WinMgmt error - Key 009 problem 1

[Scrub]

Hello,

My Win2k machine crashes without warning (usually when I'm using IE). In the
application event log there are error messages that look like this:

Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 46
Date: 4/12/2001
Time: 12:42:24 PM
User: N/A
Computer: CR680987-A
Description:
WMI ADAP was unable to retrieve data from the PerfLib localization subkey: 0009,
error code: 0x2

Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 41
Date: 4/9/2001
Time: 10:50:28 PM
User: N/A
Computer: CR680987-A

Description:
WMI ADAP was unable to create object index 2106 for Performance Library
ContentFilter because no value was found in the 009 subkey

Description:
WMI ADAP was unable to create object index 2082 for Performance Library
ContentIndex because no value was found in the 009 subkey

Description:
WMI ADAP was unable to create object index 2136 for Performance Library IAS
because no value was found in the 009 subkey

Description:
WMI ADAP was unable to create object index 2114 for Performance Library
ISAPISearch because no value was found in the 009 subkey

Description:
WMI ADAP was unable to create object index 2022 for Performance Library MSDTC
because no value was found in the 009 subkey

Description:
WMI ADAP was unable to create object index 1848 for Performance Library RSVP
because no value was found in the 009 subkey

I have tried to edit the 009 key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Perflib\009] but access is denied.

I have also run:
winmgmt /clearadap and winmgmt /resyncperf "winmgmt service pid"

If anyone can offer some help I'd really appreciate it!

Scrub

 

[butchrecon]

CAUSE
These events can be logged either because of a problem in the counter, or a false positive return value in the Windows Management Instrumentation (WMI) Performance Library Dredger. In the latter instance, in certain situations, the dredger incorrectly determines that a library is invalid even though the counter works correctly.



WORKAROUND
WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT or Windows 2000, you should also update your Emergency Repair Disk (ERD).

First, try once more to dredge the system's performance libraries using the following commands:

WINMGMT /CLEARADAP
This command clears all Web-Based Enterprise Management (WBEM) related values from the service's performance registry key.
WINMGMT /RESYNCPERF "winmgmt service PID"
This command registers the the system's performance libraries with the WMI.

The WMI service PID information can be found in the Process tab of Windows Task Manager.

The performance registry keys of the involved services are:

WbemAdapFileSize
WbemAdapFileTime
WbemAdapStatus

Note: For more information about the command line options available with WMI, type winmgmt/? at a command prompt.

Another possible reason for the above events may be that the counters are slow to respond due to other activities during startup. It is possible to tune this timeout by adding the value Collect Timeout REG_DWORD 10000 to the appropriate registry location:
HKey_Local_Machine\System\CurrentControlSet\Services\[counterfile]\Performance
If events continue to be logged after making the above changes, change the WbemAdapStatus value manually to REG_DWORD 0 under the service's performance registry key and increase the ADAPPerflbTimeout value to REG_DWORD 180 under the following registry key:
HKLM\Software\Microsoft\Wbem\CIMOM
Note: All registry changes have to be entered as decimal values.
In addition, it is possible to disable performance counters for a specific service with the Exctrlst.exe utility from the Windows 2000 Resource Kit.
This utility disables the specific counter by adding a registry key similar to the example below. These registry entries can be added under the specific counter entry manually if Exctrlst.exe is not available or desirable.
HKLM\System\CurrentControlSet\Services\Spooler\Performance

Value Name: Disable Performance
Value Type: REG_DWORD Value Data: 1



MORE INFORMATION
The AutoDiscovery/AutoPurge (ADAP) process is responsible for collecting and maintaining performance counter objects in WMI that are registered on the computer.

The ADAP process starts when the WinMgmt service is started or when performance libraries, which contain the performance counters, are installed or uninstalled using the lodctr/unlodctr utilities.

Although the above entries are logged, the counters are still available.