Tips to troubleshoot WMI-based monitoring errors
This document lists the errors often encountered when retrieving WMI-based results in Log360 Cloud. Listed below are the error codes, possible causes, and resolutions:
- 80070005 - Access is denied
- 800706BA - The RPC server is unavailable
- 80041010 - Invalid class
- 80041003 - Access Denied
- 80040154 - WMI Components are not registered
- 80080005 - Internal execution failure in the WMI service
- 8004106C - WMI is taking up too much memory
- 8004100E - Invalid namespace
- 80041017 - Invalid query
- 80010002 - WMI resource not found
1. 80070005 - Access is denied
If you are facing this error, here is the probable reason and the remedial action:
Probable cause: This error occurs when incorrect login credentials are configured.
Solution:
- Ensure to configure the correct domain name, user name, and password for the device. For instance, if the domain name is BigDom, username is admin, in the user name field, type BigDom\admin.
- Despite the correct credentials, if you still face issues, troubleshoot using the following steps:
- Check if the user account is valid on the target machine by opening a command prompt and executing the following command:
- net use \\<monitored device name>\ADMIN$ /u:"<Domain Name\User Name>" "<password>"
- If this command shows errors, the provided user account is not valid on the target machine.
- Check if 'Remote DCOM' is enabled in the monitored workstation. If it is not enabled, enable it with the following steps:
- Select Start > Run.
- Type dcomcnfg in the text box and click OK.
- Select the Default Properties tab.
- Select the Enable Distributed COM in this machine checkbox.
- Click OK.
- To enable DCOM on Windows XP hosts:
- Select Start > Run.
- Type dcomcnfg in the text box and click OK.
- Click on Component Services > Computers > My Computer.
- Right-click and select Properties.
- Select the Default Properties tab.
- Select the 'Enable Distributed COM' in this machine checkbox.
- Click OK.
2. 800706BA - The RPC server is unavailable
If you are facing this error, here is the probable reason and the remedial action:
Probable cause: This error occurs when the RPC and WMI services are not running and if the device is not pingable.
Solution:
- Check if the device is up and running, and pingable.
- Check if the RPC and WMI Services are running. To check, follow the steps listed below:
- Select Start > Run.
- Type 'services.msc' in the text box and click OK.
- In the listed services, see if the status of the RPC and WMI services are shown as started.
- If it is not started, start the services.
- A firewall might be configured on the remote computer. Such cases mostly occur in Windows XP (with SP 2), when the default Windows firewall is enabled. Follow the steps listed below to disable the default firewall in the Windows XP machine:
- Select Start > Run.
- Type Firewall.cpl and click OK.
- In the General tab, click Off.
- Click OK.
- If the firewall cannot be disabled, Enable Remote Administration (for administrators) by executing the following command on the remote machine:
- "netsh firewall set service RemoteAdmin"
- A firewall might be blocking the WMI traffic. To provide access to WMI traffic in the firewall, you will need to open the ports 445 and 135 in the firewall.
3. 80041010 - Invalid class
If you are facing this error, here is the probable reason and the remedial action:
Probable cause: This error occurs when the required WMI class is not registered.
Solution:
- Check whether the desired application is installed.
- To register all the WMI classes for the installed application, run the below commands:
- For Windows 2000, run 'winmgmt /resyncperf' command from the monitored device.
- For Windows XP and 2003, run 'wmiadap /f' command from the monitored device.
4. 80041003 - Access Denied
If you are facing this error, here is the probable reason and the remedial action:
Probable cause: This error occurs when the user name provided does not have the necessary access privileges to perform the operation. It could also happen if the user does not belong to the Administrator group for this host machine.
Solution:
- Try moving the user to the Administrator Group of the workstation with an administrator account, preferably a Domain Administrator.
5. 80040154 -WMI Components are not registered
If you are facing this error, here is the probable reason and the remedial action:
Probable cause: This error occurs when the WMI service is not available in remote windows workstation. It happens in Windows NT. This error could also occur in higher versions of Windows, if the WMI components are not registered properly.
Solution:
- Install the WMI core in the remote workstation. It can be downloaded from the Microsoft website.
- Register the WMI DLL files by executing the following command in the command prompt:
6. 80080005 - Internal execution failure in the WMI service
If you are facing this error, here is the probable reason and the remedial action:
Probable cause: This error occurs when there is some internal execution failure in the WMI service (winmgmt.exe) running in the host machine. It could happen if the last update of the WMI Repository in that workstation fails.
Solution:
- Restart the WMI Service in the remote workstation:
- Select Start > Run.
- Type Services.msc and click OK.
- In the Services window, select Windows Management Instrumentation service.
- Right-click and select Restart.
7. 8004106C - WMI is taking up too much memory
If you are facing this error, here is the probable reason and the remedial action:
Probable cause: This error occurs when the WMI takes up too much memory. It could be caused either by low memory availability or excessive memory consumption by the WMI.
Solution:
- Try restarting the WMI services, if it doesn't work, you can try re-installing it.
- If the solution doesn't work, you can try to increase the memory quota of the WMI provider service, with the following steps:
- Select Start > Run.
- Type "wbemtest.exe" and click Connect.
- In the namespace text box, type "root" and then click Connect.
- Select "Enum Instances..."
- In the Class Info dialog box, enter "__ProviderHostQuotaConfiguration" as the Superclass Name (note the double underscore at the front) and click OK.
- In the Query Result window, double-click __ProviderHostQuotaConfiguration=@".
- In the Object Editor window, double-click on the Property name you want to modify the quota for.
- In the Value dialog, enter the desired memory quota value:
- For Windows XP and Windows 2003, type "536870912" (512 MB).
- For Windows Vista and newer versions, start with "805306368" (768 MB) and increase to "1073741824" (1024 MB) if needed.
- Select Save Property and click Save Object.
- Now, close Wbemtest and restart your computer to apply the changes.
8. 8004100E - Invalid namespace
If you are facing this error, here is the probable reason and the remedial action:
Probable cause: Invalid namespace compiler is not a usual error. It is possible that the application using the namespace is not installed properly.
Solution:
- Try restarting the WMI services, if it doesn't work, you can try re-installing it.
9. 80041017 - Invalid query
If you are facing this error, here is the probable reason and the remedial action:
Probable cause: 'Query was not syntactically valid' is not a usual error. It is possible that the application using the namespace is not installed properly.
Solution:
- Recheck if the query syntax is entered correctly.
- If yes, try restarting the WMI services, if it doesn't work, you can try re-installing it.
10. 80010002 - WMI resource not found
If you are facing this error, here is the probable reason and the remedial action:
Probable cause: The requested WMI object or resource was not found. This error occurs when the RPC and WMI services are not running.
Solution:
- Check if the RPC and WMI services are running. To check, follow the steps listed below:
- Select Start > Run.
- Type 'services.msc' in the text box and click OK.
- In the listed services, see if the status of the RPC and WMI services are shown as started.
- If it is not started, start the services.
- Ensure that firewall or security software is not blocking WMI connections or queries.
- Try restarting the WMI services. If it doesn't work, you can try re-installing it.
For more details on error codes, refer the WMI error constants page.