Windows Vista strange event viewer error

  • Thread starter Thread starter gerryf
  • Start date Start date
G

gerryf

Guest
OK, here's the error

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage
> 99" could not be reactivated in namespace "//./root/CIMV2" because of
error 0x80041003. Events cannot be delivered through this filter until the
problem is corrected.

Basically, how do I correct the problem?

This is occurring on two identical machines, both of which were updated from
Windows XP Professional. Not a great deal of interesting stuff on these
machines--simple workstations. I suspect this may have resulted from the
upgrade, rather than the clean install.

The PCs seem to work fine except for these errors.
 
Re: strange event viewer error

Delete the files in the REPOSITORY folders (..\System32\wbem) (you will have
to turn off the winmanagement service to do that) 'net stop winmgmt'

--
Was this helpful? Then click the "Yes" Ratings button. Voting helps the web
interface.
http://www.microsoft.com/wn3/locales/help/help_en-us.htm#RateAPost

Mark L. Ferguson

..
"gerryf" <gerryf@community.nospam> wrote in message
news:EB5C620F-0557-44A8-BFE8-EE16EFA43D8D@microsoft.com...
> OK, here's the error
>
> Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN
> 60 WHERE TargetInstance ISA "Win32_Processor" AND
> TargetInstance.LoadPercentage
> > 99" could not be reactivated in namespace "//./root/CIMV2" because of
> error 0x80041003. Events cannot be delivered through this filter until the
> problem is corrected.
>
> Basically, how do I correct the problem?
>
> This is occurring on two identical machines, both of which were updated
> from Windows XP Professional. Not a great deal of interesting stuff on
> these machines--simple workstations. I suspect this may have resulted from
> the upgrade, rather than the clean install.
>
> The PCs seem to work fine except for these errors.
>
>
 
RE: strange event viewer error

Dear Customer,

Thanks for posting in partner newsgroup.

The '0x80041003' error code you provided indicates that
WBEM_E_ACCESS_DENIED.

This typically results when the process trying to access the namespace does
not have the required WMI privileges. The account attempting remote access
should be an administrator on the target computer; in addition, the account
might need to have a specific privilege enabled. To troubleshoot this
error, check the namespace security on the remote namespace to see the
privileges enabled for the account.


For this issue, I'd like to know which user account is used when processing
the query and whether there is proper permission on the '/root/CIMV2'.

To verify the permission of '/root/CIMV2':

Run--->'wmimgmt.msc'--->WMI control
(local)--->Properties--->Security--->/root/CIMV2


Please note: In Windows XP, 'Everyone' group have Execute Methods
permission by default. In Windows Vista, it is replaced with 'Authenticated
Users' group.

Hope this helps.

Miles Li
Microsoft Online Partner Support
 
Re: strange event viewer error

Thank you Miles,

Yes, from what I was able to glean from various sources, that is what I
thought as well. However, it didn't seem to make sense to me in the context
of the situation. All of the attempts to investigate this issue have led me
to Windows server running MYSQL server, but none (yet) seem to be Vista
related.

This is a newly installed Vista Ultimate machine (upgrade, actually), in a
network. There is no remote access -- the two machines are presently
standalone machines. These machines were fully updated XP Pro machines that
were updated using the Technet supplied Vista with integrated sp1 iso. The
error appears while checking the event log from an administrator account.

It appears the security for Root\CIMv2 is the default

Authenticated users has EXECUTE METHODS, PROVIDER WRITE, ENABLE ACCOUNT are
set to allow
Local Service EXECUTE METHODS, PROVIDER WRITE, ENABLE ACCOUNT are set to
allow
Network Service EXECUTE METHODS, PROVIDER WRITE, ENABLE ACCOUNT are set to
allow
Administrators EXECUTE METHODS, FULL WRITE, PARTIAL WRITER,, PROVIDER
WRITE, ENABLE ACCOUNT are set to allow

How can I determine what account is used when processing the query--indeed,
what query?

"Miles Li [MSFT]" <v-mileli@online.microsoft.com> wrote in message
news:I5rx0SefIHA.6616@TK2MSFTNGHUB02.phx.gbl...
> Dear Customer,
>
> Thanks for posting in partner newsgroup.
>
> The '0x80041003' error code you provided indicates that
> WBEM_E_ACCESS_DENIED.
>
> This typically results when the process trying to access the namespace
> does
> not have the required WMI privileges. The account attempting remote access
> should be an administrator on the target computer; in addition, the
> account
> might need to have a specific privilege enabled. To troubleshoot this
> error, check the namespace security on the remote namespace to see the
> privileges enabled for the account.
>
>
> For this issue, I'd like to know which user account is used when
> processing
> the query and whether there is proper permission on the '/root/CIMV2'.
>
> To verify the permission of '/root/CIMV2':
>
> Run--->'wmimgmt.msc'--->WMI control
> (local)--->Properties--->Security--->/root/CIMV2
>
>
> Please note: In Windows XP, 'Everyone' group have Execute Methods
> permission by default. In Windows Vista, it is replaced with
> 'Authenticated
> Users' group.
>
> Hope this helps.
>
> Miles Li
> Microsoft Online Partner Support
>
 
Re: strange event viewer error

Thank you Mark,

I had actually toyed with that idea given it seems to be at least marginally
related to wbem according to the error message, but the error seems to occur
mostly on servers running mysql so I was unsure if I should try that.





"Mark L. Ferguson" <MarkLFerguson@discussions.microsoft.com> wrote in
message news:um0suNZfIHA.5296@TK2MSFTNGP05.phx.gbl...
> Delete the files in the REPOSITORY folders (..\System32\wbem) (you will
> have to turn off the winmanagement service to do that) 'net stop winmgmt'
>
> --
> Was this helpful? Then click the "Yes" Ratings button. Voting helps the
> web
> interface.
> http://www.microsoft.com/wn3/locales/help/help_en-us.htm#RateAPost
>
> Mark L. Ferguson
>
> .
> "gerryf" <gerryf@community.nospam> wrote in message
> news:EB5C620F-0557-44A8-BFE8-EE16EFA43D8D@microsoft.com...
>> OK, here's the error
>>
>> Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN
>> 60 WHERE TargetInstance ISA "Win32_Processor" AND
>> TargetInstance.LoadPercentage
>> > 99" could not be reactivated in namespace "//./root/CIMV2" because of
>> error 0x80041003. Events cannot be delivered through this filter until
>> the problem is corrected.
>>
>> Basically, how do I correct the problem?
>>
>> This is occurring on two identical machines, both of which were updated
>> from Windows XP Professional. Not a great deal of interesting stuff on
>> these machines--simple workstations. I suspect this may have resulted
>> from the upgrade, rather than the clean install.
>>
>> The PCs seem to work fine except for these errors.
>>
>>
>
 
Re: strange event viewer error

That seems to have done the trick--after deleting the repository files and
rebooting 5 times the error has not recurred

Thanks!

"Mark L. Ferguson" <MarkLFerguson@discussions.microsoft.com> wrote in
message news:um0suNZfIHA.5296@TK2MSFTNGP05.phx.gbl...
> Delete the files in the REPOSITORY folders (..\System32\wbem) (you will
> have to turn off the winmanagement service to do that) 'net stop winmgmt'
>
> --
> Was this helpful? Then click the "Yes" Ratings button. Voting helps the
> web
> interface.
> http://www.microsoft.com/wn3/locales/help/help_en-us.htm#RateAPost
>
> Mark L. Ferguson
>
> .
> "gerryf" <gerryf@community.nospam> wrote in message
> news:EB5C620F-0557-44A8-BFE8-EE16EFA43D8D@microsoft.com...
>> OK, here's the error
>>
>> Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN
>> 60 WHERE TargetInstance ISA "Win32_Processor" AND
>> TargetInstance.LoadPercentage
>> > 99" could not be reactivated in namespace "//./root/CIMV2" because of
>> error 0x80041003. Events cannot be delivered through this filter until
>> the problem is corrected.
>>
>> Basically, how do I correct the problem?
>>
>> This is occurring on two identical machines, both of which were updated
>> from Windows XP Professional. Not a great deal of interesting stuff on
>> these machines--simple workstations. I suspect this may have resulted
>> from the upgrade, rather than the clean install.
>>
>> The PCs seem to work fine except for these errors.
>>
>>
>
 
Re: strange event viewer error


Hello,

Thanks for Mark's sharing.

Yes, 'Root\CIMv2' has the proper default permission and it should works.

For Mark's suggest has affects now, I'd like to recommend you to have a
further test to see whether it is stable or not.

Again, thanks for using newsgroups.


Miles Li
Microsoft Online Partner Support
 
Back
Top