Configuration refresh message: The system cannot access one or more event logs because if insufficient access rights, file corruption, or other reasons. The message suggests I look in the ServerManager-ManagementProvider event log which I did. I find a number event id 85 messages that state "Failed to query the results of bpa xpath: then there are a number of different entries with different location and the end of every message states "the system cannot find the file specified. The system cannot find the path specified.

The computer is a stand alone root certificate server that was running 2008R2. I have not had this issue with any other upgraded server though this is the first standalone server I have upgraded.

There are also some Event ID 63 WMI errors in the application log indicating that the account being used to register providers is the LocalSystem account which is a security concern.

I searched the forums but no hits. 

Thanks in ad

Hi,

So the upgrade process is ok, right?

Please post the detailed error message for more troubleshooting.

Regards.

Yes the upgrade went fine and the system is functioning fine except for the error messages. And all other upgrades of server 2008R2 VMs to 2012R2 VMs have gone well also with no errors until now. This is the first standalone machine the rest have been domain servers. Below are examples of the message:

Application Log
Event ID 63
A provider, Win32_OfflineFilesConfigurationProvider, has been registered in the Windows Management Instrumentation namespace ROOT\CIMV2 to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

ServerManager_ManagementProvider Log
Event ID 85
Failed to query the results of bpa xpath: Microsoft/Windows/FileServices:$reports$\*\Result.xml:/ResultDatabase/Result. error: A device attached to the system is not functioning., last error: The system cannot find the path specified..

Regards

Hi,

WMI logs a warning event log message when a WMI provider running in the LocalSystem security hosting context is loaded. This is done to inform system administrators about the risk of elevation of privilege attacks. Such attacks are possible if the provider code is not properly implemented.

https://technet.microsoft.com/en-us/library/dd315566%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

And for the error Failed to query the results of bpa xpath...

Can you run the BPA scan for the machine? BPA scan can be run using Server Manager console itself.

For this, go to "All Servers" canvas. Scroll below on this canvas to Best Practices Analyzer (BPA) tile. Click on "Tasks --> Start BPA Scan". Select the machine in opened window and complete the scan.

Regards.