Quota Violation Issues: Memory and/or Handle

Symptoms

• General WMI-based scripts or applications fail or fail intermittently
• Applications such as SMS/SCCM produce errors on server and/or inventories fail or fail intermittently
• Applications such as Exchange or SQL fail on server or fail intermittently
• Unable to connect to specific namespace via WBEMTEST or unable to query specific classes in a namespace. May be intermittent.
• WMI appears to be hung or non-responsive
• Unable to run msinfo32 or tasklist
• Events for unexpected termination/crash of wmiprvse.exe
• Lower than normal available memory on the system
• Out of memory errors when running certain WMI tasks
• 0x80041033 -- SHUTDOWN of the target provider
• 0x80041006 – OUTOFMEMORY
• 0x80041013 -- fail to load the provider
• 0x800705af -- The paging file is too small for this operation to complete
• 0x8004106C-- Quota violation
• Event logs contain WMI-related events
• WMI service crashing

Event Source: Service Control Manager
Event ID: 7031
Description: The Windows Management Instrumentation service terminated unexpectedly

• Handle Quota Violation

Source: Microsoft-Windows-WMI
Event 5612 Wmiprvse.exe exceeding handle quota limit Event
WMI has stopped WMIPRVSE.EXE because a quota reached a warning value. Quota: %1 Value: %2 Maximum value: %3 WMIPRVSE PID: %4

• Memory Quota Violation does not log and event such as Handle Quota Violation does. You can check to see if any instance of wmiprvse is using 500 mb of memory or greater as the default limit is 512 mb on Vista an newer. Once you hit around 500 mb and any new allocation that would cross the 512 mb limit would fail. All instances of wmiprvse combined have a 1 gb limit. For Windows XP and 2003 the default is 128 mb. Exceed the default and you have reached a Quota Violation. Also check for Windows Management Instrumentation service crashing

Memory Quota Violations refer to Ask Perf blog: WMI: High Memory Usage by WMI Service or Wmiprvse.exe (COMING SOON)

Handle Quota Violations refer to Ask Perf blog:How to Troubleshoot WMI High Handle Count (COMING SOON)

Missing or Failing WMI Providers or Invalid WMI Class

Symptoms

• General WMI-based scripts or applications fail
• Applications such as SMS/SCCM produce errors on server and/or inventories fail
• Applications such as Exchange or SQL fail on server
• Unable to connect to specific namespace via WBEMTEST or unable to query specific classes in a namespace
• WMI functionality appears normal on local node but unable to connect to/from machine via WMI scripts, tools or applications
• WMI (Local) properties in wmimgmt.msc console and see the following

Failed to initialize all required WMI classes
Win32_processor: WMI: Invalid namespace
Win32_WMISetting: WMI: Invalid namespace
Security information: Successful
Win32_OperatingSystem: WMI: Invalid namespace
Win32_processor: WMI: Invalid namespace
Win32_WMISetting: WMI: Invalid namespace
Win32_OperatingSystem: WMI: Invalid namespace

• WBEM_E_NOT_FOUND 0x80041002
• WBEM_E_PROVIDER_FAILURE 0x80041004
• WBEM_E_INVALID_NAMESPACE 0x8004100E
• WBEM_E_INVALID_CLASS 0x80041010
• WBEM_E_PROVIDER_NOT_FOUND 0x80041011
• WBEM_E_INVALID_PROVIDER_REGISTRATION 0x80041012
• WBEM_E_PROVIDER_LOAD_FAILURE 0x80041013

Refer to Ask Perf blog: WMI: Missing or Failing WMI Providers or Invalid WMI Class (COMING SOON)

High Memory Usage by WMI Service or Wmiprvse.exe

Symptoms

• Wmiprvse.exe memory quota violations – refer to top of blog
• Lower than normal available memory on the system
• Delayed or slow logons to the box
• Excessive or slow return times to queries to WMI or scripts that are running that call to WMI
• Spinning donut when trying to bring up WMI (Local) properties in wmimgmt.msc console or using Wbemtest (Windows Management Instrumentation Tester) built in tool
• Sluggish or slow responding system
• Server hang
• Unable to run msinfo32 or tasklist
• Svchost process housing WMI service (winmgmt) exhibiting high memory usage or leak
• Instance of wmiprvse reaching or exceeding 512 mb on Vista and newer, or 128 mb on XP or Windows 2003: Quota Violation issue
• Large repository C:\Windows\System32\Wbem\Repository folder and objects.data file is 1gb or larger
• Cluster management tools not working

Refer to Ask Perf blog:WMI: High Memory Usage by WMI Service or Wmiprvse.exe (COMING SOON)

High CPU Usage by WMI Components

Symptoms

• High cpu usage by svchost hosting WMI service (winmgmt)
• High cpu usage by wmiprvse
• System sluggish or slow performance

Refer to Ask Perf blog: How to troubleshoot High CPU Usage by WMI Components (COMING SOON)

High Handle Count on WMI Components

Symptoms

• Refer to top of blog: Quota Violation Issues: Memory and/or Handle 
• Following Event being logged

Source: Microsoft-Windows-WMI
Event 5612 Wmiprvse.exe exceeding handle quota limit Event
WMI has stopped WMIPRVSE.EXE because a quota reached a warning value. Quota: %1 Value: %2 Maximum value: %3 WMIPRVSE PID: %4

• Resource depletion type messages
• Error message: No more treads can be created in the system
• Message when trying to RDP

The User Profile Service service failed the logon

• High handle count on svchost process hosting WMI service (winmgmt)
• Cluster management tools not working

Refer to Ask Perf blog: How to Troubleshoot WMI High Handle Count (COMING SOON)

Repository Corruption

Symptoms

• General WMI-based scripts or applications fail
• Applications such as SMS/SCCM produce errors on server and/or inventories fail
• Applications such as Exchange and SQL fail on server
• WINMGMT.MSC Security tab shows missing, repeating and/or gibberish namespace entries
• Unable to connect to specific or possibly any namespace via WBEMTEST
• Winmgmt.msc console WMI (local) properties Security tab shows missing, repeating and/or gibberish namespace entries
• Unable to connect to root\default or root\cimv2 namespaces. Fails returning error code 0x80041002 pointing to WBEM_E_NOT_FOUND
• Opening Computer Management and Right Click on Computer Management (Local) and select Properties, you get the following error: "WMI: Not Found" or it hangs trying connect
• Wbemtest (Windows Management Instrumentation Tester) built in tool hangs
• Error 0x80041010 WBEM_E_INVALID_CLASS
• Any events with Source = Microsoft-Windows-WMI, look for any of the following WMI event IDs: 28, 65, 5600, 5601, 5614 as any of these can be indicators or repository corruption
• WMI namespaces end up missing

Refer to Ask Perf blog: WMI: Repository Corruption, or Not?

Next up: WMI: Repository Corruption, or Not?

 　執行役 専務 マーケティング＆オペレーションズ担当の平野 拓也です。米国時間 8 月 7 日に IE Blog（英語）において、Internet Explorer に関する重要なお知らせがありました。以下にその日本語訳をご紹介します。 

---

最新の Internet Explorer をご利用ください

　5 月にお知らせしたとおり、マイクロソフトは、より安全なブラウザーを提供し、ユーザーが常に最新バージョンの Internet Explorer を使えるよう支援するために継続的な投資を行なっています。本日は、お使いのオペレーティング システム向けの最新の Internet Explorer への移行計画に有用な移行リソース、アップグレードの指針、サポート タイムラインの詳細といった重要な情報をお知らせします。

　マイクロソフトは、モバイルファースト、クラウドファーストの世界においてユーザーがより多くのことを達成できるようにするための革新的で変革を促すサービスを提供しており、Internet Explorer はこのビジョンの中核にあります。今日のデジタルな世界では、数十億人の人々が、仕事と生活の両面で、クラウドサービス ベースのアプリケーションが稼働するインターネット接続デバイスを活用しています。最新の Web サイトやサービスにいつでも、どこでも、どのデバイスを使っても接続でき、高速で安全な体験を得るために、モダンなブラウザーの稼働が未だかつてないほど重要になっています。

開発者とユーザーにとっての利点

　ユーザーが最新の Web ブラウザーを使うことは、開発者に利益をもたらします。古いブラウザーはモダンな Web 標準をサポートしないことがあるため、ブラウザーの分断化が Web サイトの開発者にとっての問題になっています。また、ユーザーがモダンなブラウザーを使っていれば、Web アプリの開発者も作業を効率化でき、より良い製品とロードマップを構築できます。アップグレードを行なうことは開発者の方々全体の利益につながります。

　ユーザーも、オンラインのリスクを減少しつつ、仕事と生活の両面で最新の体験を提供できるモダンなブラウザーから利益を得られます。マイクロソフトの最新のモダン ブラウザーである Internet Explorer 11 は以下のような多くの利点を提供します。

• セキュリティの向上– モダンな Web ブラウザーでは適切なセキュリティ保護を提供していますが、旧バージョンのブラウザーは Web エコシステムを安全に維持する上で大きな課題になります。Internet Explorer 11 は、拡張保護モードなどの機能によりユーザーを安全に守ります。マイクロソフトは、Internet Explorer の潜在的脆弱性を積極的に修正しており、お客様を保護するための努力は成果をもたらしています。NSS Labs によれば、悪意のあるソフトウェアに対する保護件数は、2009 年の Internet Explorer 8 では 69%でしたが、Internet Explorer 11 では 99% 以上になっています。パッチを完全に適用した最新の Internet Explorer が旧バージョンよりも安全であるのは驚くに値しません。
• 生産性– 最新の Internet Explorer は、より高速であり、よりモダンな Web 標準をサポートしており、既存 Web アプリとの互換性も優れています。レガシーの Web アプリに加えて、Office 365 など最新の Web サイトとサービスを稼働できる点においてもユーザーにとって有益です。
• 将来の拡張性— アップグレードを行ない最新バージョンの Internet Explorer を使い続けることは Windows 8.1 Update および最新の Windows タブレットなどのデバイスへの移行を容易にし、次世代のテクノロジや生産性の可能性を広げます。

ブラウザー移行の指針

　マイクロソフトは、最新バージョンの Internet Explorer などの最新のコンピューティング体験を確実に得られるように、自動アップデートを有効化することを推奨しており、ほとんどの消費者は自動アップデートを有効化しています。法人のお客様には、アップデート（特にセキュリティ間連）を迅速にテストし、アップデートすることをお勧めします。定期的なアップデートは、セキュリティリスクの減少や信頼性の向上などの多大なメリットをもたらします。Windows Update は、Internet Explorer と Windows のアップデートを自動的にインストールすることができます。

　使用しているオペレーティング システムで利用可能な最新ブラウザーをまだ稼働していないお客様は、アップグレードを行ない、最新バージョンを維持することで、ブラウザー体験の高速化と安全性向上を達成することをお勧めします。2016 年 1 月 12 日以降、以下のオペレーティング システムとブラウザーのバージョンの組み合わせがサポートされることになります。

　 2016 年 1 月 12 日以降は、サポートされるオペレーティング システム向けの最新バージョンの Internet Explorer だけが技術サポートとセキュリティ アップデートを受けられることになります。たとえば、Windows 7 SP1 上で Internet Explorer 8、Internet Explorer 9、あるいは、Internet Explorer 10 を使用しているお客様は、セキュリティ アップデートと技術サポートを継続的に受けられるよう Internet Explorer 11 へ移行することをお勧めします。Windows と Windows Embedded のサポートのタイムラインに関する詳細情報についてはマイクロソフト サポート ライフサイクルのサイトをご参照ください。

　 Internet Explorer の以前のバージョンでの標準化を行なっている法人のお客様もいるため、マイクロソフトは最新ブラウザーへのアップグレードを行ない、最新状態を維持するための新たな機能とリソースを公開しました。お客様には、モダンな Web アプリの性能、セキュリティ、生産性上のメリットを得るためにモダンな標準へのアップグレードを計画することをお勧めしますが、短期的には、レガシーの Web アプリへの後方互換性はコスト効率に優れた手段になり得ます。2014 年 4 月にリリースされた Internet Explorer 11 向けエンタープライズ モードでは、後方互換性を強化しており、モダンな Web 標準への移行期に多くのレガシー Web アプリを稼働可能にします。

　 本日、マイクロソフトは、お客様が Internet Explorer の最新バージョンを使用しながら既存の Web アプリへの投資を拡張できるよう支援するために、エンタープライズ モードがオペレーティング システムのライフサイクルの全期間を通じてサポートされようになることを発表します。たとえば、Windows 7 ではエンタープライズ モードは 2020 年 1 月 14 日までサポートされます。マイクロソフトは、エンタープライズ モードの後方互換性機能の向上を継続し、お客様が Internet Explorer の最新バージョンにアップグレードして、最新状態を維持できるよう支援するためのツールとリソースに投資しています。

ブラウザー移行のリソース

　 マイクロソフトは、Internet Explorer の最新バージョンへの移行を望むお客様やパートナー向けに多くのオンライン サポート リソースを提供しています。

1. Modern.IE– 成功事例および MSDN からの規範的ガイダンスを取り入れた、サイトを最新標準に更新するための一連の開発者支援ツールです。企業ネットワーク内の Web アプリケーションを評価するためのイントラネット スキャナもダウンロード可能です。
2. Internet Explorer TechCenter– Internet Explorer TechNet サイトでは、Internet Explorer を実装、メンテナンス、およびサポートするための技術リソースが提供されています。Web アプリが使い続けられるよう支援する後方互換性機能である、Internet Explorer 11 向けエンタープライズ モード関連の情報が詳細にカバーされています。
3. Internet Explorer デベロッパー センター– MSDN 開発者サイトでは、Internet Explorer のアプリケーション開発に関連したリソースが提供されています。
4. Microsoft Assessment and Planning (MAP) Toolkit– ソフトウェア エージェントを使用することなく、現在のブラウザーインストール基盤を評価できる、インベントリ及びプランニングを行うツールです。

　 現場でのガイドを希望するお客様やパートナー向けに、マイクロソフトは移行を支援する以下のような多くの実装と互換性関連サービスを提供しています。。

1. マイクロソフト Premier サポート サービス– Premier サポート サービスを利用することで、自社の IT 基盤から最大の価値が得られるようになります。マイクロソフトの専任サポートチームが継続的なハンズオン支援と緊急課題のエスカレーションを提供することで、問題解決を迅速化し、ミッションクリティカルなシステムの無停止運用に貢献します。
2. マイクロソフト コンサルティング サービス– マイクロソフト テクノロジの迅速で効果的な展開により、投資から価値を見出すまでの期間を短縮できます。また、従業員がテクノロジをフルに活用することで、スキルの向上とビジネスの拡大に貢献します。Microsoft Services のコンサルタントが、マイクロソフトのテクノロジを効率的に展開できるようお客様の組織と協業します。きわめて複雑なプロジェクトにおいてもリスクを最小化できるよう支援できます。マイクロソフトのプラットフォームに関する専門知識、および、グローバルなパートナー ネットワークと技術コミュニティとの協業により、お客様のイノベーションとマイクロソフトのテクノロジとソリューションが実現可能なアイデアを検討する際、最大限に支援します。
3. Internet Explorer Migration Workshop– Microsoft Services Internet Explorer Migration Workshop は、IT プロフェッショナルと開発者向けに構成されたワークショップにより、お客様に Internet Explorer の 最新バージョンへの移行プロセスの理解を支援します。お客様の業務分野の専門家が互換性問題とその解決手法を迅速に評価します。詳細情報については、Microsoft Services 営業担当者にお問い合わせいただくか、www.microsoft.com/servicesをご参照ください。
4. Pinpoint によるマイクロソフトパートナーの検索– Internet Explorer（および .NET フレームワーク）の最新バージョンへのアップグレードを、ビジネスとアプリケーションへの影響を最小化しながら支援できる、お客様の業務分野に通じた認定ITスペシャリストを見つけるお手伝いをします。

　 お客様のアップグレードを支援する後方互換性とリソースを提供することで、マイクロソフトは、企業のお客様による Internet Explorer の最新バージョンの利用を今まで以上に容易にしています。Internet Explorer 11 への移行は、モダンな Web 標準、性能向上、セキュリティ強化、信頼性強化に加えて、Windows 8.1 Update、Office 365 などのサービス、最新の Windows デバイスへのアップグレードを可能性にします。

As well as listening to partners, Microsoft also listens to our SMB customers, offering ongoing advice and support for this community.

Forming part of this commitment, we often meet face to face with a number of SMBs in our SMB mini Summit, where we connect with real business owners to talk about growth, finance, recruitment and more.

You can now access some great insights if you sell into the SMB space.

Alternatively attend one of our short webinars to help you, help your SMB customers, address those common business challenges and overcome any obstacles which are preventing them from achieving more.

Ontem, nós fornecemos a notificação prévia para o lançamento de nove boletins de segurança. Dois destes são críticos, e os sete restantes são importante em severidade. Essas atualizações são para SQL Server, SharePoint, OneNote, .NET, Microsoft Windows e Internet Explorer.

Conforme nosso processo usual, marcamos o lançamento do boletim de segurança para a segunda terça-feira do mês, 12 de agosto de 2014, aproximadamente 10 a.m. PDT. Revisite este blog para análise do impacto relativo, bem como orientação para implantação, juntamente com uma breve visão geral de atualizações do mês.

Teremos nosso Webcast de boletim de segurança, marcada na quinta-feira,14 de agosto, às 15:30 horário de Brasília.

Registre-se: https://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032575587

Não se esqueça, você também pode nos seguir no Twitter em @LATAMSRC.

Obrigado

GBS Security LATAMSRC

For newborn Piper McAlister, timing is everything. Arriving 4 weeks pre-mature, she was born with pneumothorax- a condition in which an infant’s lungs can’t expand and the baby cannot breathe.  In such a case, medical staff have approximately 6 minutes to intervene and stabilize. For Piper and her parents, those 6 minutes could literally have become a lifetime, but thanks to the staff at the Intermountain Healthcare Valley View Medical Center, and the remote care team located at Dixie Regional Medical Center, Piper received the expert medical attention she needed. Doctors and nurses were able to consult with specialists via a brand new teleservices solution that had only been installed for 3 days.

Ayer, proporcionamos la notificación previa para la liberación de nueve boletines de seguridad. Dos de ellos son críticos, y los siete restantes son importantes en la gravedad. Estas actualizaciones son para SQL Server, SharePoint, OneNote, .Net, Microsoft Windows e Internet Explorer.

Según nuestro proceso habitual, marcamos el lanzamiento del boletín de seguridad para el segundo martes del mes, 12 de agosto de 2014, aproximadamente 10:00 am PDT. Revise este blog para el análisis del impacto relativo, así como orientación para la implementación, junto con una breve descripción de las actualizaciones del mes.

Tendremos nuestro Boletín Webcast de los boletines de seguridad, programado el jueves 14 de agosto, a las 10:30 Horário Atlántico.

Regístrese: https://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032575643

También puede seguirnos en Twitter en @LATAMSRC.

Gracias

GBS seguridad LATAMSRC

Check out this video to see how System Center Advisor helps Enterprise Operation teams transform machine data and unstructured logs into Real Time Operations Intelligence: http://channel9.msdn.com/Shows/Edge/Edge-Show-114-Log-Management-and-Other-Intelligence-Packs-in-System-Center-Advisor

Como indicado nas estatísticas recentes do TechNet Wiki, a Comunidade Francesa está entre às 5 com maiores contribuições de artigos.

Todo este conteúdo valoriza o conhecimento de diferentes tecnologias para diversos países que falam francês: Bélgica, Canadá, França ( óbvio =^b ) e outros.

A participação destacada de alguns membros que falam o idioma francês, divulgando o nosso Wiki também em eventos (presenciais e web) definiram um novo status para os franceses.

No fim do mês de julho, o Conselho da Comunidade aprovou a criação de um Blog Wiki Ninja dedicado ao idioma francês.

Logo, o Blog francês foi criado e divulgado para toda Comunidade Internacional como um prêmio pelas diversas contribuições.

Convidamos todos da Comunidade para conhecer o trabalho realizado pelos Wiki Ninjas Franceses em:

http://blogs.technet.com/b/wikininjasfr/

Parabéns pelo Blog!!! Um grande marco para às Comunidades MSDN e TechNet da França. 

Sucesso! Esperamos divulgar sempre o crescimento e os grandes destaques franceses do TechNet Wiki.

Até +,

Wiki Ninja Durval Ramos ( Blog, Twitter, Wiki, Perfil )

Hey present or future Azure fans,

I have always been a big fan of Microsoft publishing presentation materials so that you don't have to spend time creating these materials from scratch. For example, when you start with a Microsoft-published PowerPoint deck on a product, feature, technology, or solution, you can use them as is or customize them for a specific audience or purpose. Use them with the confidence that they contain the right emphasis, messaging, graphics (with some cool animations!), and are technically accurate (as of their publication date).

To this end, I am very pleased to inform you that for Microsoft Azure, there are a set of great slide decks for Azure technologies and scenarios in the Azure Readiness Content download.

This download creates the AzureReadiness-DevCamp folder with subfolders for:

• Big Data
• Data
• IaaS
• Identity
• Integration
• Keynote
• Media
• Mobile
• PaaS
• Web

In each subfolder is a PowerPoint slide deck that you can use a basis for presenting to your peers, management, customers, or community (such as at local user groups or conferences). Here is an example of a slide from the deck in the Big Data folder:

Note that you can also get the set of icons for Azure services that Microsoft uses in much of its documentation by downloading the Azure Symbol/Icon set.

I hope these resources are useful to you.

Joe Davies

If you have questions, or if you’d like to join the SAB, email us at SAB@microsoft.com.

Summary:

If the Excel Services global option "Use the EffectiveUserName" is turned on, then all workbooks that use secure store service ID's (SSID) will not refresh data and can not create connections to the SSAS data sources. So effectively the SSID authentication option is not useable if the EffectiveUserName global option is turned on.

ULS entry:

ExternalSource.ValidateConnection: Unable to get a connection: ... Microsoft.Office.Excel.Server.CalculationServer.ExternalSource.TryGetValidatedConnection

Status:

The product group is investigating the issue right now, a fix maybe provided in the near future.

This post shares important information regarding support timelines for two empowering technologies—Internet Explorer and .NET Framework— to help you plan moving to the latest versions, where applicable, and ensure you take the necessary steps needed to become more secure and benefit from the latest releases.

The latest Internet Explorer browser offers many benefits such as improved security, additional speed, increased compatibility, and the ability to run the latest web sites and services, helping customers connect anytime, anywhere.  Internet Explorer is core to enabling a mobile-first, cloud first world and we encourage customers to test and apply updates upon release for a more secure and improved user experience.  For those not yet running the latest browser available for your operating system, we encourage you to migrate soon to take advantage of the latest security and functionality. 

Beginning January 12, 2016, only the most current version of Internet Explorer available for a supported operating system will receive technical support and security updates, as shown in the table below:

* For more details on the support lifecycle, including the latest Windows Embedded operating system and Internet Explorer browser combinations, see the Microsoft Internet Explorer Support Lifecycle Policy Page.

If you are running on an older version of Internet Explorer, such as Internet Explorer 8 on Windows 7 SP1, we recommend you plan your migration to one of the above supported operating system and browser combinations by January 12, 2016.   Microsoft offers many online support resources to help you upgrade to a current version, as well as a number of deployment and compatibility services available to assist with migrations.  You can visit the Internet Explorer Blog, which includes guidance and upgrade resources.

We are especially sensitive to your needs to ensure existing web applications that were developed for previous versions of Internet Explorer, such as Internet Explorer 8, continue working while also ensuring you benefit from the latest and most secure version of Internet Explorer.  In order to ease the migration of applications to current web standards, Enterprise Mode for Internet Explorer 11, released in April 2014, offers better backward compatibility and enables you to run many legacy web applications once you upgrade to a more modern browser.  Microsoft is committed to supporting Enterprise Mode through the duration of the operating system lifecycle and continuing to improve Enterprise Mode backward compatibility, helping customers extend existing web application investments as needed.   As an example, Windows 7 SP1 running Internet Explorer with Enterprise Mode will be supported through January 14, 2020.  Microsoft will also continue to invest in tools and other resources to help customers upgrade and stay up-to-date on the latest version of Internet Explorer.

Just as the latest Internet Explorer provides the best experience for customers, the .NET Framework does the same for developers or for applications built upon it.  The latest .NET Framework, version 4.5.2, offers new workflow features, improved diagnostics, additional performance improvements, and provides a seamless update requiring no recompilation if upgrading from within the .NET 4.x family.  If your company is using a version of .NET 4.x, beginning January 12, 2016 only .NET Framework 4.5.2 will continue receiving technical support and security updates.  After this date, Microsoft will no longer support .NET 4, 4.5, or 4.5.1.  There is no change to the support timelines for any other .NET Framework version, including .NET 3.5 SP1, which will continue to be supported for the duration of the operating system lifecycle.  For more details on the .NET Framework support lifecycle, visit the Microsoft .NET Framework Blog Link or Microsoft .NET Support Lifecycle Policy page.

The innovation with Internet Explorer and .NET Framework is one step in helping customers take full advantage of a mobile-first and cloud-first world.

Scenario

Windows Management Instrumentation failing due to repository being corrupted

The WMI Repository (%windir%System32\Wbem\Repository) is the database that stores meta-information and definitions for WMI classes; in some cases the repository also stores static class data as well. If Repository becomes corrupted, then the WMI service will not be able to function correctly.

Before grabbing that preverbal hammer approach and just rebuilding your repository, ask yourself, “Is the WMI repository OK?”

Common symptoms that lead to this question are: provider load failure, access denied, class not found, invalid namespace, and namespace not found to mention a few.

If you suspect WMI or repository corruption, rebuilding repository is the last thing you should do without verifying this is truly the case. Deleting and rebuilding the repository can cause damage to Windows or to installed applications. Other steps should be taken first to eliminate other possibilities or to confirm we have repository corruption. Noting here that having a repository too large also creates problems; an issue that can sometimes be interpreted as a corrupt repository, which is not always the case. If issues are due to a large repository, rebuilding the repository is currently the only method available to reduce it back to a working size.

Since I mentioned “large repository”, let me set some guidelines up front. There is no hard fast number per say as to when you will start feeling performance problems with a large repository. As a guideline, if the objects.data file, located in (%windir%System32\Wbem\Repository, is 1 GB or larger, then I would recommend rebuilding your repository to reduce it back down to a working and manageable size. If the size is between 600-900 MB, and you are not feeling any noticeable performance issues, then I would recommend against rebuilding the repository.

If WMI is corrupted, you can receive various errors and symptoms, depending on what activity was being done at the time. Below is a few errors and symptoms that could indicate that the repository is corrupted:

1. Unable to connect to root\default or root\cimv2 namespaces. Fails returning error code 0x80041002 pointing to WBEM_E_NOT_FOUND.
2. When we open Computer Management and Right Click on Computer Management (Local) and select Properties, you get the following error: "WMI: Not Found" or it hangs trying connect
3. 0x80041010 WBEM_E_INVALID_CLASS
4. Trying to use wbemtest, it hangs
5. Schemas/Objects missing
6. Strange connection/operation errors (0x8007054e):

get-cimclass : Unable to complete the requested operation because of either a catastrophic media failure or a data structure corruption on the disk.

At line:1 char:1

+ get-cimclass -Namespace root\cimv2\TerminalServices

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : NotSpecified: (:) [Get-CimClass], CimException

+ FullyQualifiedErrorId : HRESULT 0x8007054e,Microsoft.Management.Infrastructure.CimCmdlets.GetCimClassCommand

Check the Windows Application log for events in the past week where Source = Microsoft-Windows-WMI.  Look for any of the following WMI event IDs: 28, 65, 5600, 5601, 5614. Any of these could indicate a WMI repository issue or core infrastructure problem.

If you do not find any of these events logged, your next action is to use the built in repository checker. From an elevated command prompt run "winmgmt /verifyrepository". If the repository has an issue, it will respond "repository is not consistent".

If repository check comes back as “consistent”, then look at my other Ask Perf blogs for applicability:

WMI: Missing or Failing WMI Providers or Invalid WMI Class (COMING SOON)

WMI: High Memory Usage by WMI Service or Wmiprvse.exe (COMING SOON)

How to troubleshoot High CPU Usage by WMI Components (COMING SOON)

WMI Self-Recover

When the WMI service restarts or detects Repository corruption, the self-recovery procedure will trigger automatically in two approaches (one or the other):

1. AutoRestore: if the VSS backup mechanism enable snapshot the timestamp backup images In the system (ex. Win7 feature: previous fileversion), WMI will apply the AutoRestore approach to restore backup valid images in version queue. (if possible)
   • EVT: 65 (start restore) / 66 (succeed recovered with VSS Path)

2. AutoRecovery: the rebuild process to generate fresh images of Repository based on registered mofs( listed @ HKLM\Software\Microsoft\WBEM\CIMOM: AutoRecover Mofs).
   • EVT: 5616 (complete recovery), eventually, there are lots of EVT:63 for mof warning about Localsystem registration of providers.

Note: Under almost no circumstance should you use the script that rebuilds the WMI repository from the MOF files

The script is inherently flawed, for 2 reasons:

1. If you navigate to the %systemroot%\system32\wbem folder, and list the MOF files, you see find MOFs named (some provider name)_uninstall.mof. When you mofcomp those, they remove the classes in the MOF. The script mofcomps everything, so it can very easily install then immediately uninstall the classes, resulting in the class not being accessible.
2. Replaying mofs is often sequence dependent. Example: classes in mof1 can depend on or have associations with classes in mof2. If they aren't present, MOFCOMP will not insert the classes. It's extremely difficult to know what is / is not the right sequence, so any script that simply MOFCOMPs everything is not going to be fully successful.

In addition to causing damage to your system that's almost impossible to fix correctly, if you take that approach you will blow away all information that could be used to determine the root-cause.

If the repository check (winmgmt /verifyrepository) comes back as inconsistent, your first action is to run “winmmgmt /salvagerepository” followed by running “winmgmt /verifyrepository” again to see if it now comes back as consistent.

If it is still comes back inconsistent, then you need to run “winmgmt /resetrepository.” Before running this, please read the important note below for Server 2012.

Force-recovery process -- rebuild based on the registry list of AutoRecover Mofs

1. Check regkey value is empty or not @ HKLM\Software\Microsoft\WBEM\CIMOM: 'Autorecover Mofs' (** first line on some OSs is empty, review it in opening the regkey value)
2. If above regkey is empty, copy/paste the regkey value from another machine of equal System/OS to the suspect machine
3. Run the following command from command prompt with admin rights: “Winmgmt /resetrepositoy”
4. If you get the error noted below, stop all dependency services on the WMI service by running following command: 

net stop winmgmt /y

then run

Winmgmt /resetrepositoy

WMI repository reset failed
Error code:     0x8007041B
Facility:       Win32
Description:    A stop control has been sent to a service that other running services are dependent on

NOTE: Applies to Server 2012

We have encountered some issues when running the mofcomp command on Windows Server 2012 which has caused the Cluster namespace to be removed due to the cluswmiuninstall.mof contained in the c:\windows\system32\wbem folder. It has also caused unregistering class names for Cluster Aware Updating (CAU) because of its cauwmiv2.mof also in the wbem folder. Those could also affect other namespace that have an uninstall type .mof in the wbem folder beyond the two mentioned above.

Furthermore, the uninstall .mof files for servers running Microsoft Cluster are also part of the autorecover folder that is used when you run the winmgmt /resetrepository command which will end up having the same effect of first installing the Cluster namespace, then uninstalling it just as if you had run a script to rebuild the repository that contained the “for” command to recompile all of the MOFs in the WBEM folder.

Take the following actions to confirm if the uninstall problem for this scenario exists on your server. If it doesn’t, then you can run the winmgmt /reset repository, otherwise follow my directions below for manually accomplishing rebuild.

1. Open regedit, and navigate to hklm\software\microsoft\wbem\cimom, and open “Autorecover MOFS”
2. Copy the data from that string value, and paste it into notepad
3. Do a search for ClusWmiUninstall.mof. If the cluster provider uninstall has autorecover, it will be listed here
4. If found, then continue to manual rebuild below, if not found then go ahead and use the winmgmt /resetrepository command

How to manually rebuild repository on Server 2012 Cluster machine when cluster provider uninstall has an autorecover

First ensure you have run winmgmt /verifyrepository to ensure that it is “inconsistent” and that you have tried winmgmt /salvagerepository to see if it resolves your issue.

Change the startup type for the Window Management Instrumentation (WMI) Service to disabled.

1. Stop the WMI Service, you may need to stop services dependent on the WMI service first before it allow you to successfully stop WMI Service
2. Rename the repository folder:  C:\WINDOWS\system32\wbem\Repository to Repository.old
3. Open a CMD Prompt with elevated privileges
4. Cd windows\system32\wbem
5. Run following command to re-register all the dlls: for /f %s in ('dir /b /s *.dll') do regsvr32 /s %s
6. Set the WMI Service type back to Automatic and restart WMI Service
7. cd /d c:\  ((go to the root of the c drive, this is important))
8. Run following command specifically adopted for 2012 Clustered servers to recompile the MOFs:“dir /b *.mof *.mfl | findstr /v /i uninstall > moflist.txt & for /F %s in (moflist.txt) do mofcomp %s”
9. Restart WMI service

As a final note, if you run into a reoccurring corruption issue in your environment with WMI, try to exclude the WBEM folder and all subfolders under it from AV scanning. AV scanning is known to cause corruption and other issues in WMI.

Other repository recovery solutions:

Note: in following solutions (1 & 2), if the backup images (repository) are in large size (>100MB), restoring the repository will take some time.

1. Apply WMI AutoRestore story in the system to recover the repository image quickly and keep it in sync with previous state.
2. Enable VSS backup-related features for storing image snapshots
   • ex.  Volume Shadow Copy (VSS), or check any valid copies listed Local Disk(C:) Properties >> Shadow copies
3. Make sure registry key has following setting: HKLM\Software\Microsoft\WBEM\CIMOM: AutoRestoreEnabled=1
4. Frequently snapshot the restore-points of the system (if needed, refer to the following PowerShell scripts)

$filterStmt = [String]::Format("DriveLetter='{0}'",$env:SystemDrive)

# Get systemdrive Volume info

$vlm = gcim win32_Volume -Filter $filterStmt

# create a shadowcopy

$res = icim win32_ShadowCopy -MethodName Create -Arguments @{Volume=$Vlm.DeviceID}

if ($res.ReturnValue -eq 0)

{ gcim win32_ShadowCopy -Filter ("ID='"+$res.ShadowID+"'") } # **

else

{ $res | fc }

• AutoRestore only searches the top 3 queued snapshots for the latest valid backup, if no valid one is found, AutoRecovery will apply.
• To restore others in the queue of snapshots ( manually )
  1. In Server sku, looking at 'previous version' tab of the repository folder to find the expected backup path 
     • ex. "\\localhost\C$\@GMT-2014.03.13-01.02.49Windows\system32\wbem\repository"
     • to check whether the snapshot image is valid or not, from command prompt do:
       • winmgmt /verifyrepository"\\localhost\C$\@GMT-2014.03.13-01.02.49Windows\system32\wbem\repository"
  2. stop WMI service: Net stop winmgmt /y
  3. Replace all of the files in %windir%\system32\wbem\Repository folder with the files from the backup path found in step 1

Note The WMI Service has auto start setting, and if it comes back alive, you will not be able to replace the files.  The service needs to be in a stopped state (if WMI service is alive at the time, repeat step: 2~3)

ex. Directory of \\localhost\C$\@GMT-2014.03.13-01.02.49Windows\system32\wbem\repository

03/11/2014  11:53 AM    <DIR>          .
03/11/2014  11:53 AM    <DIR>          ..
03/12/2014  05:30 PM         4,759,552 INDEX.BTR
03/12/2014  05:30 PM            90,640 MAPPING1.MAP
03/12/2014  03:26 PM            90,640 MAPPING2.MAP
03/12/2014  05:24 PM            90,640 MAPPING3.MAP
03/12/2014  05:30 PM        27,541,504 OBJECTS.DATA

4. Run following wmic command to bring WMI service back to life: wmic os

You should set up a regular Scheduled Task to backup the latest repository:

• winmgmt /backup <backup image path>
• tracing EVT: 67,68

You could also schedule restores as necessary

• winmgmt /restore <above backup image path> 1
• tracing EVT: 65,66

If the issue is not a repository issue, and the objects are not retrievable:

• Re-install the product. This is the first place to start.
• If there is a specific provider that is not showing up, you can re-run mofcomp of a single provider. See Ask the Performance Team Blog article WMI: Missing or Failing WMI Providers or Invalid WMI Class (COMING SOON)

If the issue persists or keeps returning, then at this point you will now need to open a Support Incident Case with Microsoft for further assistance.

Reference this blog when you open the Support Incident Case with Microsoft as it will help the engineer understand what actions have been taken or followed and well help us track the effectiveness of the blog.

Next up: WMI: Missing or Failing WMI Providers or Invalid WMI Class

Summary: Figure out how many days are in a month by using Windows PowerShell.

 How can I use Windows PowerShell to find how many days are in a particular month?

 Use the DaysInMonth static method from the System.DateTime object.
            It expects the year and then the month as arguments. Here are a couple examples:

Days in October 2014:

[datetime]::DaysInMonth(14,10)

Days in February 2015:

[datetime]::DaysInMonth(2015,2)

Sysmon v1.0: We’re excited to announce Sysmon, a new Sysinternals utility that monitors and reports key system activity via the Windows event log, including detailed information about process creation, network connections and file creation timestamp changes. With Sysmon installed on your systems, you can collect and analyze these events to identify the presence of attackers, and correlate events across your network to track them as they traverse your network.

Autoruns v12.01: This update to Autoruns, a utility that comes in Windows application and command-line forms, has numerous bug fixes, adds a profile attribute/column to CSV and XML output, and interprets the CodeBase value for COM object registrations.

Coreinfo v3.3: Coreinfo is a command-line utility that reports comprehensive information about a system’s processors, including their cache sizes and topology, memory latency, and processor features, now reports virtual memory address width as well as support for many additional instructions, including PT, SHA, MPX, CFLUSHOPT, and AVX variants.

Procexp v16.03: This release of Process Explorer, a process viewing and control utility, fixes several bugs, including one where moving the mouse over the information graphs could cause it to crash and another that could cause a crash when checking Virus Total results.

Last week, MVP Yagmoth blogged about how Benoit's French blog post:

The "Microsoft TechNet Guru Awards" is now available in French !

And that leads us to another important bit of news, we now have a French blog with two posts on it so far:

1. Notre 1e article francophone sur les blogs des WikiNinjas !
2. Les "Microsoft TechNet Guru Awards" français attendent leurs contributeurs !

So thanks to Gokan and Benoit for getting it started! Over on French Council Bloggers (fr-FR), you can see that Yagmoth and Mr X will also be joining up as French bloggers! 

Over on the Wiki Ninjas Blogs Portal, you'll see that French is our fourth language to get a Wiki Ninjas blog!

1. English (this one) - http://blogs.technet.com/b/wikininjas/
2. Portuguese - http://blogs.technet.com/b/wikininjasbr/
3. Turkish - http://blogs.technet.com/b/wikininjastr/
4. French - http://blogs.technet.com/b/wikininjasfr/

We hope to have more, and to keep these communities alive and growing!

Thanks to our French community for your leadership!

   - Ninja Ed

Beschreibung

Der viertägige Workshop vermittelt den Teilnehmern die notwendigen Fertigkeiten, um das Active Directory (AD) nach spezifischen  Microsoft® Active Directory Domain Services (AD DS) wieder aufzubauen und ebendieses proaktiv zu vermeiden. Darüber hinaus werden die erforderlichen Inhalte zur Erstellung eines Disaster Recovery Plans besprochen. Jedes der in dem Workshop genutzten Ausfallszenarien behandelt folgende Themengebiete:

•           Domain Controller, Domain and Forest Recovery

•           AD DS Object Deletion

•           DNS Deletion or Corruption

•           Group Policy Objects

•           SYSVOL Content and Replication

Anhand von Praxislösungen werden die gelernten Inhalte vertieft. Die Labs basieren auf Windows Server 2008.

Agenda

Module 1: Introduction to Active Directory Disasters
Module 2: Disaster Recovery Key Concepts
Module 3: Loss of a Forest or Domain
Module 4: Object Deletion
Module 5: Name Resolution Disasters
Module 6: Group Policy (GPO) Disasters.
Module 7: SYSVOL Replication (FRS and DFSR) Disasters.
Module 8: Go Dos and Environment Improvements.

Zielgruppe

IT-Systemadministratoren, IT-Techniker, IT-Berater, IT-Infrastrukturarchitekten, Projektmanager.

 
Level

Level  300

(Level Skala: 100= Strategisch/ 200= technischer Überblick/ 300=tiefe Fachkenntnisse/  400= technisches Expertenwissen)

Sprache

Dieser Workshop wird in deutscher Sprache gehalten. Es werden hauptsächlich Englisch sprachige Kursunterlagen verwendet.

Anmeldung

Unter folgendem Link finden Sie weitere Informationen zur Veranstaltungsreihe und können eine verbindliche Anmeldung vornehmen.  

http://blogs.technet.com/b/microsoft_services_deutschland/p/events.aspx