Solved WMI Event ID 10 "//./root/CIMV2

[HiroPro]

I have these strange errors showing up in my Application and System log.

It is as follows

Log Name:      Application
Source:        Microsoft-Windows-WMI
Date:          8/21/2011 1:00:37 PM
Event ID:      10
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Hal9000
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
    <EventID Qualifiers="49152">10</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-08-21T20:00:37.000000000Z" />
    <EventRecordID>6480</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Hal9000</Computer>
    <Security />
  </System>
  <EventData>
    <Data>//./root/CIMV2</Data>
    <Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99</Data>
    <Data>0x80041003</Data>
  </EventData>
</Event>

I also have another error that's strange as well...

Log Name:      Application
Source:        Microsoft-Windows-LoadPerf
Date:          8/21/2011 1:05:49 PM
Event ID:      3011
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      Hal9000
Description:
Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-LoadPerf" Guid="{122EE297-BB47-41AE-B265-1CA8D1886D40}" />
    <EventID>3011</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-08-21T20:05:49.861879200Z" />
    <EventRecordID>6490</EventRecordID>
    <Correlation />
    <Execution ProcessID="808" ThreadID="876" />
    <Channel>Application</Channel>
    <Computer>Hal9000</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="LoadPerf">
      <param1>WmiApRpl</param1>
      <param2>WmiApRpl</param2>
      <binaryDataSize>8</binaryDataSize>
      <binaryData>F20300004D070000</binaryData>
    </EventXML>
  </UserData>
</Event>

This is a fresh install of windows 7 U x64 SP1 Retail Technet ISOand I've had no issues/crashes. Curious what the heck is happening with WMI and Performance Counter!

I also have a DCOM error under System log

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          8/21/2011 12:58:01 PM
Event ID:      10010
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Hal9000
Description:
The server {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} did not register with DCOM within the required timeout.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="49152">10010</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-08-21T19:58:01.000000000Z" />
    <EventRecordID>24977</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>Hal9000</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}</Data>
  </EventData>
</Event>

I think that's related to my AMD/ATI video card and it's hotkey/logging using service AMD External Events Utility

 

[seth500]

It just means that you dont have permissions on that particular folder this is a fix that I got from microsoft it's a vbs script that deletes the object and it's recreated after a reboot but it gets rid of that error..hope it helps Seth Just run it as admin from your desktop and follow the prompts. This is where I got the script:

http://support.microsoft.com/kb/950375

 

[HiroPro]

What about the second error for Performance Counters?

Should I rebuild them with lodctr /r ?

 

[HiroPro]

That script nukes obj2set and obj3set. Is this the right approach?

Here is a newer KB article about it with regards to using Win 7 SP1 ISO and receiving the same permissions error.

http://support.microsoft.com/kb/2545227

And this is the script they post.

[B]strComputer = "."[/B]

[B]Set objWMIService = GetObject("winmgmts:" _[/B]
[B]& "{impersonationLevel=impersonate}!\\" _[/B]
[B]& strComputer & "\root\subscription")[/B]

[B]Set  obj1 = objWMIService.ExecQuery("select * from __eventfilter where  name='BVTFilter' and query='SELECT * FROM __InstanceModificationEvent  WITHIN 60 WHERE TargetInstance ISA ""Win32_Processor"" AND  TargetInstance.LoadPercentage > 99'")[/B]

[B]For Each obj1elem in obj1[/B]

[B]set obj2set = obj1elem.Associators_("__FilterToConsumerBinding")[/B]

[B]set obj3set = obj1elem.References_("__FilterToConsumerBinding")[/B]

[B]For each obj2 in obj2set[/B]

[B]                WScript.echo "Deleting the object"[/B]

[B]                WScript.echo obj2.GetObjectText_[/B]

[B]                obj2.Delete_[/B]

[B]next[/B]

[B]For each obj3 in obj3set[/B]

[B]                WScript.echo "Deleting the object"[/B]

[B]                WScript.echo obj3.GetObjectText_[/B]

[B]                obj3.Delete_[/B]

[B]next[/B]

[B]WScript.echo "Deleting the object"[/B]

[B]WScript.echo obj1elem.GetObjectText_[/B]

[B]obj1elem.Delete_[/B]

[B]Next[/B]

MS also has a FixIt msi for it #50688
http://go.microsoft.com/?linkid=9775756

OK great so we cross off the WMI problem in the first error I posted. What about the second error for Performance Counter?

PS This should be stickied somewhere because this WMI issue occurs whenever you install with a Win 7 SP1 disk!

 

[seth500]

OK great so we cross off the WMI problem in the first error I posted. What about the second error for Performance Counter?

Hopefully the wmi fix will fix that error as for the dcom you have something not registering with the server in the allocated 2 minutes of time. Some program thats installed I don't know.

Edit see if you have the permissions by following this:
http://technet.microsoft.com/en-us/library/cc774175(WS.10).aspx

 

[HiroPro]

OK great so we cross off the WMI problem in the first error I posted. What about the second error for Performance Counter?

Hopefully the wmi fix will fix that error as for the dcom you have something not registering with the server in the allocated 2 minutes of time. Some program thats installed I don't know.

Edit see if you have the permissions by following this:
Event ID 10010

Cross off error two as I rebuild the Performance Counters. Was strange though as on first reboot the vsyc was above 60Hz and my screen said overscan. I let it run for a minute as I could see HD access then I did a hard-reset. On reboot I didn't let it use the backup hives. All is fine now. Must have something to do with AMD/ATI software. I think the culprit is the service "AMD External Events Utility". It has something to do with error reporting and hotkeys. I've disabled hotkeys within the ATI control panel. Should I disable that service? BTW thanks seth500!

UPDATE

I set hotkeys option in CCC to disable.
I set the "AMD External Events Utility" service to manual and now I don't get the DCOM error on shutdown. Logs are entirely error free now!!! YAY!!!

PS I also noticed my HD 4890 was slightly throttling the fan up and down. With that service disabled it isn't doing this anymore.

PSS Anyone know where I can get BIOS for GV-R489-1GH-B (HD 4890) that might be newer than I have?