** MOF Registration: '' 06735 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_GenericIKEandAuthIP, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06736 14:51:25 (0) ** MOF Registration: '' 06737 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecAuthIPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06738 14:51:25 (0) ** MOF Registration: '' 06739 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecAuthIPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06740 14:51:25 (0) ** MOF Registration: '' 06741 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecAuthIPv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06742 14:51:25 (0) ** MOF Registration: '' 06743 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecAuthIPv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06744 14:51:25 (0) ** MOF Registration: '' 06745 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecIKEv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06746 14:51:25 (0) ** MOF Registration: '' 06747 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecIKEv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06748 14:51:25 (0) ** MOF Registration: '' 06749 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecIKEv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06750 14:51:25 (0) ** MOF Registration: '' 06751 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecIKEv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06752 14:51:25 (0) ** MOF Registration: '' 06753 14:51:25 (0) ** - Root/CIMV2, Win32_PerfFormattedData_TermService_TerminalServices, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06754 14:51:25 (0) ** MOF Registration: '' 06755 14:51:25 (0) ** - Root/CIMV2, Win32_PerfRawData_TermService_TerminalServices, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06756 14:51:25 (0) ** MOF Registration: '' 06757 14:51:25 (0) ** - Root/WMI, ReserveDisjoinThread, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06758 14:51:25 (0) ** MOF Registration: '' 06759 14:51:25 (0) ** - Root/WMI, ReserveLateCount, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06760 14:51:25 (0) ** MOF Registration: '' 06761 14:51:25 (0) ** - Root/WMI, ReserveJoinThread, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06762 14:51:25 (0) ** MOF Registration: '' 06763 14:51:25 (0) ** - Root/WMI, ReserveDelete, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06764 14:51:25 (0) ** MOF Registration: '' 06765 14:51:25 (0) ** - Root/WMI, ReserveBandwidth, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06766 14:51:25 (0) ** MOF Registration: '' 06767 14:51:25 (0) ** - Root/WMI, ReserveCreate, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06768 14:51:25 (0) ** MOF Registration: '' 06769 14:51:25 (0) ** - Root/WMI, SystemConfig_PhyDisk, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06770 14:51:25 (0) ** MOF Registration: '' 06771 14:51:25 (0) ** - Root/WMI, SystemConfig_Video, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06772 14:51:25 (0) ** MOF Registration: '' 06773 14:51:25 (0) ** - Root/WMI, SystemConfig_IDEChannel, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06774 14:51:25 (0) ** MOF Registration: '' 06775 14:51:25 (0) ** - Root/WMI, SystemConfig_NIC, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06776 14:51:25 (0) ** MOF Registration: '' 06777 14:51:25 (0) ** - Root/WMI, SystemConfig_Network, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06778 14:51:25 (0) ** MOF Registration: '' 06779 14:51:25 (0) ** - Root/WMI, SystemConfig_CPU, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06780 14:51:25 (0) ** MOF Registration: '' 06781 14:51:25 (0) ** - Root/WMI, SystemConfig_LogDisk, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06782 14:51:25 (0) ** MOF Registration: '' 06783 14:51:25 (0) ** - Root/WMI, SystemConfig_Power, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found. 06784 14:51:25 (0) ** MOF Registration: '' 06785 14:51:25 (0) ** => When a WMI performance class is missing (i.e. 'Win32_PerfRawData_TermService_TerminalServices'), it is generally due to 06786 14:51:25 (0) ** a lack of buffer refresh of the WMI class provider exposing the WMI performance counters. 06787 14:51:25 (0) ** You can refresh the WMI class provider buffer with the following command: 06788 14:51:25 (0) ** 06789 14:51:25 (0) ** i.e. 'WINMGMT.EXE /SYNCPERF' 06790 14:51:25 (0) ** 06791 14:51:25 (0) ** WMI MOF representations: ............................................................................................ OK. 06792 14:51:25 (0) ** WMI QUALIFIER access operations: .................................................................................... OK. 06793 14:51:25 (0) ** WMI ENUMERATION operations: ......................................................................................... OK. 06794 14:51:25 (2) !! WARNING: WMI EXECQUERY operation errors reported: ................................................................... 2 WARNING(S)! 06795 14:51:25 (0) ** - Root/CIMV2, 'Select * From Win32_PointingDevice WHERE Status = "OK"' did not return any instance while AT LEAST 1 instance is expected. 06796 14:51:25 (0) ** - Root/CIMV2, 'Select * From Win32_Keyboard' did not return any instance while AT LEAST 1 instance is expected. 06797 14:51:25 (0) ** 06798 14:51:25 (2) !! WARNING: WMI GET VALUE operation errors reported: ................................................................... 5 WARNING(S)! 06799 14:51:25 (0) ** - Root, Instance: __EventConsumerProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000'). 06800 14:51:25 (0) ** - Root, Instance: __EventProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000'). 06801 14:51:25 (0) ** - Root, Instance: __EventSinkCacheControl=@, Property: ClearAfter='00000000000015.000000:000' (Expected default='00000000000230.000000:000'). 06802 14:51:25 (0) ** - Root, Instance: __ObjectProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000'). 06803 14:51:25 (0) ** - Root, Instance: __PropertyProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000'). 06804 14:51:25 (0) ** 06805 14:51:25 (0) ** WMI WRITE operations: ............................................................................................... NOT TESTED. 06806 14:51:25 (0) ** WMI PUT operations: ................................................................................................. NOT TESTED. 06807 14:51:25 (0) ** WMI DELETE operations: .............................................................................................. NOT TESTED. 06808 14:51:25 (0) ** WMI static instances retrieved: ..................................................................................... 2072. 06809 14:51:25 (0) ** WMI dynamic instances retrieved: .................................................................................... 0. 06810 14:51:25 (0) ** WMI instance request cancellations (to limit performance impact): ................................................... 1. 06811 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06812 14:51:25 (0) ** # of Event Log events BEFORE WMIDiag execution since the last 20 day(s): 06813 14:51:25 (0) ** DCOM: ............................................................................................................. 0. 06814 14:51:25 (0) ** WINMGMT: .......................................................................................................... 0. 06815 14:51:25 (0) ** WMIADAPTER: ....................................................................................................... 0. 06816 14:51:25 (0) ** 06817 14:51:25 (0) ** # of additional Event Log events AFTER WMIDiag execution: 06818 14:51:25 (0) ** DCOM: ............................................................................................................. 0. 06819 14:51:25 (0) ** WINMGMT: .......................................................................................................... 0. 06820 14:51:25 (0) ** WMIADAPTER: ....................................................................................................... 0. 06821 14:51:25 (0) ** 06822 14:51:25 (0) ** 30 error(s) 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found 06823 14:51:25 (0) ** => This error is typically a WMI error. This WMI error is due to: 06824 14:51:25 (0) ** - a missing WMI class definition or object. 06825 14:51:25 (0) ** (See any GET, ENUMERATION, EXECQUERY and GET VALUE operation failures). 06826 14:51:25 (0) ** You can correct the missing class definitions by: 06827 14:51:25 (0) ** - Manually recompiling the MOF file(s) with the 'MOFCOMP <FileName.MOF>' command. 06828 14:51:25 (0) ** Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag. 06829 14:51:25 (0) ** (This list can be built on a similar and working WMI Windows installation) 06830 14:51:25 (0) ** The following command line must be used: 06831 14:51:25 (0) ** i.e. 'WMIDiag CorrelateClassAndProvider' 06832 14:51:25 (0) ** Note: When a WMI performance class is missing, you can manually resynchronize performance counters 06833 14:51:25 (0) ** with WMI by starting the ADAP process. 06834 14:51:25 (0) ** - a WMI repository corruption. 06835 14:51:25 (0) ** In such a case, you must rerun WMIDiag with 'WriteInRepository' parameter 06836 14:51:25 (0) ** to validate the WMI repository operations. 06837 14:51:25 (0) ** Note: ENSURE you are an administrator with FULL access to WMI EVERY namespaces of the computer before 06838 14:51:25 (0) ** executing the WriteInRepository command. To write temporary data from the Root namespace, use: 06839 14:51:25 (0) ** i.e. 'WMIDiag WriteInRepository=Root' 06840 14:51:25 (0) ** - If the WriteInRepository command fails, while being an Administrator with ALL accesses to ALL namespaces 06841 14:51:25 (0) ** the WMI repository must be reconstructed. 06842 14:51:25 (0) ** Note: The WMI repository reconstruction requires to locate all MOF files needed to rebuild the repository, 06843 14:51:25 (0) ** otherwise some applications may fail after the reconstruction. 06844 14:51:25 (0) ** This can be achieved with the following command: 06845 14:51:25 (0) ** i.e. 'WMIDiag ShowMOFErrors' 06846 14:51:25 (0) ** Note: The repository reconstruction must be a LAST RESORT solution and ONLY after executing 06847 14:51:25 (0) ** ALL fixes previously mentioned. 06848 14:51:25 (2) !! WARNING: Static information stored by external applications in the repository will be LOST! (i.e. SMS Inventory) 06849 14:51:25 (0) ** 06850 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06851 14:51:25 (0) ** Unexpected, wrong or missing registry key values: ................................................................... 1 KEY(S)! 06852 14:51:25 (0) ** INFO: Unexpected registry key value: 06853 14:51:25 (0) ** - Current: HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\Logging (REG_SZ) -> 0 06854 14:51:25 (0) ** - Expected: HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\Logging (REG_SZ) -> 1 06855 14:51:25 (0) ** From the command line, the registry configuration can be corrected with the following command: 06856 14:51:25 (0) ** i.e. 'REG.EXE Add "HKLM\SOFTWARE\Microsoft\WBEM\CIMOM" /v "Logging" /t "REG_SZ" /d "1" /f' 06857 14:51:25 (0) ** 06858 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06859 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06860 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06861 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06862 14:51:25 (0) ** 06863 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06864 14:51:25 (0) ** ------------------------------------------------------ WMI REPORT: END ----------------------------------------------------------- 06865 14:51:25 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 06866 14:51:25 (0) ** 06867 14:51:25 (0) ** ERROR: WMIDiag detected issues that could prevent WMI to work properly!. Check 'C:\USERS\{Username}\APPDATA\LOCAL\TEMP\WMIDIAG-V2.1_2K8R2.SRV.SP1.64_{ComputerName}_2012.07.10_14.40.25.LOG' for details. 06868 14:51:25 (0) ** 06869 14:51:25 (0) ** WMIDiag v2.1 ended on Tuesday, July 10, 2012 at 14:51 (W:103 E:51 S:1).

Following might help A Wmiprvse.exe process crashes in Windows Server 2008 R2 when you use the WMI interface to query the hardware status on a computer that supports the IPMI standard http://support.microsoft.com/kb/2280777I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

Following might help A Wmiprvse.exe process crashes in Windows Server 2008 R2 when you use the WMI interface to query the hardware status on a computer that supports the IPMI standard http://support.microsoft.com/kb/2280777 I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights. I saw this in my googling. Listed as the cause on the hotfix page is the following: "This problem occurs because the Ipmiprv.dll module leads the Wmiprvse.exe process to crash. This behavior depends on certain hardware sensor types when the sensor is enumerated." The faulting module for that hotfix is ipmiprv.dll, and our faulting module is ntdll.dll. I'm thinking that this hotfix isn't applicable, but I'm open to hearing why I'm incorrect if I am.Seth Johnson

I'm thinking that this hotfix isn't applicable, but I'm open to hearing why I'm incorrect if I am. Seth Johnson Unfortunately, I don't have answer for that.I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

Please install this hotfix: The "Win32_Service" WMI class leaks memory in Windows Server 2008 R2 and in Windows 7 http://support.microsoft.com/kb/981314 Regards, MiyaMiya Yao TechNet Community Support

Please install this hotfix: The "Win32_Service" WMI class leaks memory in Windows Server 2008 R2 and in Windows 7 http://support.microsoft.com/kb/981314 Regards, Miya According to the KB I found here, kb 2397711, "Windows Server 2008 R2: Hyper-V Server, Library Server and VMM Server The following updates apply to Windows Server 2008 R2 systems that do not have Service Pack 1 installed: 981314 The "Win23_Service" WMI class leaks memory in Windows Server 2008 R2 and in Windows 7." That tells me the hotfix you're suggesting isn't applicable to a machine running SP1. Was this hotfix rolled into SP1? Is it still applicable?Seth Johnson