Thanks,
Dave
-------------
'Get % Processor Time
'Connect to Local Machine
' These get "Invalid Class" on the .get method
'set oSvc = GetObject("winmgmts:\root\cimv2")
'set oSvc = GetObject("winmgmts:\\.\root\cimv2")
' This one works
set oSvc = GetObject("winmgmts:\\canyonnet\root\cimv2")
sObjectPath = "Win32_Service.Name='TlntSvr'"
set instance = oSvc.get( sObjectPath )
wscript.echo "Telnet State = " , instance.State
set oSvc = nothing
BTW, Is this the same XP machine where the Formatted classes are not working
?
Are you sure that WinMmgt is in a healthy state on that machine ?
Can you enumerate the instances of Win32_Process and/or Win32_Service
locally in the XP box ?
--
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Dave Kolb" <Dave.Kol...@remove.sas.com> wrote in message
news:#i95Qy0uCHA.2304@TK2MSFTNGP10...
This was working under XP earlier just fine as I used to test some of my WQL
events by starting and stopping the Telnet server.
And yes this is the same machine that fails the formatted classes so I guess
something in WMI is messed up. What could have happened and what might I do
to fix this? I've not messed with the repository other than adding some
permanent event consumers and filters using some .NET code provided by
Philip that worked fine.
Thanks,
Dave
"Ivan Brugiolo [MSFT]" <ivan...@online.microsoft.com> wrote in message
news:OVROH80uCHA.2000@TK2MSFTNGP11...
"Ivan Brugiolo [MSFT]" <ivan...@online.microsoft.com> wrote in message
news:OyqB2f#uCHA.2288@TK2MSFTNGP09...
> I have detailed several time in the
> microsoft.public.windowsxp.wmi forum a procedure to "restore" WinMmgt from
> misconfiguration.
>
> You can save your repository (the content of
> %windir%\system32\wbem\repository) before going through the following
steps.
>
>
> /////////////////////////////////////////////
>
> Try to remove, if they are there
>
> HKLM\Software\Microsoft\OLE
> "EnableRemoteConnect"="Y"
> "LegacyAuthenticationLevel"=dword:00000001
> "LegacyImpersonationLevel"=dword:00000001
>
> Some legacy application from the Win9x era are known to create
> those key that impair many DCOM functionality on the machine.
>
> check the following registry key
> HKLM\System\Software\Microsoft\WBEM\CIMOM\AutoRecover MOFs
> it is supposed to have a list of *.MOF and *.MFL files, and it MUST begin
> with cimwin32.mof
> There are ISP connection kits and .NET Framework setups known to corrupt
> this key.
> Please delete it content if it appears to have few files or if it appears
> corrupt.
>
> check if in %windir%\system32\wbem there are about 40 MOF files.
> There are certain applications known to delete them.
> If you don't have them, please recover them from the CD of WinXP.
> The complete list is found in %windir%\IFM\wbemoc.inf
>
>
> Please check the following:
> -1- that you system path has still %windir%\system32\wbem in it.
> -2- that there are no wmiutils.dll and wbemcomn.dll in the system path
that
> comes before the one in system32\wbem.
>
> c:\>for %i in ("wbemcomn.dll") do (echo %~$PATH:i)
> c:\>for %i in ("wmiutils.dll") do (echo %~$PATH:i)
>
> check if the wbemutils.dll registered as a COM component comes from the OS
> or from Visual Studio and/or other development tools.
> Make sure the OS Supplied one is used.
>
> enable versbose logging
> HKLM\Software\Microsoft\WBEM\CIMOM:Logging(REG_SZ) = "2"
> HKLM\Software\Microsoft\WBEM\CIMOM:Logging File Max Size (REG_SZ) =
> "4000000"
>
> find the PID of the svchost.exe process running WinMgmt
> HKLM\Software\Microsoft\WBEM\CIMOM:ProcessID (REG_DWORD) = XXX
>
> crosss check the pid
> c:\>tlist -s | findstr /i winmgmt
> it must be the same as above, if not, trust tlist.exe more than the
registry
> for the steps below.
>
> you can get "tlist .exe" and "kill.exe" (needed later)
> from http://www.microsoft.com/ddk/debugging/installx86.asp
>
> c:\>sc config winmgmt start= disabled
> c:\>kill -f XXX <<<<<<<<<<<<<<<<<<<<<<<<<<<<<< pid obtained before
> c:\>cd /D %windir%\system32\wbem
> c:\WIN\system32\wbem>rmdir /s /q repository
> c:\WIN\system32\wbem>rmdir /s /q Logs
> c:\WIN\system32\wbem>mkdir Logs
> c:\WIN\system32\wbem>for /R %i in (*.dll) do (regsvr32 /s %i)
> c:\WIN\system32\wbem>regsvr32 /s fastprox.dll
> c:\WIN\system32\wbem>for /R %i in (*.exe) do (%i -regserver) <<<<<<<<<<<<<
> this will open wbemtest and/or wmic.exe. Just close it
> c:\WIN\system32\wbem>sc config winmgmt start= auto
> c:\WIN\system32\wbem>regsvr32 wbemupgd.dll <<<<<<<<<<<<<< this can take
30
> seconds to 2 minutes
> c:\WIN\system32\wbem>net start server && net start workstation && net
start
> AudioSrv && net start termservice
>
> after this, please start %windir%\system32\wbem\wbemtest.exe,
> and connect to the root\cimv2 namespace.
>
> If something goes wrong, please read the logs under
> %windir%\system32\wbem\Logs, just to see if there is something obviousely
> wrong there.
>
> After all of this is done, there might be misconfiguration problems
> that have changed access permission to registry key and files for the
> NetworkService account.
> The NetworkService account is the one running one of the Provider Host.
> To test if this can be the problem, you ca add NetworkService to the
> administrators group
> c:\>net localgroup administrators NetworkService /ADD
> Please remember to remove it as soon as the misconfiguration problem have
> been identified
>
>
> --
> This posting is provided "As Is" with no warranties, and confers no
rights.
> Use of included script samples are subject to the terms specified at
> http://www.microsoft.com/info/cpyright.htm
>
>
> "Dave Kolb" <Dave.Kol...@remove.sas.com> wrote in message
> news:OII3IT#uCHA.2396@TK2MSFTNGP10...
/////////////////////////////////////////////
--
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Dave Kolb" <Dave.Kol...@remove.sas.com> wrote in message
news:OII3IT#uCHA.2396@TK2MSFTNGP10...
-2- What has to do the user account that is logged on on the machine
with the user account that is running WmiPrvSe.exe ? They are
different things.
Looks like you've lost the class definitions carried on by cimwin32.mof.
I'm not positive if it makes sense to indentify the root cause of the
problem through newsgruoup posting.
the "revovery" procedure has been amended in the past 6 months
taking in account many different misconfigurations problem, and it is
regarded as being complete.
If it does not work, then we can start working on it.
Please run the full recovery steps and let's see if they do any good.
You can anways save your repository if you feel it has important
information.
--
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Dave Kolb" <Dave.Kol...@remove.sas.com> wrote in message
news:#1vdYO$uCHA.2568@TK2MSFTNGP12...
> Everything looked find though the only mention of wbemutils.dll in the
> registry was in conjunction with
> the following key:
>
>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserD
>
ata\S-1-5-21-98583002-1947013824-37170099-1492\Components\3CC81BB0E3EAB7D91A
> BDAD7B2B1570BB which had a name with a long hex value with the a data
value
> of C:\Program Files\WMI Tools\WBEMUtils.dll.
>
> If you meant wmiutils.dll however it IS registered in the CLSID section as
> an InProcServer32 to the system32/wbem directory.
>
> I turned on verbose debugging via the snapin and bumped up the log size by
> hand (the entry was "Log File Max Size" though) and then rebooted, deleted
> the logs and then used WMI CIM Studio to try to get instances of
> win32_service objects and got the following wbemcore.log file with some
> 80041010 and 80041002 errors.
>
> I am admin on my own machine and am running the WMI stuff from my machine
so
> did not fool with the NetworkService account. I did check root permissions
> though and I have full permissions at root and below.
>
> Thanks,
> Dave
>
>
> (Tue Jan 14 12:32:29 2003.1672609) : CALL CWbemNamespace::ExecQuery
> BSTR QueryFormat = WQL
> BSTR Query = select * from Win32_Process
> IEnumWbemClassObject **pEnum = 0x5DFE44
> (Tue Jan 14 12:32:29 2003.1672609) : CALL CWbemNamespace::ExecQueryAsync
> BSTR QueryFormat = WQL
> BSTR Query = select * from Win32_Process
> IWbemObjectSink* pHandler = 0x0
> (Tue Jan 14 12:32:29 2003.1672625) : Query Engine request: querying dyn
> provider with <select * from Win32_Process>
> (Tue Jan 14 12:32:29 2003.1672625) : Query Engine actual: querying dyn
> provider with <select * from Win32_Process>
> (Tue Jan 14 12:32:29 2003.1672671) : Error 80041002 occured executing
queued
> request
> (Tue Jan 14 12:32:29 2003.1672671) : CAsyncReq_CancelProvAsyncCall call
> failed
> (Tue Jan 14 12:32:30 2003.1673656) : CALL CWbemNamespace::ExecQuery
> BSTR QueryFormat = WQL
> BSTR Query = select * from Win32_Process
> IEnumWbemClassObject **pEnum = 0x5DFE44
> (Tue Jan 14 12:32:30 2003.1673656) : CALL CWbemNamespace::ExecQueryAsync
> BSTR QueryFormat = WQL
> BSTR Query = select * from Win32_Process
> IWbemObjectSink* pHandler = 0x0
> (Tue Jan 14 12:32:30 2003.1673656) : Query Engine request: querying dyn
> provider with <select * from Win32_Process>
> (Tue Jan 14 12:32:30 2003.1673656) : Query Engine actual: querying dyn
> provider with <select * from Win32_Process>
> (Tue Jan 14 12:32:30 2003.1673703) : Error 80041002 occured executing
queued
> request
> (Tue Jan 14 12:32:30 2003.1673703) : CAsyncReq_CancelProvAsyncCall call
> failed
> (Tue Jan 14 12:32:32 2003.1675046) : CALL CWbemNamespace::GetObject
> BSTR ObjectPath = Win32_Service
> long lFlags = 0
> IWbemClassObject ** pObj = 0x15CF92C
> (Tue Jan 14 12:32:32 2003.1675046) : CALL CWbemNamespace::GetObject
> BSTR ObjectPath = Win32_Service
> long lFlags = 0
> IWbemClassObject ** pObj = 0x108F92C
> (Tue Jan 14 12:32:32 2003.1675046) : CALL
CWbemNamespace::CreateInstanceEnum
> long lFlags = 0x30
> BSTR Class = Win32_Service
> IEnumWbemClassObject **pEnum = 0x2284C80
> (Tue Jan 14 12:32:32 2003.1675062) : CALL
> CWbemNamespace::CreateInstanceEnumAsync
> BSTR Class = Win32_Service
> long lFlags = 0x0
> IWbemObjectSink pHandler = 0x0
> (Tue Jan 14 12:32:32 2003.1675078) : Query Engine request: querying dyn
> provider with <select * from Win32_Service>
> (Tue Jan 14 12:32:32 2003.1675093) : Query Engine actual: querying dyn
> provider with <select * from Win32_Service>
> (Tue Jan 14 12:32:32 2003.1675093) : Query Engine request: querying dyn
> provider with <select * from Win32_Service>
> (Tue Jan 14 12:32:32 2003.1675093) : Query Engine actual: querying dyn
> provider with <select * from Win32_TerminalService>
> (Tue Jan 14 12:32:32 2003.1675187) : Thread 0xc98 throttled in merger for
> 0xffffffff ms.
> Parent Objects: 43, Child Objects: 0, Num Throttled Threads: 1
> (Tue Jan 14 12:32:32 2003.1675218) : CALL CWbemNamespace::GetObject
> BSTR ObjectPath =
__Win32Provider.Name="Win32_WIN32_TERMINALSERVICE_Prov"
> long lFlags = 0
> IWbemClassObject ** pObj = 0x228B8D4
> (Tue Jan 14 12:32:32 2003.1675218) : CALL CWbemNamespace::GetObjectAsync
> BSTR ObjectPath =
__Win32Provider.Name="Win32_WIN32_TERMINALSERVICE_Prov"
> long lFlags = 0
> IWbemObjectSink* pHandler = 0x0
> (Tue Jan 14 12:32:32 2003.1675218) : CALL CWbemNamespace::ExecQuery
> BSTR QueryFormat = Wql
> BSTR Query = references of
> {__Win32Provider.Name="Win32_WIN32_TERMINALSERVICE_Prov"}
> IEnumWbemClassObject **pEnum = 0x1DBFBB4
> (Tue Jan 14 12:32:32 2003.1675218) : CALL CWbemNamespace::ExecQueryAsync
> BSTR QueryFormat = Wql
> BSTR Query = references of
> {__Win32Provider.Name="Win32_WIN32_TERMINALSERVICE_Prov"}
> IWbemObjectSink* pHandler = 0x0
> (Tue Jan 14 12:32:32 2003.1675218) : STARTING a main queue thread 3496 for
a
> total of 4
> (Tue Jan 14 12:32:32 2003.1675250) : CALL CWbemNamespace::GetObject
> BSTR ObjectPath =
__Win32Provider.Name="Win32_WIN32_TERMINALSERVICE_Prov"
> long lFlags = 0
> IWbemClassObject ** pObj = 0x148F92C
> (Tue Jan 14 12:32:32 2003.1675250) : STARTING a main queue thread 3492 for
a
> total of 3
> (Tue Jan 14 12:32:32 2003.1675281) : CALL CWbemNamespace::ExecQuery
> BSTR QueryFormat = Wql
> BSTR Query = references of
> {__Win32Provider.Name="Win32_WIN32_TERMINALSERVICE_Prov"}
> IEnumWbemClassObject **pEnum = 0x22A0E60
> (Tue Jan 14 12:32:32 2003.1675281) : CALL CWbemNamespace::ExecQueryAsync
> BSTR QueryFormat = Wql
> BSTR Query = references of
> {__Win32Provider.Name="Win32_WIN32_TERMINALSERVICE_Prov"}
> IWbemObjectSink* pHandler = 0x0
> (Tue Jan 14 12:32:32 2003.1675296) : CALL CWbemNamespace::GetObject
> BSTR ObjectPath =
__Win32Provider.Name="Win32_WIN32_TERMINALSERVICE_Prov"
> long lFlags = 0
> IWbemClassObject ** pObj = 0x128F92C
> (Tue Jan 14 12:32:32 2003.1675296) : CALL CWbemNamespace::ExecQuery
> BSTR QueryFormat = Wql
> BSTR Query = references of
> {__Win32Provider.Name="Win32_WIN32_TERMINALSERVICE_Prov"}
> IEnumWbemClassObject **pEnum = 0x22A0E60
> (Tue Jan 14 12:32:32 2003.1675296) : CALL CWbemNamespace::ExecQueryAsync
> BSTR QueryFormat = Wql
> BSTR Query = references of
> {__Win32Provider.Name="Win32_WIN32_TERMINALSERVICE_Prov"}
> IWbemObjectSink* pHandler = 0x0
> (Tue Jan 14 12:32:32 2003.1675437) : Thread 0xc98 woken up in merger.
> (Tue Jan 14 12:32:32 2003.1675437) : Error 80041010 occured executing
queued
> request
> (Tue Jan 14 12:32:32 2003.1675546) : Error 80041002 occured executing
queued
> request
> (Tue Jan 14 12:32:32 2003.1675546) : CAsyncReq_CancelProvAsyncCall call
> failed
> (Tue Jan 14 12:32:32 2003.1675578) : Error 80041002 occured executing
queued
> request
> (Tue Jan 14 12:32:32 2003.1675578) : CAsyncReq_CancelProvAsyncCall call
> failed
> (Tue Jan 14 12:32:34 2003.1676906) : CALL CWbemNamespace::GetObject
> BSTR ObjectPath = Win32_Service
> long lFlags = 0
> IWbemClassObject ** pObj = 0x128F92C
> (Tue Jan 14 12:32:34 2003.1677687) : CALL CWbemNamespace::ExecQuery
> BSTR QueryFormat = WQL
> BSTR Query = select * from Win32_Process
> IEnumWbemClassObject **pEnum = 0x5DFE44
> (Tue Jan 14 12:32:34 2003.1677687) : CALL CWbemNamespace::ExecQueryAsync
> BSTR QueryFormat = WQL
> BSTR Query = select * from Win32_Process
> IWbemObjectSink* pHandler = 0x0
> (Tue Jan 14 12:32:34 2003.1677687) : Query Engine request: querying dyn
> provider with <select * from Win32_Process>
> (Tue Jan 14 12:32:34 2003.1677687) : Query Engine actual: querying dyn
> provider with <select * from Win32_Process>
> (Tue Jan 14 12:32:34 2003.1677734) : Error 80041002 occured executing
queued
> request
> (Tue Jan 14 12:32:34 2003.1677734) : CAsyncReq_CancelProvAsyncCall call
> failed
> (Tue Jan 14 12:32:35 2003.1678718) : CALL CWbemNamespace::ExecQuery
> BSTR QueryFormat = WQL
> BSTR Query = select * from Win32_Process
> IEnumWbemClassObject **pEnum = 0x5DFE44
> (Tue Jan 14 12:32:35 2003.1678718) : CALL CWbemNamespace::ExecQueryAsync
> BSTR QueryFormat = WQL
> BSTR Query = select * from Win32_Process
> IWbemObjectSink* pHandler = 0x0
> (Tue Jan 14 12:32:35 2003.1678718) : Query Engine request: querying dyn
> provider with <select * from Win32_Process>
> (Tue Jan 14 12:32:35 2003.1678718) : Query Engine actual: querying dyn
> provider with <select * from Win32_Process>
> (Tue Jan 14 12:32:35 2003.1678765) : Error 80041002 occured executing
queued
> request
> (Tue Jan 14 12:32:35 2003.1678765) : CAsyncReq_CancelProvAsyncCall call
> failed
>
>
However, now CIM Studio can find no definitions for
Win32_PerfRawData_PerfOS_Processor or
Win32_PerfFormattedData_PerfOS_Processor classes and I know get "Invalid
Class" errors for those names. Anyway to add those definitions back assuming
they were deleted when the repository was deleted?
Thanks,
Dave
"Ivan Brugiolo [MSFT]" <ivan...@online.microsoft.com> wrote in message
news:enSdeX$uCHA.2556@TK2MSFTNGP10...
--
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Dave Kolb" <Dave.Kol...@remove.sas.com> wrote in message
news:ufSUUu$uCHA.2488@TK2MSFTNGP12...
I don't suppose that could be used to add the formatted classes to Windows
2000 could it?
"Ivan Brugiolo [MSFT]" <ivan...@online.microsoft.com> wrote in message
news:OfqFR8$uCHA.1656@TK2MSFTNGP09...
--
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Dave Kolb" <Dave.Kol...@remove.sas.com> wrote in message
news:#nT0wMAvCHA.2916@TK2MSFTNGP09...