NT Event Log Consumer: could not retrieve sid, 0x80041002

[Jumbba]

please help with this error message found in wbemess.log.

TIA

[Ivan Brugiolo [MS]]

Do you have a permanent subscription for the EventLog consumer ?
if yes, can you post the __EventFilter, __FilterToConsumerBinding and the
instance of the consumer ?
Which OS are you seeing this in ?

--
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

"Jumbba" <jum...@easynet.fr> wrote in message
news:u5MA2qcWCHA.2496@tkmsftngp09...

[to...@toto.com]

Thanks for your answer Ivan.
I must admit I'm completely new to wmi, my initial problem is that I cannot
setup my XPPro box as a VPN server (getting message 'invalid local user
database handle'). After digging hard by means of sysinternals tools I found
out that this is caused by wmi with the message described in my previous
post.
Can you please detail me further how to check my subscription and so on ?
I installed SDK and wmi browser but I still don't know much about wmi (even
if I made some progress ;o)), I really need to have my problem fixed.

Appreciate your help, thank you for giving me more information

"Ivan Brugiolo [MS]" <ivan...@online.microsoft.com> wrote in message
news:Of7qU7eWCHA.436@tkmsftngp10...

[Ivan Brugiolo [MS]]

On top of my knowledge,
there is no relationship at all between WinMgmt and a 'VPN server'.
The only networking component that relay upon WinMgmt is "HomeNet",
that you can access normally through the Advanced TAB
of the properties of your network connection.
If you could clear to me how you would set-up a 'VPN Server',
I can see if and how it is related to WinMgmt.

If the error reported in the title is the only interesting log
you can find in the files under %windir%\system32\wbem\Logs,
then I can assume the WinMgmt is working,
and you have a specific problem with a specific permanent subscription.

Just in case,
you can bring-up %windir%\system32\wbem\wbemtest.exe,
connect to the "root\cimv2" namespace, and enumerate the instances of
Win32_Process,
just to see if something very basic is working.

then you can connect to the root\subscription namespace, and enumerate the
instances mentioned below.

--
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

<to...@toto.com> wrote in message news:ej4t87iWCHA.2820@tkmsftngp10...

[to...@toto.com]

Thanks again Ivan,

For the setting of the vpn server I use the new network connection wizard
and select 'create and advanced connection', then 'set up a vpn connection'
and 'allow incoming connection' then I have to chose among a list of user
accounts to select who to authorize : that is exactly where it fails. I
suppose wmi is used to retrieve this users accounts list (as wmi logs report
activity at this point).

with wbemtest I get those results:

Instances of __EventFilter :
__EventFilter.Name="SCM Event Log Filter"
__EventFilter.Name="Microsoft WMI Updating Consumer Scenario Control"

Instances of __FilterToConsumerBinding :
__FilterToConsumerBinding.Consumer=\\\. \\root\\subscription:MSFT
UCSScenarioControl... etc.
__FilterToConsumerBinding.Consumer="NTEventLogEventConsumer...etc.

That's all I was able to check by using wbemtest, maybe there are others
things to check ? (if so please explain me how).

Regards

"Ivan Brugiolo [MS]" <ivan...@online.microsoft.com> wrote in message

news:ORgBcZjWCHA.1852@tkmsftngp10...

[Ivan Brugiolo [MS]]

For your VPN problems you can take out of the Loop both WinMgmt
per se and the error you are seeing from the permanent subscription.

I looks the WinMgmt activity in the debugger, and only HomeNet is uing it,
and there is no query fo getting the list of users to populate the dilaog
box.

Instead looks like the RemoteAccess service uses a lot of Database "stuff"
to even populate the list of users.

This would make more sense with the error you are seeing.

Unfortunately this is not my area od expertise, so I cannot advice you
futher.

These are the DLL loaded in the svchost.exe process while running the
wizard.

ModLoad: 66370000 6639f000 D:\WINDOWS\System32\iprtrmgr.dll
ModLoad: 5d340000 5d35c000 D:\WINDOWS\System32\rtm.dll
ModLoad: 663b0000 663b5000 D:\WINDOWS\System32\iprtprio.dll
ModLoad: 61550000 61564000 D:\WINDOWS\System32\mprddm.dll
ModLoad: 67310000 67335000 D:\WINDOWS\System32\iasrecst.dll
ModLoad: 1b560000 1b5b4000 D:\WINDOWS\System32\msjetoledb40.dll <<<<<<<<<<
OLEDB provider for Jet
ModLoad: 1b000000 1b16f000 D:\WINDOWS\System32\msjet40.dll
ModLoad: 1b5c0000 1b655000 D:\WINDOWS\System32\mswstr10.dll
ModLoad: 1b2c0000 1b2cd000 D:\WINDOWS\System32\msjter40.dll
ModLoad: 1b2d0000 1b2f6000 D:\WINDOWS\System32\MSJINT40.DLL
ModLoad: 1b7f0000 1b82a000 D:\WINDOWS\System32\msjtes40.dll
ModLoad: 0f9c0000 0fa22000 D:\WINDOWS\System32\expsrv.dll

--
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

<to...@toto.com> wrote in message news:eKZGQjkWCHA.4008@tkmsftngp11...

[Manfred Braun]

Hi All,

just a simple hint:

m1 >D:\Develop\Dev\Experimente\wbem\Experimente\WBEMError.vbs 0x80041002
[ERROR]Fehler =wbemErrNotFound
[ERROR]Nr.(dez)=-2147217406
[ERROR]Nr.(hex)=80041002
[ERROR]Source =WMI
[ERROR]Descr. =The object could not be found.

Because the query is not listed in this thread, this is all I can input.

Best regards,
Manfred Braun

(Private)
Lange Roetterstrasse 7
D68167 Mannheim
Germany

mailto:_manfred...@berlin.de
(Remove the anti-spam-underscore to mail me!)

"Jumbba" <jum...@easynet.fr> wrote in message
news:u5MA2qcWCHA.2496@tkmsftngp09...