WMI: Common Symptoms and Errors

[CraigMarcho]

First published on TECHNET on Aug 08, 2014
Quota Violation Issues: Memory and/or Handle

Symptoms

• General WMI-based scripts or applications fail or fail intermittently
• Applications such as SMS/SCCM produce errors on server and/or inventories fail or fail intermittently
• Applications such as Exchange or SQL fail on server or fail intermittently
• Unable to connect to specific namespace via WBEMTEST or unable to query specific classes in a namespace. May be intermittent.
• WMI appears to be hung or non-responsive
• Unable to run msinfo32 or tasklist
• Events for unexpected termination/crash of wmiprvse.exe
• Lower than normal available memory on the system
• Out of memory errors when running certain WMI tasks
• 0x80041033 -- SHUTDOWN of the target provider
• 0x80041006 – OUTOFMEMORY
• 0x80041013 -- fail to load the provider
• 0x800705af -- The paging file is too small for this operation to complete
• 0x8004106C-- Quota violation
• Event logs contain WMI-related events
• WMI service crashing

Event Source: Service Control Manager
Event ID: 7031
Description: The Windows Management Instrumentation service terminated unexpectedly

• Handle Quota Violation

Source: Microsoft-Windows-WMI
Event 5612 Wmiprvse.exe exceeding handle quota limit Event
WMI has stopped WMIPRVSE.EXE because a quota reached a warning value. Quota: %1 Value: %2 Maximum value: %3 WMIPRVSE PID: %4

• Memory Quota Violation does not log and event such as Handle Quota Violation does. You can check to see if any instance of wmiprvse is using 500 mb of memory or greater as the default limit is 512 mb on Vista an newer. Once you hit around 500 mb and any new allocation that would cross the 512 mb limit would fail. All instances of wmiprvse combined have a 1 gb limit. For Windows XP and 2003 the default is 128 mb. Exceed the default and you have reached a Quota Violation. Also check for Windows Management Instrumentation service crashing

Memory Quota Violations refer to Ask Perf blog: WMI: High Memory Usage by WMI Service or Wmiprvse.exe

Handle Quota Violations refer to Ask Perf blog: WMI:How to Troubleshoot WMI High Handle Count

Missing or Failing WMI Providers or Invalid WMI Class

Symptoms

• General WMI-based scripts or applications fail
• Applications such as SMS/SCCM produce errors on server and/or inventories fail
• Applications such as Exchange or SQL fail on server
• Unable to connect to specific namespace via WBEMTEST or unable to query specific classes in a namespace
• WMI functionality appears normal on local node but unable to connect to/from machine via WMI scripts, tools or applications
• WMI (Local) properties in wmimgmt.msc console and see the following

Failed to initialize all required WMI classes
Win32_processor: WMI: Invalid namespace
Win32_WMISetting: WMI: Invalid namespace
Security information: Successful
Win32_OperatingSystem: WMI: Invalid namespace
Win32_processor: WMI: Invalid namespace
Win32_WMISetting: WMI: Invalid namespace
Win32_OperatingSystem: WMI: Invalid namespace

• WBEM_E_NOT_FOUND 0x80041002
• WBEM_E_PROVIDER_FAILURE 0x80041004
• WBEM_E_INVALID_NAMESPACE 0x8004100E
• WBEM_E_INVALID_CLASS 0x80041010
• WBEM_E_PROVIDER_NOT_FOUND 0x80041011
• WBEM_E_INVALID_PROVIDER_REGISTRATION 0x80041012
• WBEM_E_PROVIDER_LOAD_FAILURE 0x80041013

Refer to Ask Perf blog: WMI: Missing or Failing WMI Providers or Invalid WMI Class

High Memory Usage by WMI Service or Wmiprvse.exe

Symptoms

• Wmiprvse.exe memory quota violations – refer to top of blog
• Lower than normal available memory on the system
• Delayed or slow logons to the box
• Excessive or slow return times to queries to WMI or scripts that are running that call to WMI
• Spinning donut when trying to bring up WMI (Local) properties in wmimgmt.msc console or using Wbemtest (Windows Management Instrumentation Tester) built in tool
• Sluggish or slow responding system
• Server hang
• Unable to run msinfo32 or tasklist
• Svchost process housing WMI service (winmgmt) exhibiting high memory usage or leak
• Instance of wmiprvse reaching or exceeding 512 mb on Vista and newer, or 128 mb on XP or Windows 2003: Quota Violation issue
• Large repository C:WindowsSystem32WbemRepository folder and objects.data file is 1gb or larger
• Cluster management tools not working

Refer to Ask Perf blog: WMI: High Memory Usage by WMI Service or Wmiprvse.exe

High CPU Usage by WMI Components

Symptoms

• High cpu usage by svchost hosting WMI service (winmgmt)
• High cpu usage by wmiprvse
• System sluggish or slow performance

Refer to Ask Perf blog: WMI: How to troubleshoot High CPU Usage by WMI Components

High Handle Count on WMI Components

Symptoms

• Refer to top of blog: Quota Violation Issues: Memory and/or Handle
• Following Event being logged

Source: Microsoft-Windows-WMI
Event 5612 Wmiprvse.exe exceeding handle quota limit Event
WMI has stopped WMIPRVSE.EXE because a quota reached a warning value. Quota: %1 Value: %2 Maximum value: %3 WMIPRVSE PID: %4

• Resource depletion type messages
• Error message: No more treads can be created in the system
• Message when trying to RDP

The User Profile Service service failed the logon

• High handle count on svchost process hosting WMI service (winmgmt)
• Cluster management tools not working

Refer to Ask Perf blog: WMI: How to Troubleshoot WMI High Handle Count

Repository Corruption

Symptoms

• General WMI-based scripts or applications fail
• Applications such as SMS/SCCM produce errors on server and/or inventories fail
• Applications such as Exchange and SQL fail on server
• WINMGMT.MSC Security tab shows missing, repeating and/or gibberish namespace entries
• Unable to connect to specific or possibly any namespace via WBEMTEST
• Winmgmt.msc console WMI (local) properties Security tab shows missing, repeating and/or gibberish namespace entries
• Unable to connect to rootdefault or rootcimv2 namespaces. Fails returning error code 0x80041002 pointing to WBEM_E_NOT_FOUND
• Opening Computer Management and Right Click on Computer Management (Local) and select Properties, you get the following error: " WMI : Not Found" or it hangs trying connect
• Wbemtest (Windows Management Instrumentation Tester) built in tool hangs
• Error 0x80041010 WBEM_E_INVALID_CLASS
• Any events with Source = Microsoft-Windows-WMI, look for any of the following WMI event IDs: 28, 65, 5600, 5601, 5614 as any of these can be indicators or repository corruption
• WMI namespaces end up missing

Refer to Ask Perf blog: WMI: Repository Corruption, or Not?

Next up: WMI: Repository Corruption, or Not?

-Jeffrey Worline