Wmi activity ошибка 5858 win 10

• Remove From My Forums

• Вопрос

• Добрый день.

  Имеем:

  Windows 2012 Server Standart

  Роли — контроллер домена, AD DS, DNS, Hyper-V. Работает несколько виртуальных машин.

  Весь журнал завален ошибками 5858 WMI-Activity, примерно такого содержания:

  Имя журнала:   Microsoft-Windows-WMI-Activity/Operational
  Источник:      Microsoft-Windows-WMI-Activity
  Дата:          09.04.2013 6:58:27
  Код события:   5858
  Категория задачи:Отсутствует
  Уровень:       Ошибка
  Ключевые слова:
  Пользователь:  СИСТЕМА
  Компьютер:     SRV-MAIN.XXXX.XXXXXXXX.com
  Описание:
  Id = {E25A1B35-A874-4BC4-9514-069B77BE1942}; ClientMachine = SRV-MAIN; User = ; ClientProcessId = 1356; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - RootRsopUserS_1_5_21_2475379679_2976830835_2111589685_1105 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown
  Xml события:
  <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
      <Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418EF04-B0B4-4623-BF7E-D74AB47BBDAA}" />
      <EventID>5858</EventID>
      <Version>0</Version>
      <Level>2</Level>
      <Task>0</Task>
      <Opcode>0</Opcode>
      <Keywords>0x4000000000000000</Keywords>
      <TimeCreated SystemTime="2013-04-08T21:58:27.850773400Z" />
      <EventRecordID>35560</EventRecordID>
      <Correlation />
      <Execution ProcessID="1356" ThreadID="21972" />
      <Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
      <Computer>SRV-MAIN.XXXX.XXXXXXXX.com</Computer>
      <Security UserID="S-1-5-18" />
    </System>
    <UserData>
      <Operation_ClientFailure xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
        <Id>{E25A1B35-A874-4BC4-9514-069B77BE1942}</Id>
        <ClientMachine>SRV-MAIN</ClientMachine>
        <User>
        </User>
        <ClientProcessId>1356</ClientProcessId>
        <Component>Unknown</Component>
        <Operation>Start IWbemServices::DeleteInstance - RootRsopUserS_1_5_21_2475379679_2976830835_2111589685_1105 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"</Operation>
        <ResultCode>0x80041002</ResultCode>
        <PossibleCause>Unknown</PossibleCause>
      </Operation_ClientFailure>
    </UserData>
  </Event>

  Наверное не умею пользоваться поиском, но не получилось ни чего найти, кроме подобных ссылок, где ответов еще нет Event
  5858 from WMI-Activity

  Прошу помочь с этой проблемой. Куда копать, что смотреть.

  Заранее спасибо.

Good morning,

This question is a copy of
the one, asked on the Microsoft community. I’ve been advised to copy this question here. Hereby my question:

On a customer’s system, I’ve installed a program, which launches quite some WMI queries, for determining the status of the machine.

Regularly those WMI queries are failing, and in event logs, there are lots of errors (event ID 5858), hereby a typical example (I’ve obfuscated computer name, customer name and GUID for security reasons):

Log Name:      Microsoft-Windows-WMI-Activity/Operational
Source:        Microsoft-Windows-WMI-Activity
Date:          1/04/2019 14:54:06
Event ID:      5858
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      Computer_Name.Customer.intra
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = Computer_Name; User = NT AUTHORITYSYSTEM; ClientProcessId = 6968; Component = Unknown; Operation = Start IWbemServices::ExecQuery — rootccmpolicymachine : select * from InventoryAction where InventoryActionID=»{00000000-0000-0000-0000-000000000001}»;
ResultCode = 0x80041032; PossibleCause = Unknown
Event Xml:
<Event xmlns=»http://schemas.microsoft.com/win/2004/08/events/event»>
  <System>
    <Provider Name=»Microsoft-Windows-WMI-Activity» Guid=»{……..-….-….-….-…………}» />
    <EventID>5858</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime=»2019-04-01T12:54:06.515593700Z» />
    <EventRecordID>570075</EventRecordID>
    <Correlation />
    <Execution ProcessID=»1736″ ThreadID=»30436″ />
    <Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
    <Computer>Computer_Name.Customer.intra</Computer>
    <Security UserID=»S-1-5-18″ />
  </System>
  <UserData>
    <Operation_ClientFailure xmlns=»http://manifests.microsoft.com/win/2006/windows/WMI»>
      <Id>{00000000-0000-0000-0000-000000000000}</Id>
      <ClientMachine>Computer_Name</ClientMachine>
      <User>NT AUTHORITYSYSTEM</User>
      <ClientProcessId>6968</ClientProcessId>
      <Component>Unknown</Component>
      <Operation>Start IWbemServices::ExecQuery — rootccmpolicymachine : select * from InventoryAction where InventoryActionID=»{00000000-0000-0000-0000-000000000001}»</Operation>
      <ResultCode>0x80041032</ResultCode>
      <PossibleCause>Unknown</PossibleCause>
    </Operation_ClientFailure>
  </UserData>
</Event>

There are 210 such events, the different «ResultCode» values are shown here:

The customer has Windows Server 2016.

Why are those error logs appearing and what can I do in order to avoid them? (Windows update, patch installation (which one?), …)

For your information, my program(s) is/are launching lots of WMI queries, some of them quite complicated, like this one:

SELECT Handle,Name,PageFileUsage,WorkingSetSize,VirtualSize,CommandLine FROM Win32_Process WHERE CommandLine IS NOT NULL AND (ProcessId=6968 or ProcessId=3796 or ProcessId=1120 or ProcessId=3056 or ProcessId=6620 or ProcessId=7520 or ProcessId=28980 or ProcessId=29328 or ProcessId=9012 or ProcessId=7588 or ProcessId=7212 or ProcessId=7744 or ProcessId=7300 or ProcessId=7380 or ProcessId=7416 or ProcessId=9936 or ProcessId=10000 or ProcessId=10068 or ProcessId=10136 or ProcessId=9824 or ProcessId=10808 or ProcessId=10868 or ProcessId=10928 or ProcessId=10996 or ProcessId=10768 or ProcessId=8724 or ProcessId=7136 or ProcessId=8756 or ProcessId=2752 or ProcessId=12984 or ProcessId=10988 or ProcessId=9312 or ProcessId=7308 or ProcessId=7752 or ProcessId=4 or ProcessId=2864 or ProcessId=1684 or ProcessId=2872 or ProcessId=3080 or ProcessId=5452 or ProcessId=6288 or ProcessId=5668 or ProcessId=7628 or ProcessId=38504 or ProcessId=6236 or ProcessId=34356 or ProcessId=3940 or ProcessId=5996 or ProcessId=3068 or ProcessId=3076 or ProcessId=8940 or ProcessId=2688 or ProcessId=3048 or ProcessId=2392 or ProcessId=912 or ProcessId=824 or ProcessId=12252 or ProcessId=2664 or ProcessId=30376 or ProcessId=1128 or ProcessId=2880 or ProcessId=108 or ProcessId=4472 or ProcessId=2960 or ProcessId=2912 or ProcessId=116 or ProcessId=712 or ProcessId=10672 or ProcessId=2284 or ProcessId=1748 or ProcessId=2056 or ProcessId=2572 or ProcessId=2580 or ProcessId=2588 or ProcessId=2760 or ProcessId=2768 or ProcessId=2844 or ProcessId=136 or ProcessId=1212 or ProcessId=1220 or ProcessId=1300 or ProcessId=1328 or ProcessId=1336 or ProcessId=1400 or ProcessId=1568 or ProcessId=1736 or ProcessId=816 or ProcessId=1600 or ProcessId=2640 or ProcessId=37004 or ProcessId=936 or ProcessId=968 or ProcessId=3648)

Thanks in advance

Dominique

• Edited by

  Wednesday, April 3, 2019 10:31 AM

• Moved by
  cloris_sun
  Monday, April 8, 2019 9:50 AM

Good morning,

This question is a copy of
the one, asked on the Microsoft community. I’ve been advised to copy this question here. Hereby my question:

On a customer’s system, I’ve installed a program, which launches quite some WMI queries, for determining the status of the machine.

Regularly those WMI queries are failing, and in event logs, there are lots of errors (event ID 5858), hereby a typical example (I’ve obfuscated computer name, customer name and GUID for security reasons):

Log Name:      Microsoft-Windows-WMI-Activity/Operational
Source:        Microsoft-Windows-WMI-Activity
Date:          1/04/2019 14:54:06
Event ID:      5858
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      Computer_Name.Customer.intra
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = Computer_Name; User = NT AUTHORITYSYSTEM; ClientProcessId = 6968; Component = Unknown; Operation = Start IWbemServices::ExecQuery — rootccmpolicymachine : select * from InventoryAction where InventoryActionID=»{00000000-0000-0000-0000-000000000001}»;
ResultCode = 0x80041032; PossibleCause = Unknown
Event Xml:
<Event xmlns=»http://schemas.microsoft.com/win/2004/08/events/event»>
  <System>
    <Provider Name=»Microsoft-Windows-WMI-Activity» Guid=»{……..-….-….-….-…………}» />
    <EventID>5858</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime=»2019-04-01T12:54:06.515593700Z» />
    <EventRecordID>570075</EventRecordID>
    <Correlation />
    <Execution ProcessID=»1736″ ThreadID=»30436″ />
    <Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
    <Computer>Computer_Name.Customer.intra</Computer>
    <Security UserID=»S-1-5-18″ />
  </System>
  <UserData>
    <Operation_ClientFailure xmlns=»http://manifests.microsoft.com/win/2006/windows/WMI»>
      <Id>{00000000-0000-0000-0000-000000000000}</Id>
      <ClientMachine>Computer_Name</ClientMachine>
      <User>NT AUTHORITYSYSTEM</User>
      <ClientProcessId>6968</ClientProcessId>
      <Component>Unknown</Component>
      <Operation>Start IWbemServices::ExecQuery — rootccmpolicymachine : select * from InventoryAction where InventoryActionID=»{00000000-0000-0000-0000-000000000001}»</Operation>
      <ResultCode>0x80041032</ResultCode>
      <PossibleCause>Unknown</PossibleCause>
    </Operation_ClientFailure>
  </UserData>
</Event>

There are 210 such events, the different «ResultCode» values are shown here:

The customer has Windows Server 2016.

Why are those error logs appearing and what can I do in order to avoid them? (Windows update, patch installation (which one?), …)

For your information, my program(s) is/are launching lots of WMI queries, some of them quite complicated, like this one:

SELECT Handle,Name,PageFileUsage,WorkingSetSize,VirtualSize,CommandLine FROM Win32_Process WHERE CommandLine IS NOT NULL AND (ProcessId=6968 or ProcessId=3796 or ProcessId=1120 or ProcessId=3056 or ProcessId=6620 or ProcessId=7520 or ProcessId=28980 or ProcessId=29328 or ProcessId=9012 or ProcessId=7588 or ProcessId=7212 or ProcessId=7744 or ProcessId=7300 or ProcessId=7380 or ProcessId=7416 or ProcessId=9936 or ProcessId=10000 or ProcessId=10068 or ProcessId=10136 or ProcessId=9824 or ProcessId=10808 or ProcessId=10868 or ProcessId=10928 or ProcessId=10996 or ProcessId=10768 or ProcessId=8724 or ProcessId=7136 or ProcessId=8756 or ProcessId=2752 or ProcessId=12984 or ProcessId=10988 or ProcessId=9312 or ProcessId=7308 or ProcessId=7752 or ProcessId=4 or ProcessId=2864 or ProcessId=1684 or ProcessId=2872 or ProcessId=3080 or ProcessId=5452 or ProcessId=6288 or ProcessId=5668 or ProcessId=7628 or ProcessId=38504 or ProcessId=6236 or ProcessId=34356 or ProcessId=3940 or ProcessId=5996 or ProcessId=3068 or ProcessId=3076 or ProcessId=8940 or ProcessId=2688 or ProcessId=3048 or ProcessId=2392 or ProcessId=912 or ProcessId=824 or ProcessId=12252 or ProcessId=2664 or ProcessId=30376 or ProcessId=1128 or ProcessId=2880 or ProcessId=108 or ProcessId=4472 or ProcessId=2960 or ProcessId=2912 or ProcessId=116 or ProcessId=712 or ProcessId=10672 or ProcessId=2284 or ProcessId=1748 or ProcessId=2056 or ProcessId=2572 or ProcessId=2580 or ProcessId=2588 or ProcessId=2760 or ProcessId=2768 or ProcessId=2844 or ProcessId=136 or ProcessId=1212 or ProcessId=1220 or ProcessId=1300 or ProcessId=1328 or ProcessId=1336 or ProcessId=1400 or ProcessId=1568 or ProcessId=1736 or ProcessId=816 or ProcessId=1600 or ProcessId=2640 or ProcessId=37004 or ProcessId=936 or ProcessId=968 or ProcessId=3648)

Thanks in advance

Dominique

• Edited by

  Wednesday, April 3, 2019 10:31 AM

• Moved by
  cloris_sun
  Monday, April 8, 2019 9:50 AM

Read these next…

• 
  
  

  WINDOWS 10 «glitch» — file explorer

  Windows

  Hi.I have been experiencing a black line (glitch) on my file explorer which comes for milliseconds then it goes away. See screen grab. Is there anyone who has experienced such and how were they able to solve it?Thank you.

• 
  
  

  Are you updating workstations to Windows 11?

  Windows

  Has anyone started updating workstations on a AD domain to Windows 11? what type of issues are you facing?What is the user reaction been?Thanks!

• 
  
  

  Snap! — Psyche Probe, DIY Gene Editing, RaiBo, AI handwriting, Metric Pirates

  Spiceworks Originals

  Your daily dose of tech news, in brief.

  Welcome to the Snap!

  Flashback: January 27, 1880: Thomas Edison receives patent for the Electric Lamp. (Read more HERE.)

  Bonus Flashback: January 27, 1967: Apollo 1 Tragedy (Read more HERE.)

  You …

• 
  
  

  NEC Inmail Email doesn’t Change

  Collaboration

  Hey Everyone,Recently a client of mine wanted to change the email to their QA extension to her email as to help keep voicemails consolidated instead of spread out among different emails. Normally this wouldn’t be a huge deal. Logged in to to Webpro, hoppe…

• 
  
  

  I inherited some really cool equipment. I just have no clue how to use it!

  Hardware

  So I’ve got some switches, and some servers. The switches seem pretty straight forward, plug in packet go zoom, but I have no clue how these servers work. They’re headless rack servers. I know there must be a way to get some kind of UI going with a monito…

1. WMI activity even 5858 and no one seems to know how to fix it

   I have been receiving these errors for a very long time on windows 10. My event viewer for the service WMI is completely full of 5858 errors. The only fix i haven’t tried is one that no one seems to be able to help me do.https://docs.microsoft.com/de-DE/troubleshoot/windows-client/system-management-components/wmi-activity-event-5858-logged-with-resultcode-0x80041032it explains that I should do the following.The WMI client application should be modified to IEnumWbemClassObject::Nextissue calls to get the full result set before the IWbemContext object is released. If no objec

2. WMI Activity generates event ID 5858 every 15 seconds

   WMI Activity generates event ID 5858 every 15 seconds
   Errors Are related to Intel CIntelWLANEvent, win32_perfformatteddata_perfdisk_physicaldisk CurrentDiskQueueLength, BIOSEvent

   Ran dism Sfc Chkdsk all without error.

   Turned off WMI performance adapter Service and the errors ceased

   At one point it had reconfigured all my apps

   I have created a wmi activity evtx file
   Error 11/15/2017 2:18:52 PM WMI-Activity 5858 None

   Windows 10 home Fall creators edition Dell 5567

   [Moved from: Windows / Windows 10 / Windows settings]

3. WMI events 5858 on a Windows Server 2016, what to do?

   Thanks for your quick reply.

   As suggested I created a copy of this question on Technet forum: Technet
   copy

4. WMI activity even 5858 and no one seems to know how to fix it

   Windows not shutting down, caused by Event Error 5858 ? (WMI Activity)

   Regularly my pc does not shut down, it gets stuck on the blue screen with «Shutting Down»
   After a while I need to shut down the pc, using the power-button on the case.

   I already untagged «Turn on fast start-up (recommended)»
   under Control Panel->All Control Panel Items->Power Options->System Settings under ‘Shut-down settings»

   Regretfully that did not solve the issue.

   I checked the event log between me initiating shutdown (event 1074) and rebooting.

   There are quite a number of entries reading like this:

   Event : 5858
   Source : Microsoft-Windows-WMI-Activity
   Description:
   Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-JFFLEA5; User = NT AUTHORITYSYSTEM; ClientProcessId = 2908; Component = Unknown; Operation = Start IWbemServices::ExecQuery — rootwmi : select * from WDMClassesOfDriver where ClassName = «MSStorageDriver_ClassErrorLogEntry»; ResultCode = 80041032; PossibleCause Unknown
   —
   Event : 5858
   Source : Microsoft-Windows-WMI-Activity
   Description:
   Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-JFFLEA5; User = NT AUTHORITYSYSTEM; ClientProcessId = 2908; Component = Unknown; Operation = Start IWbemServices::ExecQuery — rootwmi : select * from WMIBinaryMofResource where Name = «USBSTORDisk&Ven_WD&Prod_My_Book_1230&Rev_106557583231443934374E345956&0_0-{05901221-D566-11d1-B2F0-00A0C9062910}»; ResultCode = 80041032; PossibleCause = Unknown
   =

   Note that I did have external drives running, but they were properly removed (ejected) and then, before shutting down, they were switched/powered off, i.e. they didn’t exist anymore for Windows.

   Does anybody out there know how to handle this and what is causing this error?
   Any solutions?

   Thanks!

   =

Содержание:

• Диагностика проблем с WMI
• Исправление WMI репозитория, перерегистрация библиотек, перекомпиляция MOF файлов
• Сброс и пересоздание WMI репозитория (хранилища)

В моем случае, например, при открытии свойств WMI Control в консоли управления компьютером (compmgmt.msc) появлялась надпись:

Failed to initialize all required WMI classes
Win32_Processor. WMI: Invalid namespace
Win32_WMISetting. WMI: Invalid namespace
Win32_OperationSystem. WMI: Invalid namespace

Совет. В 64 битных версиях Windows wmidiag нужно запускать так:

c:windowsSystem32cscript.exe wmidiag.vbs

в противном случае появится ошибка:

WMIDiag must be run from native 64-bit environment. It is not supported in Wow64.

На 64 битной версии Windows эти действия нужно также выполнить для каталога SysWOW64. Замените третью строку на

cd %windir%SysWOW64wbem