3

I need to troubleshoot some WMI crashes we are suffering from. Unfortunately the event log doesn't show any details as the descriptions are missing. This is what the log says:

The description for Event ID 5612 from source **Microsoft-Windows-WMI** cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

HandleCount
4116
4096
10508

I have already worked through Microsoft's knowledgebase article on how to troubleshoot the "event message not found" problem (https://support.microsoft.com/en-us/kb/166902) without any luck.

The registry key EventMessageFile under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\**WMI.NET Provider Extension** points to C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EventLogMessages.dll which is existent.

Comparing the registry keys to a system where this specific event id gets shown correctly doesn't reveal any differences. Also the EventLogMessages.dll has the same version and checksum.

Am I looking at the right registry key?

The path HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\WinMgmt only contains a key called ProviderGuid. But that seems to be fine, as the descriptions are getting displayed on a system having the same (and only this) key.

[EDIT]

I indeed was looking at the wrong registry keys. The right one to look for is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Microsoft-Windows-WMI which was completely missing. Also a key called Enabled and the ChannelReferences subkeys where missing within the provider configuration which can be found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}.

Adding those keys made the WMI events to get displayed correctly. However it did only last till a reboot of the system. Now the registry keys are there as they should be, but still no proper display of the events... any ideas?

This are my exact registry settings that I have exported from a working system:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Microsoft-Windows-WMI]
"ProviderGuid"="{1edeee53-0afe-4609-b846-d8c0b2075b1f}"
"EventMessageFile"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,\
  00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\
  5c,00,77,00,62,00,65,00,6d,00,5c,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,\
  00,52,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}]
@="Microsoft-Windows-WMI"
"ResourceFileName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,\
  00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\
  5c,00,77,00,62,00,65,00,6d,00,5c,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,\
  00,52,00,2e,00,64,00,6c,00,6c,00,00,00
"MessageFileName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
  6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
  00,77,00,62,00,65,00,6d,00,5c,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,00,\
  52,00,2e,00,64,00,6c,00,6c,00,00,00
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}\ChannelReferences]
"Count"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}\ChannelReferences\0]
@="Application"
"Id"=dword:00000009
"Flags"=dword:00000001
1
  • You seem to have gone through the basic troubleshooting steps, Maybe this is a 64-bit vs 32-bit issue. This article may also help: eventsentry.com/blog/2008/04/…
    – Lucky Luke
    Commented Jun 30, 2015 at 1:32

3 Answers 3

0

Missing event ids can easily be added using the EventCreate command line command. More information can be found at https://technet.microsoft.com/en-us/library/bb490899.aspx.

1
  • 2
    Please expand you answer with the information from the link. Commented Aug 18, 2018 at 16:08
0

Restart Event Viewer. Had this same problem, googled it, and found the answer.

"Event Viewer was not restarted since you added the EventMessageFile entry in the registry. Event Viewer caches the DLLs it loads for event sources. If you have changed the registry to give a proper directory or source name after the event viewer has been started, you need to restart Event Viewer." -ref: See point #6 https://support.microsoft.com/en-us/help/166902/howto-troubleshooting-the-event-message-not-found-message

0

Change format to Events from RenderedText

wecutil es

wecutil ss "subscription" /cf:Events

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .