Hi Darren, Once I have reset the system security. and if my errors disappear, what is the next step? I will need to push out the security settings again with a GPO right? ________________________________ From: gptalk-bounce@xxxxxxxxxxxxx on behalf of Darren Mar-Elia Sent: Mon 10/15/2007 11:17 AM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Re: WMI and MORE errors on multiple systems I doubt an ADM reset will work. How about trying to reset security on one system as a test? See http://support.microsoft.com/kb/313222/en-us for instructions. From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Piet Slaghekke Sent: Monday, October 15, 2007 8:03 AM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Re: WMI and MORE errors on multiple systems Hi everyone, I am still not able to fix this issue. Perhaps I need to import an ADM template to reset my wmi and firewall settings. I get the errors below consistently on all systems. Event ID: 1090 Event ID: 1085 Event ID: 1202 Thanks, ________________________________ From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Piet Slaghekke Sent: Friday, October 12, 2007 3:04 PM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Re: WMI and MORE errors on multiple systems Hi Darren, I don't think so. The only thing I have changed is some of the password requirements. I did have a corrupt default domain policy which I fixed. ________________________________ From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Darren Mar-Elia Sent: Friday, October 12, 2007 12:00 PM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Re: WMI and MORE errors on multiple systems Piet- Did you make any changes to system security on your systems that might be causing permission issues with WMI? Darren From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Piet Slaghekke Sent: Friday, October 12, 2007 6:37 AM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] WMI and MORE errors on multiple systems Hi Everyone, I am having an issue with my systems firewalls and WMI. I get the following text when I try to access my local windows firewall settings on my NIC's on all systems "Windows cannot display the properties of this connection. The Windows Management Instrumentation (WMI) information might be corrupted. To correct this, use System Restore to restore Windows to an earlier time (called restore point). System Restore is located in the System Tolls Folder in Accessories." I am hoping I can fix this from my domain controller and not have to fix each individual system. any help will be greatly appreciated. Thanks! Here are some errors and warnings: Application Logs Error 1 Event Type: Error Event Source: Userenv Event Category: None Event ID: 1090 Date: 10/12/2007 Time: 8:49:43 AM User: NT AUTHORITY\SYSTEM Computer: my computer Description: Windows couldn't log the RSoP (Resultant Set of Policies) session status. An attempt to connect to WMI failed. No more RSoP logging will be done for this application of policy. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp <http://go.microsoft.com/fwlink/events.asp> . Error 2 Event Type: Error Event Source: Userenv Event Category: None Event ID: 1085 Date: 10/12/2007 Time: 8:48:12 AM User: NT AUTHORITY\SYSTEM Computer: My computer Description: The Group Policy client-side extension Security failed to execute. Please look for any errors reported earlier by that extension. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp <http://go.microsoft.com/fwlink/events.asp> . Warning 1 Event Type: Warning Event Source: SceCli Event Category: None Event ID: 1202 Date: 10/12/2007 Time: 8:48:12 AM User: N/A Computer: My Computer Description: Security policies were propagated with warning. 0x4b8 : An extended error has occurred. For best results in resolving this event, log on with a non-administrative account and search http://support.microsoft.com <http://support.microsoft.com/> for "Troubleshooting Event 1202's". For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp <http://go.microsoft.com/fwlink/events.asp> . Warning 2 Event Type: Warning Event Source: EventSystem Event Category: (52) Event ID: 4356 Date: 10/12/2007 Time: 8:47:38 AM User: N/A Computer: my computer Description: The COM+ Event System failed to create an instance of the subscriber partition:{41E90F3E-56C1-4633-81C3-6E8BAC8BDD70}!new:{6295DF2D-35EE-11D1-8707-00C04FD93327}. CoGetObject returned HRESULT 8000401A. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp <http://go.microsoft.com/fwlink/events.asp> . Security Logs Event Type: Failure Audit Event Source: Security Event Category: Object Access Event ID: 560 Date: 10/12/2007 Time: 9:12:57 AM User: NT AUTHORITY\NETWORK SERVICE Computer: my computer Description: Object Open: Object Server: SC Manager Object Type: SERVICE OBJECT Object Name: winmgmt Handle ID: - Operation ID: {0,2815946} Process ID: 1928 Image File Name: C:\WINDOWS\system32\services.exe Primary User Name: my computer$ Primary Domain: my domain Primary Logon ID: (0x0,0x3E7) Client User Name: NETWORK SERVICE Client Domain: NT AUTHORITY Client Logon ID: (0x0,0x3E4) Accesses: READ_CONTROL Query information from service Privileges: - Restricted Sid Count: 0 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp <http://go.microsoft.com/fwlink/events.asp> .