[gptalk] Re: WMI and MORE errors on multiple systems

  • From: "Darren Mar-Elia" <darren@xxxxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Fri, 12 Oct 2007 09:00:05 -0700

Piet-

Did you make any changes to system security on your systems that might be
causing permission issues with WMI? 

 

Darren

 

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Piet Slaghekke
Sent: Friday, October 12, 2007 6:37 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] WMI and MORE errors on multiple systems

 

Hi Everyone, 

 

I am having an issue with my systems firewalls  and WMI. 

 

I get the following text when I try to access my local windows firewall
settings on my NIC's on all systems

 

 "Windows cannot display the properties of this connection. The Windows
Management Instrumentation (WMI) information might be corrupted.  To correct
this, use System Restore to restore Windows to an earlier time (called
restore point). System Restore is located in the System Tolls Folder in
Accessories."

 

I am hoping I can fix this from my domain controller and not have to fix
each individual system.  

 

any help will be greatly appreciated.  Thanks! 

 

 

Here are some errors and warnings:

 

Application Logs

 

Error 1

 

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1090
Date:  10/12/2007
Time:  8:49:43 AM
User:  NT AUTHORITY\SYSTEM
Computer:  my computer

Description:  Windows couldn't log the RSoP (Resultant Set of Policies)
session status. An attempt to connect to WMI failed. No more RSoP logging
will be done for this application of policy.

 

For more information, see Help and Support Center at
<http://go.microsoft.com/fwlink/events.asp>
http://go.microsoft.com/fwlink/events.asp.
 

Error 2

 

 Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1085
Date:  10/12/2007
Time:  8:48:12 AM
User:  NT AUTHORITY\SYSTEM
Computer: My computer

Description: The Group Policy client-side extension Security failed to
execute. Please look for any errors reported earlier by that extension.

 

For more information, see Help and Support Center at
<http://go.microsoft.com/fwlink/events.asp>
http://go.microsoft.com/fwlink/events.asp.

 

Warning 1

 

Event Type: Warning
Event Source: SceCli
Event Category: None
Event ID: 1202
Date:  10/12/2007
Time:  8:48:12 AM
User:  N/A
Computer: My Computer
Description: Security policies were propagated with warning. 0x4b8 : An
extended error has occurred.

 

For best results in resolving this event, log on with a non-administrative
account and search  <http://support.microsoft.com>
http://support.microsoft.com for "Troubleshooting Event 1202's".

 

For more information, see Help and Support Center at
<http://go.microsoft.com/fwlink/events.asp>
http://go.microsoft.com/fwlink/events.asp.

 

 

Warning 2

 

Event Type: Warning
Event Source: EventSystem
Event Category: (52)
Event ID: 4356
Date:  10/12/2007
Time:  8:47:38 AM
User:  N/A
Computer: my computer 

Description: The COM+ Event System failed to create an instance of the
subscriber
partition:{41E90F3E-56C1-4633-81C3-6E8BAC8BDD70}!new:{6295DF2D-35EE-11D1-870
7-00C04FD93327}.  CoGetObject returned HRESULT 8000401A.

 

For more information, see Help and Support Center at
<http://go.microsoft.com/fwlink/events.asp>
http://go.microsoft.com/fwlink/events.asp.

 

 

Security Logs

 

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access 
Event ID: 560
Date:  10/12/2007
Time:  9:12:57 AM
User:  NT AUTHORITY\NETWORK SERVICE
Computer: my computer
Description:
Object Open:
  Object Server: SC Manager
  Object Type: SERVICE OBJECT
  Object Name: winmgmt
  Handle ID: -
  Operation ID: {0,2815946}
  Process ID: 1928
  Image File Name: C:\WINDOWS\system32\services.exe
  Primary User Name: my computer$
  Primary Domain: my domain

  Primary Logon ID: (0x0,0x3E7)
  Client User Name: NETWORK SERVICE
  Client Domain: NT AUTHORITY
  Client Logon ID: (0x0,0x3E4)
  Accesses:  READ_CONTROL 
   Query information from service 
   
  Privileges:  -
  Restricted Sid Count: 0

 


For more information, see Help and Support Center at
<http://go.microsoft.com/fwlink/events.asp>
http://go.microsoft.com/fwlink/events.asp.

 

 

 

 

Other related posts: