WMI has issues outside of safe mode

Okay, they worked without the /i switch, I couldn't copy over them, it said they were in use.

 

I'm not crossing my fingers, but reboot and see if there's any change.

 

Just got back from reboot, no change. Want a new log or anything?

 

Yes, send a new Diag tool log please.

 

Log looks pretty much the same too.

WARNING: WMI DCOM components registration is missing for the following EXE/DLLs: .................................... 6 WARNING(S)!
12423 00:44:49 (0) ** - C:\WINDOWS\SYSTEM32\WBEM\FASTPROX.DLL (\CLSID\{7A0227F6-7108-11D1-AD90-00C04FD8FDFF}\InProcServer32)
12424 00:44:49 (0) ** - C:\WINDOWS\SYSTEM32\WBEM\FASTPROX.DLL (\CLSID\{D71EE747-F455-4804-9DF6-2ED81025F2C1}\InProcServer32)
12425 00:44:49 (0) ** - C:\WINDOWS\SYSTEM32\WBEM\FASTPROX.DLL (\CLSID\{ED51D12E-511F-4999-8DCD-C2BAC91BE86E}\InProcServer32)
12426 00:44:49 (0) ** - C:\WINDOWS\SYSTEM32\WBEM\WBEMPROX.DLL (\CLSID\{4C6055D8-84B9-4111-A7D3-6623894EEDB3}\InProcServer32)
12427 00:44:49 (0) ** - C:\WINDOWS\SYSTEM32\WBEM\WBEMPROX.DLL (\CLSID\{A1044801-8F7E-11D1-9E7C-00C04FC324A8}\InProcServer32)
12428 00:44:49 (0) ** - C:\WINDOWS\SYSTEM32\WBEM\WBEMPROX.DLL (\CLSID\{F7CE2E13-8C90-11D1-9E7B-00C04FC324A8}\InProcServer32)
12429 00:44:49 (0) ** => WMI System components are not properly registered as COM objects, which could make WMI to
12430 00:44:49 (0) ** fail depending on the operation requested.
12431 00:44:49 (0) ** => For a .DLL, you can correct the DCOM configuration by executing the 'REGSVR32.EXE <Filename.DLL>' command.

Please try to replace those two dlls in safe mode, then run that last set of commands again when back in normal mode.

 

Hi

I was hoping for better news?

I have been on the road this week.

I was hoping to have time to check in earlier but it has been 14 -16 hrs a day and I still may not get home till Saturday.

My mind is to strung out on my work to think of anything now. Perhaps Sunday. But hope it is fixed by then.

Spidy you have the best helping you (Dave).

Mike

 

Thanks for the vote of confidence Mike.

I have 2 XP Professional SP2 machines and 1 XP Home SP2 machine that I've been doing some testing and researching with, and the results are a bit puzzling. 1 of the Pro machines has the above CLSID registry entries, the other 2 machines do not. I unregistered then re-registered fastproxy.dll and wbemproxy.dll on all 3 machines, and the above CLSIDs were not included in the changes to any of the systems. Leaves me stumped as to why the Diag tool suggests registering those dlls to fix the problem. I have yet to figure out where those registry entries come from. If from registering a dll, we may only need to figure out which dll(s) to register. I'll continue working on that and advise if I find something.

Spider, please click Start>Run and type eventvwr.msc then hit enter.
Click the System entry in the left pane to select it.
Click Action on the menu, then select Save Log File As
Name it system, and leave the Save as type: Event Log (*.evt)
Save the file somewhere handy, then email it to me please.

If you've received my email and followed the instructions, open a command window and type wmic then hit enter. It should notify you it's installing, then go to a new command prompt, which appears as;

wmic:root\cli>

Close the command window for now.

Click Start>Run and type DCOMCNFG.EXE then hit Enter
Expand Component Services>Computers>My Computer>DCOM Config
Right click and select Properties on Microsoft WBEM UnSecured Apartment
Select the Security tab, then select Customize in the Launch and Activation Permissions section. Click Edit.
On the Security tab of Launch Permissions, you should have the following groups with the following permissions set to Allow.

Administrators

• Local Launch
• Remote Launch
• Local Activation
• Remote Activation

Interactive

• Local Launch
• Local Activation

System

• Local Launch
• Local Activation

Customized Access Permissions should be Allow as follows.

Self

• Local Access
• Remote Access

System

• Local Access

Customized Configuration Permissions should be Allow as follows.

Administrators

• Full Control
• Read
• Special Permissions

Creator Owner

• Special Permissions

your username

• Full Control
• Read

System

• Full Control
• Read
• Special Permissions

Users

• Read
• Special Permissions

You can do the following WMI control panel steps in safe mode, but return to normal to complete the rest. We did this once, but I would like to redo it to make sure it's still correct.

Click Start>Run and type wmimgmt.msc then hit Enter to open the WMI Control Panel
Click Action>Properties
Select the Security tab, Security button and select each group listed, then view the permissions for each in the lower pane.
Administrators should have all boxes checked in the Allow column (except for Special Permissions), the others should have Execute Methods, Provider Write and Enable Account checked in the Allow column. None should have anything checked in the Deny column.

You should also click the Advanced button and verify that each of the 4 groups show Special in the Permissions column, and they Apply To This namespace and subnamespaces.
Exit the Properties dialog and click File>Save << important step!
Close the WMI Control panel


Open a command window and paste the following command, then hit enter.

WMIC.EXE /NODE: "JORDAN" /AUTHLEVELktprivacy /NAMESPACE:\ \ ROOT \ SERVICEMODEL Class __SystemSecurity

Let me know what this command produces. I ran it only on the test machines that do not contain the CLSIDs in question above (the one that contains them is my work machine so didn't chance it) and got a message about the alias not being found.

Restart and see if there's any difference.

No difference? Click Start>Run and type wbemtest then hit enter.
Click Connect
Make sure root\cimv2 is shown in the first blank and click Connect again
Under Method Invocation Options select Asynchronous
Click Notification Query
Type or paste the following command and click Apply

Select * From MSFT_WmiSelfEvent

Post all resulting information here for the following events.

Msft_WmiProvider_ComServerLoadOperationEvent
Msft_WmiProvider_InitializationOperationEvent
Msft_WmiProvider_LoadOperationEvent


You might want to take screen shots, as I see no way to save a log.

 

I've sent you a zipped registry file that contains the following information (I didn't want to risk copying it from here ..... the forum software can add spaces where they shouldn't be)

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\TRANSPORTS]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\TRANSPORTS\Address Resolution Modules]
 "Stack Order "=hex(7):7b,00,41,00,31,00,30,00,34,00,34,00,38,00,30,00,31,00,2d,\
  00,38,00,46,00,37,00,45,00,2d,00,31,00,31,00,44,00,31,00,2d,00,39,00,45,00,\
  37,00,43,00,2d,00,30,00,30,00,43,00,30,00,34,00,46,00,43,00,33,00,32,00,34,\
  00,41,00,38,00,7d,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\TRANSPORTS\Address Resolution Modules\{A1044801-8F7E-11D1-9E7C-00C04FC324A8}]
 "Name "= "WBEM Local Address Resolution Module "
 "Supported Address Types "=hex(7):7b,00,41,00,31,00,30,00,34,00,34,00,38,00,30,\
  00,33,00,2d,00,38,00,46,00,37,00,45,00,2d,00,31,00,31,00,44,00,31,00,2d,00
 "Display Name "= "{A1044802-8F7E-11D1-9E7C-00C04FC324A8} "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\TRANSPORTS\AddressTypes]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\TRANSPORTS\AddressTypes\{A1044803-8F7E-11D1-9E7C-00C04FC324A8}]
 "Description "= "Local Machine "
 "Display Name "= "{A1044804-8F7E-11D1-9E7C-00C04FC324A8} "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\TRANSPORTS\Localizations]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\TRANSPORTS\Localizations\409]
 "{A2F7D6C1-8DCD-11D1-9E7C-00C04FC324A8} "= "WBEM DCOM Transport V1 "
 "{A1044802-8F7E-11D1-9E7C-00C04FC324A8} "= "WBEM Local Address Resolution Module "
 "{A1044804-8F7E-11D1-9E7C-00C04FC324A8} "= "Local Machine "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\TRANSPORTS\Network Transport Modules]
 "Stack Order "=hex(7):7b,00,46,00,37,00,43,00,45,00,32,00,45,00,31,00,33,00,2d,\
  00,38,00,43,00,39,00,30,00,2d,00,31,00,31,00,44,00,31,00,2d,00,39,00,45,00,\
  37,00,42,00,2d,00,30,00,30,00,43,00,30,00,34,00,46,00,43,00,33,00,32,00,34,\
  00,41,00,38,00,7d,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\TRANSPORTS\Network Transport Modules\{F7CE2E13-8C90-11D1-9E7B-00C04FC324A8}]
 "Name "= "WBEM DCOM Transport V1 "
 "Independent "=dword:00000001
 "Display Name "= "{A2F7D6C1-8DCD-11D1-9E7C-00C04FC324A8} "

Extract the transports.reg registry file from the zip.

Stop the WMI service by clicking Start>Run and typing the following then hitting Enter.

sc stop winmgmnt

Double click the transports.reg file and allow it to merge with the registry.
Navigate to the C:\Windows\system32\wbem folder and rename the Repository folder to oldRepository.
Start the WMI service by clicking Start>Run and typing the following then hitting Enter.

sc start winmgmnt

Reboot and see if there's any change. Verify that a new Repository folder was created.

 

sorry I was busy studying exams and finishing up programs as well as starting an ACM chapter for my college this week and catching up around the house today, I'll catch up on as much of this as possible tomorrow.

 

No need to apologize ........ there's no rush. This may take a while anyway, and I will enjoy the ride for as long as it takes.