strange event viewer error

[gerryf]

OK, here's the error

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage
> 99" could not be reactivated in namespace "//./root/CIMV2" because of
error 0x80041003. Events cannot be delivered through this filter until the
problem is corrected.

Basically, how do I correct the problem?

This is occurring on two identical machines, both of which were updated from
Windows XP Professional. Not a great deal of interesting stuff on these
machines--simple workstations. I suspect this may have resulted from the
upgrade, rather than the clean install.

The PCs seem to work fine except for these errors.

[Mark L. Ferguson]

Delete the files in the REPOSITORY folders (..\System32\wbem) (you will have
to turn off the winmanagement service to do that) 'net stop winmgmt'

[Miles Li [MSFT]]

The '0x80041003' error code you provided indicates that
WBEM_E_ACCESS_DENIED.

This typically results when the process trying to access the namespace does
not have the required WMI privileges. The account attempting remote access
should be an administrator on the target computer; in addition, the account
might need to have a specific privilege enabled. To troubleshoot this
error, check the namespace security on the remote namespace to see the
privileges enabled for the account.


For this issue, I'd like to know which user account is used when processing
the query and whether there is proper permission on the '/root/CIMV2'.

To verify the permission of '/root/CIMV2':

Run--->'wmimgmt.msc'--->WMI control
(local)--->Properties--->Security--->/root/CIMV2


Please note: In Windows XP, 'Everyone' group have Execute Methods
permission by default. In Windows Vista, it is replaced with 'Authenticated
Users' group.

[gerryf]

Yes, from what I was able to glean from various sources, that is what I
thought as well. However, it didn't seem to make sense to me in the context
of the situation. All of the attempts to investigate this issue have led me
to Windows server running MYSQL server, but none (yet) seem to be Vista
related.

This is a newly installed Vista Ultimate machine (upgrade, actually), in a
network. There is no remote access -- the two machines are presently
standalone machines. These machines were fully updated XP Pro machines that
were updated using the Technet supplied Vista with integrated sp1 iso. The
error appears while checking the event log from an administrator account.

It appears the security for Root\CIMv2 is the default

Authenticated users has EXECUTE METHODS, PROVIDER WRITE, ENABLE ACCOUNT are
set to allow
Local Service EXECUTE METHODS, PROVIDER WRITE, ENABLE ACCOUNT are set to
allow
Network Service EXECUTE METHODS, PROVIDER WRITE, ENABLE ACCOUNT are set to
allow
Administrators EXECUTE METHODS, FULL WRITE, PARTIAL WRITER,, PROVIDER
WRITE, ENABLE ACCOUNT are set to allow

How can I determine what account is used when processing the query--indeed,
what query?

[gerryf]

I had actually toyed with that idea given it seems to be at least marginally
related to wbem according to the error message, but the error seems to occur
mostly on servers running mysql so I was unsure if I should try that.

That seems to have done the trick--after deleting the repository files and
rebooting 5 times the error has not recurred

[Miles Li [MSFT]]

Yes, 'Root\CIMv2' has the proper default permission and it should works.

For Mark's suggest has affects now, I'd like to recommend you to have a
further test to see whether it is stable or not.

Again, thanks for using newsgroups.

[tuxman]

I just had this problem and cleared the wbem repository as proposed here... now, on startup, error 0x8004401e pops up... any ideas about that?