WMI Repair in Windows XP

Continuing on my path of figuring out group policy I came across some errors on our Windows XP machines in the event log that I’ve been trying to repair for awhile now. For some reason the printers aren’t deploying to our Windows XP machines and I’m thinking it’s because the machines are having problems pulling the policy off the domain controller.  I also needed to use the system information tool to send to our anti-virus company so they could troubleshoot an issue we’re having with their software. But when I went to system information it said it could not collect the data.  It was event ID 1090, the source is Userenv, and it says:

I’ve been looking up this error for weeks trying to decipher how to repair Windows Management Instrumentation. Nearly every site and forum I found said either to empty the c:\windows\system32\wbem\repository folder, re-register the dll files associated with WMI, or do a repair installation of Windows XP.  I emptied that folder I don’t know how many times.  I tried using system file checker to replace any corrupted system files. I also ran the WMI diagnostic tool you can download from Microsoft to see if that would point me in any other directions, but I didn’t find it terribly helpful – except for one thing I found in the log file that it generates.

I came across the same error when I tried to re-register the dll files and when I ran the diagnostic tool.

!! ERROR: WMI CONNECTION errors occured for the following namespaces:

.1581 14:13:07 (0) ** – Root, 0x80070005 – Access is denied..
.1582 14:13:07 (0) ** – Root, 0x80070005 – Access is denied..
.1583 14:13:07 (0) ** – Root/Default, 0x80070005 – Access is denied..
.1584 14:13:07 (0) ** – Root/CIMv2, 0x80070005 – Access is denied..
.1585 14:13:07 (0) ** – Root/WMI, 0x80070005 – Access is denied..

Access denied? I had no idea why access would be denied. I’m the admin and have full permissions. Well today I finally figured out the problem. Since I was having problems today using the system information tool, I googled that error and came across this forum that had a script in it.  When I tried to run the script the first time on my account I got the access denied errors again.  So I went to the run box and typed services.msc. I looked at the WMI service to see what account it was logging on as, it says local administrator account. Well that’s good, so I next look at the remote procedure call (RPC) service and that one originally said log on as NT Authority or some other network account.

Well I changed that one to local administrator, rebooted the machine in safe mode so that no services were running, and ran the script from that forum again. It took awhile but I noticed it wasn’t throwing any access denied errors. I rebooted the machine, logged in on my regular network account and did not see a single RSoP error in the event log. Success.

Copy this script into notepad or some other text editor and save it as fixwmi.cmd. When you go to save as you’ll have to select all files in the file type so it doesn’t save as a text file.

@echo on
cd /d c:\temp
if not exist %windir%\system32\wbem goto TryInstall
cd /d %windir%\system32\wbem
net stop winmgmt
winmgmt /kill
if exist Rep_bak rd Rep_bak /s /q
rename Repository Rep_bak
for %%i in (*.dll) do RegSvr32 -s %%i
for %%i in (*.exe) do call :FixSrv %%i
for %%i in (*.mof,*.mfl) do Mofcomp %%i
net start winmgmt
goto End

:FixSrv
if /I (%1) == (wbemcntl.exe) goto SkipSrv
if /I (%1) == (wbemtest.exe) goto SkipSrv
if /I (%1) == (mofcomp.exe) goto SkipSrv
%1 /RegServer

:SkipSrv
goto End

:TryInstall
if not exist wmicore.exe goto End
wmicore /s
net start winmgmt
:End

Now I’m seeing another error related to to group policy, but hey, at least it isn’t a WMI error.

Sources:

  1. How to Troubleshoot Service Startup Permissions
  2. Solved: Can’t Collect Information

, ,

  1. #1 by Kent R. Rieske on July 20, 2012 - 10:24 AM

    I went to Start – run and type: C:\fixwmi.cmd [Enter]
    After several pauses the program ran to completion. I restarted the computer and reinstalled the Seagate Replica GoFlex Desk external backup. It ran perfectly without the previous “Volume Shadow Service is not working correctly” and “WMI Writer is in failed state.” Relica created the necessary “Restore Points” and did not display any error messages. WOW! This is great. Thank you. It is a shame that Microsoft support and Seagate support are superficial and ineffective.

  2. #2 by Kent R. Rieske on July 19, 2012 - 8:33 PM

    I am getting WMI error messages when using Seagate Replica GoFlex Desk backup drive.
    The suggestions from Seagate support has not helped. My WMI seems to be empty when I go to right click computer – management – Services
    The script file fixwmi.cmd looks like a batch file. How is it executed?
    Let’s say I save the file as C:\fixwmi.cmd
    Do I go to Start – run and type: C:\fixwmi.cmd [Enter]
    Thank you very much,
    Kent

    • #3 by jen3ral on July 19, 2012 - 9:51 PM

      I think so. You know, I can’t remember for sure, I just go to where I saved the file and double click it to run it.

  3. #4 by Rich on June 13, 2012 - 10:48 AM

    Thank you! First usable piece of information I have found after hours of searching.

  4. #5 by Jerome on June 10, 2012 - 11:34 AM

    Solve similar problem, thanks a lot.

  5. #6 by Jeff on November 15, 2011 - 1:41 PM

    Thank you, that “Access denied” error had me stumped. The Mofcomp step failed on several files for me, something about performance data not being found, but WMI seems to be working again.

  6. #7 by mizar on September 15, 2011 - 4:20 AM

    Thanks. Worked perfect for me.

  7. #8 by noblemonkey on June 29, 2011 - 6:09 PM

    Thank you for this! I tried all sorts of things to fix a bust WMI, and your scripts worked a charm.

  1. Fix Wmi Errors Windows Xp Windows XP, Vista, 7, 8 [Solved]
  2. Fix Windows Xp Wmi Error Errors - Windows XP, Vista & Windows 7, 8

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: