Wmi event id 10 error

Technical articles, content and resources for IT Professionals working in Microsoft technologies

Comments

  • 5 Mar 2012 7:44 AM

    Anyone having the Event 10 as listed below, Either Vista or Windows 7, Can ignore this problem or use the fixit to remove the Event consumer and Event Filter that appears to be accidently left in while the OS was being designed and built. The only place it showed up (that I could find) was in the WMI repository.

    Event filter with query «SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99″ could not be reactivated in namespace «//./root/CIMV2» because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    The Error Number 0x80041003 is a WMI Error, WBEM_E_ACCESS_DENIED (2147749891 (0x80041003))

    Which Means the User “SID” Used to Create the Event Filter does not exist on your system and will have no security permissions to do anything and will always be denied.

    If you have Event 10 listings other than this one then they will have to be handled in their own way.

  • 29 Jan 2012 6:41 AM

    help for that please Vista SP2!

  • 6 Dec 2011 9:02 AM

    Sorry for all these posts.  I kept trying to post and kept getting an error message that I could not connect.  So I assumed none of the posts got through….

  • 6 Dec 2011 8:31 AM

    I also have Vista Sp2 and am getting this error.  Is the fix above OK to use for Vista?

  • 6 Dec 2011 8:11 AM

    I also have Vista Sp2 and am getting this error.  Any solution?  Here is event:

    Log Name:      Application

    Source:        Microsoft-Windows-WMI

    Date:          12/6/2011 8:19:19 AM

    Event ID:      10

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      junia-PC

    Description:

    Event filter with query «SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99″ could

    not be reactivated in namespace «//./root/CIMV2» because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Event Xml:

    <Event xmlns=»schemas.microsoft.com/…/event»>

     <System>

       <Provider Name=»Microsoft-Windows-WMI» Guid=»{1edeee53-0afe-4609-b846-d8c0b2075b1f}» EventSourceName=»WinMgmt» />

       <EventID Qualifiers=»49152″>10</EventID>

       <Version>0</Version>

       <Level>2</Level>

       <Task>0</Task>

       <Opcode>0</Opcode>

       <Keywords>0x80000000000000</Keywords>

       <TimeCreated SystemTime=»2011-12-06T13:19:19.000Z» />

       <EventRecordID>204557</EventRecordID>

       <Correlation />

       <Execution ProcessID=»0″ ThreadID=»0″ />

       <Channel>Application</Channel>

       <Computer>junia-PC</Computer>

       <Security />

     </System>

     <EventData>

       <Data>//./root/CIMV2</Data>

       <Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99</Data>

       <Data>0x80041003</Data>

     </EventData>

    </Event>

  • 6 Dec 2011 8:04 AM

    I also have Vista Sp2 and am getting this error.  Any advice?

  • 6 Dec 2011 8:01 AM

    I also have Vista Sp2 and am getting this error.  Any solution?  Here is event:

    Log Name:      Application

    Source:        Microsoft-Windows-WMI

    Date:          12/6/2011 8:19:19 AM

    Event ID:      10

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      junia-PC

    Description:

    Event filter with query «SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99″ could

    not be reactivated in namespace «//./root/CIMV2» because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Event Xml:

    <Event xmlns=»schemas.microsoft.com/…/event»>

     <System>

       <Provider Name=»Microsoft-Windows-WMI» Guid=»{1edeee53-0afe-4609-b846-d8c0b2075b1f}» EventSourceName=»WinMgmt» />

       <EventID Qualifiers=»49152″>10</EventID>

       <Version>0</Version>

       <Level>2</Level>

       <Task>0</Task>

       <Opcode>0</Opcode>

       <Keywords>0x80000000000000</Keywords>

       <TimeCreated SystemTime=»2011-12-06T13:19:19.000Z» />

       <EventRecordID>204557</EventRecordID>

       <Correlation />

       <Execution ProcessID=»0″ ThreadID=»0″ />

       <Channel>Application</Channel>

       <Computer>junia-PC</Computer>

       <Security />

     </System>

     <EventData>

       <Data>//./root/CIMV2</Data>

       <Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99</Data>

       <Data>0x80041003</Data>

     </EventData>

    </Event>

  • 6 Dec 2011 7:59 AM

    I also have Vista Sp2 and am getting this error.  Any solution?  Here is event:

    Log Name:      Application

    Source:        Microsoft-Windows-WMI

    Date:          12/6/2011 8:19:19 AM

    Event ID:      10

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      junia-PC

    Description:

    Event filter with query «SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99″ could

    not be reactivated in namespace «//./root/CIMV2» because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Event Xml:

    <Event xmlns=»schemas.microsoft.com/…/event»>

     <System>

       <Provider Name=»Microsoft-Windows-WMI» Guid=»{1edeee53-0afe-4609-b846-d8c0b2075b1f}» EventSourceName=»WinMgmt» />

       <EventID Qualifiers=»49152″>10</EventID>

       <Version>0</Version>

       <Level>2</Level>

       <Task>0</Task>

       <Opcode>0</Opcode>

       <Keywords>0x80000000000000</Keywords>

       <TimeCreated SystemTime=»2011-12-06T13:19:19.000Z» />

       <EventRecordID>204557</EventRecordID>

       <Correlation />

       <Execution ProcessID=»0″ ThreadID=»0″ />

       <Channel>Application</Channel>

       <Computer>junia-PC</Computer>

       <Security />

     </System>

     <EventData>

       <Data>//./root/CIMV2</Data>

       <Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99</Data>

       <Data>0x80041003</Data>

     </EventData>

    </Event>

  • 6 Dec 2011 7:56 AM

    I also have Vista Sp2 and am getting this error.  Any solution?  Here is event:

    Log Name:      Application

    Source:        Microsoft-Windows-WMI

    Date:          12/6/2011 8:19:19 AM

    Event ID:      10

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      junia-PC

    Description:

    Event filter with query «SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99″ could

    not be reactivated in namespace «//./root/CIMV2» because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Event Xml:

    <Event xmlns=»schemas.microsoft.com/…/event»>

     <System>

       <Provider Name=»Microsoft-Windows-WMI» Guid=»{1edeee53-0afe-4609-b846-d8c0b2075b1f}» EventSourceName=»WinMgmt» />

       <EventID Qualifiers=»49152″>10</EventID>

       <Version>0</Version>

       <Level>2</Level>

       <Task>0</Task>

       <Opcode>0</Opcode>

       <Keywords>0x80000000000000</Keywords>

       <TimeCreated SystemTime=»2011-12-06T13:19:19.000Z» />

       <EventRecordID>204557</EventRecordID>

       <Correlation />

       <Execution ProcessID=»0″ ThreadID=»0″ />

       <Channel>Application</Channel>

       <Computer>junia-PC</Computer>

       <Security />

     </System>

     <EventData>

       <Data>//./root/CIMV2</Data>

       <Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99</Data>

       <Data>0x80041003</Data>

     </EventData>

    </Event>

  • 6 Dec 2011 7:54 AM

    I also have Vista Sp2 and am getting this error.  Any solution?  Here is event:

    Log Name:      Application

    Source:        Microsoft-Windows-WMI

    Date:          12/6/2011 8:19:19 AM

    Event ID:      10

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      junia-PC

    Description:

    Event filter with query «SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99″ could

    not be reactivated in namespace «//./root/CIMV2» because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Event Xml:

    <Event xmlns=»schemas.microsoft.com/…/event»>

     <System>

       <Provider Name=»Microsoft-Windows-WMI» Guid=»{1edeee53-0afe-4609-b846-d8c0b2075b1f}» EventSourceName=»WinMgmt» />

       <EventID Qualifiers=»49152″>10</EventID>

       <Version>0</Version>

       <Level>2</Level>

       <Task>0</Task>

       <Opcode>0</Opcode>

       <Keywords>0x80000000000000</Keywords>

       <TimeCreated SystemTime=»2011-12-06T13:19:19.000Z» />

       <EventRecordID>204557</EventRecordID>

       <Correlation />

       <Execution ProcessID=»0″ ThreadID=»0″ />

       <Channel>Application</Channel>

       <Computer>junia-PC</Computer>

       <Security />

     </System>

     <EventData>

       <Data>//./root/CIMV2</Data>

       <Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA «Win32_Processor» AND TargetInstance.LoadPercentage > 99</Data>

       <Data>0x80041003</Data>

     </EventData>

    </Event>

 
Easy Steps to Fix Event 10 WMI Error on Windows 10. – While creating ISO or DVD, you get Event ID 10 error or WMI Event 10. Windows 10, 8.1, and 7 users equally find this error and see a message – “Events cannot be delivered through this filter until the problem is corrected “. Event Viewer 10 WMI is a common issue for the Windows users, but thankfully Microsoft has given a fix. This fix works very well to solve Event ID error on all the versions including Windows 10.

Event 10 Error occurs due to WMI registration doesn’t properly work and becomes unable to run on a live system. However, the issue doesn’t harm your system so you can ignore it. But fixing Event 10 WMI is a better solution. So you will see simple steps to fix this Event Viewer 10 WMI problem.

Step 1 – Click Start icon, write Notepad, and press Enter.

Step 2 – Copy the below text

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\" _
& strComputer & "rootsubscription")

Set obj1 = objWMIService.ExecQuery("select * from __eventfilter where name='BVTFilter' and query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ""Win32_Processor"" AND TargetInstance.LoadPercentage > 99'")

For Each obj1elem in obj1

set obj2set = obj1elem.Associators_("__FilterToConsumerBinding")

set obj3set = obj1elem.References_("__FilterToConsumerBinding")

For each obj2 in obj2set

WScript.echo "Deleting the object"

WScript.echo obj2.GetObjectText_

obj2.Delete_

next

For each obj3 in obj3set

WScript.echo "Deleting the object"

WScript.echo obj3.GetObjectText_

obj3.Delete_

next

WScript.echo "Deleting the object"

WScript.echo obj1elem.GetObjectText_

obj1elem.Delete_

Next

Step 3 – Paste in the notepad and click File Followed by Save.

How to Fix Event 10 WMI Error on Windows 10 image 1

Step 4 – On the Save Windows, write File name fix.vbs and click Save. Before saving select a convenient location where the file will be saved.

How to Fix Event 10 WMI Error on Windows 10 image 2

Alternatively, you can download one fix.vbs from the below –

Event 10 WMI Error script

The downloaded file will work as Event id 10 hotfix after you run the CD command.

Change the Directory of fixing Script

Step 1 – Click “Win+X”, and select “Command prompt (admin)” from the list of options.

Step 2 – Quickly the UAC pop up will appear. Click Yes.

Step 2 – Copy the command CD c:users%username% paste and click Enter.

How to Fix Event 10 WMI Error on Windows 10 image 3

Run the script to stop Event 10 WMI

Step 5 – Finally, double click on fix.vbs to run the saved script.

This will stop Event 10 WMI Error on Windows 10 (event id 10). In case, you want to remove the event logs displaying the error, go to the Event viewer and manually remove them.

So, if you have removed the error, the older logs will be deleted and no more Event 10 WMI Error message will be found.

Conclusion

These are the ways for How to Fix Event 10 WMI Error on Windows 10. The script will prevent the issue and so, you will not see later the message later.

Repair any Windows problems such as Blue/Black Screen, DLL, Exe, application, Regisrty error and quickly recover system from issues using Reimage.

I have got below error Event 10 in Application log after installed the Windows Server 2008 R2 Service Pack 1.

Log Name:      Application
Source:        Microsoft-Windows-WMI
Date:          11/15/2014 1:48:57 PM
Event ID:      10
Level:         Error
Computer:      TPVServer.MTS.local
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Fix/Solution for Windows 7 or Windows Server with Service Pack 1

I have got the quick fix for this error Event 10 from microsoft support forum: Fix Application Error Event ID 10

We need to run below script to stop the Event ID 10 messages. To run the script follow these steps:

1) Copy the below script code and paste in Notepad file.

2) Save As the Notepad file with the extension .vbs like FixErrorEvent10.vbs

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!" _
& strComputer & "rootsubscription")
Set obj1 = objWMIService.ExecQuery("select * from __eventfilter where name='BVTFilter' and query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ""Win32_Processor"" AND TargetInstance.LoadPercentage > 99'")

For Each obj1elem in obj1

set obj2set = obj1elem.Associators_("__FilterToConsumerBinding")
set obj3set = obj1elem.References_("__FilterToConsumerBinding")

For each obj2 in obj2set
WScript.echo "Deleting the object"
WScript.echo obj2.GetObjectText_
obj2.Delete_
next

For each obj3 in obj3set
WScript.echo "Deleting the object"
WScript.echo obj3.GetObjectText_
obj3.Delete_
next

WScript.echo "Deleting the object"
WScript.echo obj1elem.GetObjectText_
obj1elem.Delete_
Next

3) Open the command prompt with elevated privilege (Run As Administrator)

4) Now run the vb script file FixErrorEvent10.vbs using CScript from command prompt to stop the event 10 with the above error message.

Event ID 10 - SELECT * FROM __InstanceModificationEvent - WMI

After running this script the Event ID 10 errors related to this event should stop occurring.

Note: If you receive the Event ID 10 with different error message, there can be other reasons, this only prevents the Event ID 10 with above error message.

Thanks,
Morgan
Software Developer

I recently upgraded my Hyper-V host from Server 2008 R2 to 2012 R2. It’s not domain-joined, and I did an in-place upgrade. Every 11 seconds, I was getting the following error in the Application event log:

Log Name:      Application
Source:        Microsoft-Windows-WMI
Event ID:      10
Level:         Error
User:          SYSTEM
Description:
Event filter with query “SELECT * FROM __InstanceOperationEvent WITHIN 10 WHERE (TargetInstance ISA ‘Msvm_ExternalEthernetPort’) OR (TargetInstance ISA ‘Msvm_VmLANEndpoint’) OR (TargetInstance ISA ‘Msvm_SyntheticEthernetPort’) OR (TargetInstance ISA ‘Msvm_ComputerSystem’) OR (TargetInstance ISA ‘Msvm_VLANEndpointSettingData’)” could not be reactivated in namespace “//./root/virtualization” because of error 0×80041010. Events cannot be delivered through this filter until the problem is corrected.

Each section below lists an attempted fix. Jump to the last section for “The Short Answer.”

Network Drivers

Microsoft Partner Support suggested that this might be caused by network drivers. This machine has both Broadcom and Intel NICs. For both, when I tried to update the driver, I got the message, “Windows has determined the driver software for your device is up to date.” Nonetheless, I decided to uninstall and reinstall the drivers to see if it helped.

First I uninstalled the Intel driver, version 6.3.9600.16384. After a reboot, the driver had re-installed itself, but with version 9.6.10.0. The WMI errors continued.

Next I uninstalled the Broadcom driver, version 7.4.23.2. After a reboot, the driver had re-installed itself, but with version 7.4.23.2. The WMI errors continued.

Note that uninstalling the driver causes Hyper-V to lose the NIC association; it reverts to being an Internal network. After the drivers re-installed, I had to go back to the Hyper-V Virtual Switch Manager and re-assign the existing switch to the External network.

WMI Rebuild

Another suggestion was to rebuild the WMI repository. I ran this script from TechNet:

http://blogs.technet.com/b/askperf/archive/2009/04/13/wmi-rebuilding-the-wmi-repository.aspx

After running the script, I ran winmgmt /verifyrepository. The repository is consistent. However, the errors continue every 11 seconds.

Process Monitor

While working on another issue, I ran Process Monitor from Sysinternals. Interesting:  there are a lot of references to IProsetMonitor.exe, including unsuccessful attempts to read a “virtualization” key in the registry, followed by writing to a special event log, Microsoft-Windows-WMI-Activity/Operational.

WMI 10 error 1

That log is small (1MB) so it only holds about 750 events. There are so many 5858 events being written to that log that it only holds about five seconds worth. It took some fast keyboarding to grab this sample:

Log Name:      Microsoft-Windows-WMI-Activity/Operational
Source:        Microsoft-Windows-WMI-Activity
Event ID:      5858
Level:         Error
User:          SYSTEM
Description:
Id = {4C4C4544-0031-0002-EAE0-B8E795DDCE01}; ClientMachine = MYHVSVR; User = NT AUTHORITYSYSTEM; ClientProcessId = 1732; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery – rootvirtualization : SELECT * FROM __InstanceOperationEvent WITHIN 10 WHERE (TargetInstance ISA ‘Msvm_ExternalEthernetPort’) OR (TargetInstance ISA ‘Msvm_VmLANEndpoint’) OR (TargetInstance ISA ‘Msvm_SyntheticEthernetPort’) OR (TargetInstance ISA ‘Msvm_ComputerSystem’) OR (TargetInstance ISA ‘Msvm_VLANEndpointSettingData’); ResultCode = 0x80041010;

That “ClientProcessId = 1732” is interesting because it points back to IProsetMonitor.exe in Task Manager:

WMI 10 error 2

The Culprit:  Intel PROSet Monitoring Service

So finally we know where the error is coming from:  the Intel PROSet Monitoring Service. Sure enough, when I stopped that service, it stopped both the 5858 events in the Microsoft-Windows-WMI-Activity event log and the WMI 10 events in the Application event log. Phew! That’s a relief. I bet my system will run better without hundreds of events being written every few seconds.

So I need a version of PROSet that works on 2012 R2.

I tried re-installing the version that was working before (Dell calls is 14.0.0; Intel calls it 17.3.66), but I still get the WMI errors.

I tried installing the latest from Dell (14.5.1, Intel 18.2.63.0), but that will require deleting my virtual NIC:

WMI 10 error 3

Well if I’m going to do that, maybe I should see if Intel has a later version specifically for 2012 R2. Yup, here’s ProWin64.exe version 18.7 for Server 2012 R2. I tried installing that and it said my computer has no Intel adapters (shown here next to Device Manager listing the Intel adapters):

WMI 10 error 4

So I went back to the latest Dell version 14.5.1. that installed okay, but the WMI errors were back.

Eventually I found this Intel page about the level of 2012 R2 support for each of their NICs. It turns out that my PRO/1000 PT Server Adapter only has “In Box Support,” which means that PROSet for Windows Device Manager is not included. So I wound up doing a Modify installation on the latest Dell version, leaving only the drivers and the SNMP Agent installed:

WMI 10 error 5

In that configuration, PROSet is not active and the WMI errors are not happening.

Re-Activate the Virtual Adapter

The last step is to re-connect the Hyper-V virtual switch to the physical NIC. After opening the Network Connections (ncpa.cpl) to confirm which NIC is plugged in, I went in to the Hyper-V Virtual Switch Manager and set the old virtual switch to use the “new” external NIC. That led to this message:

WMI 10 error 6

Great. How can every little step in setting up a computer be a failure? And why not give a reason for the failure?

Back to Google, I found lots of suggestions. One was to uninstall and re-install the network drivers. I thought I just did that, but I went to Device Manager, told it to uninstall and remove drivers on both Intel NICs, then rebooted.

Before the reboot, the Microsoft NIC driver was at version 9.6.10.0; an attempt to update gave a message that the latest driver is already installed. After the reboot, the Microsoft NIC driver was at version 9.13.41.3. Go figure.

Anyway, the driver uninstall/reinstall didn’t help. I kept getting the “Failed while adding virtual Ethernet switch connections” message.

This article had some low-level details on the errors. I followed the first part of those suggestions, including removing the old virtual switch from all virtual machines, but kept getting the error.

Finally on a whim, I tried unchecking “Allow management operating system to share this network adapter.”

WMI 10 error 7

Voila! The virtual switch was created with no problem. Then I went back in and re-enabled management:

WMI 10 error 8

That also completed with no problem (other than losing the Remote Desktop session—be sure you have console access).

Finally, I went in to the new vEthernet switch and set the machines fixed IP address and DNS servers:

WMI 10 error 9

The Short Answer

If you’re getting WMI 10 errors every 11 seconds after a Server 2012 R2 upgrade, try these steps:

  1. In Event Viewer, go to Applications and Services Logs > Microsoft > Windows > WMI-Activity event log and check for 5858 errors. If you see errors that match the WMI 10 errors in the Application log, use the Process ID from the 5858 event to find out from Task Manager what process is causing the error.
  2. If IProsetMonitor.exe is causing the error, check this Intel page to see what level of support your NIC has under Server 2012 R2.
  3. If Full Support is available, you may be able to update your NIC driver. You’ll want to use the full package that includes the PROSet tools. Mine didn’t have full support so this didn’t work for me.
  4. If only Out of Box support is available, either uninstall the Intel tools entirely and just use the Microsoft driver, or Modify the install to remove PROSet but leave the driver.

If you need to remove and re-create your Hyper-V virtual switch in order to uninstall the driver, see notes in the previous section.

PROBLEM:

A WMI error occurs if a “WMI Filter” is accessed without sufficient permission. This originated in the Windows 7 SP1 DVD/ISO creation process. There was an issue in the creation process that caused a WMI registration to remain in the DVD/ISO. Since the registration is designed to work only during the DVD/ISO creation process, it fails to run on a live system and causes these events.

These events are not indicative of any issue in the system and can be safely ignored. If however you want to prevent these events from getting generated and want to remove this specific WMI registration manually, please follow the steps mentioned in this article for running the workaround script.

​When you click on the DETAILS tab in the error message and select XML view , you receive a message similar to this:

Event Xml:
<Event xmlns=”https://schemas.microsoft.com/win/2004/08/events/event”>
<System>
<Provider Name=”Microsoft-Windows-WMI” Guid=”{1edeee53-0afe-4609-b846-d8c0b2075b1f}” EventSourceName=”WinMgmt” />
<EventID Qualifiers=”49152″>10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”2008-01-18T22:37:27.000Z” />
<EventRecordID>187</EventRecordID>
<Correlation />
<Execution ProcessID=”0″ ThreadID=”0″ />
<Channel>Application</Channel>
<Computer>adsd-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage &gt; 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>

How to Fix It:

To resolve this problem, you need to run a script to stop the Event ID 10 messages. This article applies to all versions of Windows 7 and Server 2008 R2.

1.  In a text editor such as notepad, create a new text document name “workaround.vbs”
2.  Copy and paste the following code into “workaround.vbs”. Do NOT copy <start> and <end> tags.

<START>

strComputer = “.”
Set objWMIService = GetObject(“winmgmts:” _
& “{impersonationLevel=impersonate}!\” _
& strComputer & “rootsubscription”)
Set obj1 = objWMIService.ExecQuery(“select * from __eventfilter where name=’BVTFilter’ and query=’SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “”Win32_Processor”” AND TargetInstance.LoadPercentage > 99′”)
For Each obj1elem in obj1
set obj2set = obj1elem.Associators_(“__FilterToConsumerBinding”)
set obj3set = obj1elem.References_(“__FilterToConsumerBinding”)
For each obj2 in obj2set
WScript.echo “Deleting the object”
WScript.echo obj2.GetObjectText_
obj2.Delete_
next
For each obj3 in obj3set
WScript.echo “Deleting the object”
WScript.echo obj3.GetObjectText_
obj3.Delete_
next
WScript.echo “Deleting the object”
WScript.echo obj1elem.GetObjectText_
obj1elem.Delete_
Next

<END>

3.  Save and close notepad.
4.  Open an “elevated command prompt” (Start/Programs and RIGHT click on command prompt –choose “run as administrator”.
5.  Changed Directory (CD x.x) to the location of “workaround.vbs” text document
6.  Run script.
7.  After you run this script, the Event ID 10 messages stop appearing in the Application log. However, you have to manually clear any previous Event ID 10 messages​

Recently, some users encountered an error message with Windows WMI Error Event ID 10. This problem occurs due to several factors. Let’s discuss some of them below.

Speed up your PC in just a few clicks

  • 1. Download and install ASR Pro
  • 2. Open the application and click on the Scan button
  • 3. Select the files or folders you want to restore and click on the Restore button
  • Download this software now and say goodbye to your computer problems.

    WMI provides users with information about the status of local or networked IT support computer systems. The purpose of WMI is to help administrators manage various Windows operating environments, including remote computer recovery systems.

    This article provides a script to suppress event ID 10 mitigated after installing maintenance group 1 for Windows 7 or Windows Server 2008 R2.

    Applies to: Windows 7 Service Pack 1, Windows Server 2009 R2 Service Pack 1
    Source Knowledge Base Collection: 2545227

    Symptoms

    After installing Windows 4 SP1 or sometimes Windows Server 2008 R2 SP1 with media included, the following WMI errors are logged in the Application log after each reboot:

    Protocol Name - ApplicationSource-WMIEvent ID - tenlevel - errorUser - N/ATransaction code informationTask chat - noKeywords - ClassicsDetails from event filter with situation "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.> loadpercentage 99 "failed to reactivate in entire namespace" //. /root/CIMV2" due to calculation error 0x80041003. Events are notYou can stream through your filter until the problem is likely to be resolved.

    Reason

    This issue occurs during the creation process of a Windows SP1 7 DVD/ISO. During the creation process, a problem occurred that caused a WMI entry to remain on the DVD/ISO. Because most of the registry is designed to run during the DVD/ISO creation process, it does not run afterwards and results in these events. These events indicate that there is no output in the system and can always be safely ignored. When you finally want to prevent these events from merging and manually remove that very specific WMI entry, you usually run a workaround script.

    Resolution

    To resolve this issue, run this script to stop messages with event ID 10. To run the script, do the following:

    1. In Notepad, create a new document called Workaround.txt.

    2. Copy the script to paste it into Notepad:

      Speed up your PC in just a few clicks

      Is your computer running slow and unstable? Are you plagued by mysterious errors, and worried about data loss or hardware failure? Then you need ASR Pro � the ultimate software for repairing Windows problems. With ASR Pro, you can fix a wide range of issues in just a few clicks, including the dreaded Blue Screen of Death. The application also detects crashing applications and files, so you can quickly resolve their problems. And best of all, it�s completely free! So don�t wait � download ASR Pro now and enjoy a smooth, stable and error-free PC experience.

      strComputer = "."Setting objWMIService means GetObject("winmgmts:" _& "impersonationLevel=impersonation!" _&& strComputer "rootsubscription")Set obj1 = objWMIService.ExecQuery("select 7 . from __eventfilter where name = 'BVTFilter', in addition query = 'SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ""Win32_Processor"" isa AND TargetInstance.LoadPercentage > Every 99'")for obj1elem in obj1set obj2set to obj1elem.Associators_("__FilterToConsumerBinding")set obj3set = obj1elem.References_("__FilterToConsumerBinding")Almost all obj2 in obj2setWScript.echo "Deleting our object"WScript.echo obj2.GetObjectText_obj2.delete_nextFor each obj3 in obj3setWScript.echo "Deleting the current object"WScript.echo obj3.GetObjectText_obj3.delete_nextWScript.echo "Usually deletes object"WScript.echo obj1elem.GetObjectText_obj1elem.delete_Next
    3. Save text as Workaround.vbs.

    4. How do I fix WMI error?

      Disable and stop the WMI service. winmgmt structured configuration start = disabled. (pay attention to this place before disconnecting)Run all of the following commands. Winmgmt /salvagerrepository %windir%System32wbem. Winmgmt /resetrepository %windir%System32wbem.Re-enable the WMI service and restart the computer.

      Close the editor.

    5. Open an elevated command prompt:

      1. Select.
      2. Select programs.
      3. Right-click Command Prompt.
      4. Select “Run as administrator”.
    6. windows wmi error event id 10

      Change to the directory containing workaround.vbs, for example CD c:users%username%.

    7. Run workaround.vbs.

    After running the script, the Event ID 10 errors associated with this important event should no longer appear. This software does not delete known zhu entries.event log, many of them would have to be manually removed from the Application Workshop log.

    Read More

    This particular error message named event 10 above can simply be ignored. This indicates a serious problem not with the Service the Pack, but with the operating system.

  • 2 minutes of reading
  • There may be other reasons for the error messages with event ID 10. This workaround only prevents the error lesson described above from occurring. For

    How To Fix Windows WMI Error Event ID Ten On Windows 7

    PROBLEM:

    WMI error occurs when – ” WMI filter” is displayed without sufficient resolution. This happened while building the Windows SP1 7 DVD/ISO. There was a problem during the build process that left another WMI entry on the DVD/ISO. Because the registry is only designed to run during the DVD/ISO creation process, it cannot be run on a live system and may trigger these events.

    What is error 0x80041003?

    0x80041003 – Event 10 fantastic error in your current event viewer. According to the Event Viewer documentation, this is usually WMI (Windows Management Instrumentation). This error indicates that the event could notut be delivered directly from this filter until the problem is actually solved.

    These events are not in practice an indication that there is no problem and may be safe is ignored. However, if you want to prevent user events from being generated and need to manually remove this special WMI flag, follow the steps in this article to run this workaround. Click the DETAILS tab in the error message and resolve in XML. see. You will receive a message similar to the following:

    Event Xml:

    10
    0
    0
    2
    0
    0x80000000000000

    Application< /Channel>
    adsd-pc
    />

    //./root/CIMV2
    SELECT FROM * __InstanceModificationEvent IN 65 WHERE TargetInstance ISA “Win32_Processor ” AND TargetInstance .LoadPercentage > 99
    0x80041003
    < br> < /p>

    K How To Fix It:

    What is WMI error in Event Viewer?

    WMI error occurs when “WMI filter” is displayed without proper authorization. This happened during the Windows 7 SP1 DVD/ISO era process. Because burning can only work during a specific DVD/ISO creation process, it will not work on a real system and will therefore trigger these events.

    To solve this problem, you need to run a script to stop reporting the event with id ten. This article applies to all types of Windows 7 and Server 08 R2.

    1. In a text editor or notepad, create a new text document called workaround.vbs.
    2. Also copy and paste the following code: “workaround in .vbs”. Do NOT copy tags.

    strComputer = “.”
    Set objWMIService means GetObject(“winmgmts:” & _< br> “impersonationLevel=impersonate!” & _
    strComputer & “rootsubscription” )
    Set obj1 to objWMIService.* execquery ( – select from __eventfilter exact name = “BVTFilter” and query = “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA” “Win32_Processor” “AND TargetInstance.LoadPercentage > 99” ²″)
    For each obj1elem in obj1
    set = obj2set obj1elem.Associators_ (″__FilterToConsumerBinding″ )
    set obj3set = obj1elem.References_(″__FilterToConsumerBinding″)
    For each in obj2 obj2set
    WScript.echo “Delete object”
    WScript.echo obj2. GetObjectText_

    windows wmi error event id 10

    Download this software now and say goodbye to your computer problems.

    Id De Evento De Erro Do Windows Wmi 10
    Id De Evento De Error Wmi De Windows 10
    Id Evento Di Errore Wmi Di Windows 10
    Identifikator Sobytiya Oshibki Windows Wmi 10
    Windows Wmi 오류 이벤트 Id 10
    Windows Wmi Felhandelse Id 10
    Windows Wmi Fehlerereignis Id 10
    Windows Wmi Identyfikator Zdarzenia Bledu 10
    Windows Wmi Foutgebeurtenis Id 10
    Id D Evenement D Erreur Windows Wmi 10

    Alex Reynolds

    Некоторые пользователи Windows 7 время от времени могут сталкиваться с ошибкой 0x80041003. Ее предвестником, например, может быть зависание ПК, от которого можно избавиться лишь его перезагрузкой. В Просмотре событий вы можете найти следующую информацию по ошибке:

    Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99″ could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected

    В сегодняшней статье мы рассмотрим два метода, которые — по заявлению многих пользователей — могут разрешить ошибку 0x80041003 в Windows 7. Первый метод — применение скрипта VBS, а второй — использование средства, разработанного самой компанией Майкрософт.

    Ошибка 0x80041003 в Windows 7: методы решения

    0x80041003.png

    Метод №1 Выполнение скрипта VBS

    • Создайте на своем рабочем столе простой текстовый документ;
    • откройте документ и вставьте в него следующий скрипт:
      • strComputer = «.»Set objWMIService = GetObject(«winmgmts:» _& «{impersonationLevel=impersonate}!» _& strComputer & «rootsubscription»)Set obj1 = objWMIService.Get(«__EventFilter.Name=’BVTFilter’»)

        set obj2set = obj1.Associators_(«__FilterToConsumerBinding»)

        set obj3set = obj1.References_(«__FilterToConsumerBinding»)

        For each obj2 in obj2setWScript.echo «Deleting the object»WScript.echo obj2.GetObjectText_obj2.Delete_next

        For each obj3 in obj3setWScript.echo «Deleting the object»WScript.echo obj3.GetObjectText_obj3.Delete_next

        WScript.echo «Deleting the object»WScript.echo obj1.GetObjectText_obj1.Delete_

    • переименуйте данный документ в fixeventid10 и замените его расширение на .VBS — получиться у вас должен файл fixeventid10.vbs;
    • дважды кликните на этот файл, чтобы запустить его;
    • в Просмотре событий Windows 7 удалите все логи события 10, которые относятся к ошибке 0x80041003, чтобы те больше не мешались вам в будущем.

    Метод №2 Запуск Fix It от Майкрософт

    • Скачайте с официального сайта Майкрософт средство Fix It;
    • запустите его и следуйте указаниям на своем экране;
    • протестируйте систему и проверьте, была ли устранена ошибка 0x80041003.

    Мы надеемся, что данный материал помог вам избавиться от ошибки 0x80041003, и вы продолжили спокойно использовать Windows 7.

    Нашли опечатку? Выделите текст и нажмите Ctrl + Enter

    Сообщение об ошибке в разделе Просмотр событий -> Журналы Windows -> Приложение :

    Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99″ could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    wmi-error-300x214.png

    Ошибка WMI (код события: 10)

    Как исправить:

    1. Отключаем контроль учетных записей.
    2. Перезагружаемся в безопасный режим.
    3. Останавливаем службу Инструментарий управления Windows (Windows Management Instrumentation).
    4. Открываем папку c:windowssystem32wbemrepository. На всякий случай содержимое папки копируем в безопасное место, а затем удаляем.
    5. Перезагружаемся.
    6. При первой загрузке возможны проблемы: торможение, подвисания и т.п. Ничего страшного – перезагружаемся еще раз.
    7. Вторая загрузка должна пройти быстро и без помех. Проверяем логи – больше никаких ошибок WMI во время загрузки системы!
    8. Включаем контроль учетных записей обратно.

    В заключение следует сказать о том, что данная ошибка классифицируется в Микрософт как некритичная и не влияющая на работоспособность системы. И это действительно так, два года проработал с ней без проблем. Но если есть способ исправить, почему бы это не сделать? ))

    329998fe25fe083fb927b43cfb49b5ba.jpg Рэнди Франклин Смит (CISA, SSCP, Security MVP) имеет в своем арсенале очень полезный документ, рассказывающий о том, какие события (event IDs) обязательно должны отслеживаться в рамках обеспечения информационной безопасности Windows. В этом документе изложена крайне полезная информация, которая позволит Вам “выжать” максимум из штатной системы аудита. Мы подготовили перевод этого материала. Заинтересованных приглашаем под кат. О том, как настроить аудит, мы уже обстоятельно писали в одном из наших постов. Но из всех event id, которые встречаются в журналах событий, необходимо остановить свое внимание на нескольких критических важных. На каких именно – решать каждому. Однако Рэнди Франклин Смит предлагает сосредоточить внимание на 10 важных событиях безопасности в Windows.

    Контроллеры доменов

    Event ID — (Категория) — Описание 1) 675 или 4771 (Аудит событий входа в систему) Событие 675/4771 на контроллере домена указывает на неудачную попытку войти через Kerberos на рабочей станции с доменной учетной записью. Обычно причиной этого является несоответствующий пароль, но код ошибки указывает, почему именно аутентификация была неудачной. Таблица кодов ошибок Kerberos приведена ниже. 2) 676, или Failed 672 или 4768(Аудит событий входа в систему) Событие 676/4768 логгируется для других типов неудачной аутентификации. Таблица кодов Kerberos приведена ниже. ВНИМАНИЕ: В Windows 2003 Server событие отказа записывается как 672 вместо 676. 3) 681 или Failed 680 или 4776(Аудит событий входа в систему) Событие 681/4776 на контроллере домена указывает на неудачную попытку входа в систему через NTLM с доменной учетной записью. Код ошибки указывает, почему именно аутентификация была неудачной. Коды ошибок NTLM приведены ниже. ВНИМАНИЕ: В Windows 2003 Server событие отказа записывается как 680 вместо 681. 4) 642 или 4738 (Аудит управления учетными записями) Событие 642/4738 указывает на изменения в указанной учетной записи, такие как сброс пароля или активация деактивированной до этого учетной записи. Описание события уточняется в соответствие с типом изменения. 5) 632 или 4728; 636 или 4732; 660 или 4756(Аудит управления учетными записями) Все три события указывают на то, что указанный пользователь был добавлен в определенную группу. Обозначены Глобальная (Global), Локальная (Local) и Общая (Universal) соответственно для каждого ID. 6) 624 или 4720 (Аудит управления учетными записями) Была создана новая учетная запись пользователя 7) 644 или 4740(Аудит управления учетными записями) Учетная запись указанного пользователя была заблокирована после нескольких попыток входа 8) 517 или 1102(Аудит системных событий) Указанный пользователь очистил журнал безопасности

    Вход и выход из системы (Logon/Logoff)

    Event Id — Описание528 или 4624 — Успешный вход в систему529 или 4625 — Отказ входа в систему – Неизвестное имя пользователя или неверный пароль 530 или 4625 Отказ входа в систему – Вход в систему не был осуществлен в течение обозначенного периода времени531 или 4625 — Отказ входа в систему – Учетная запись временно деактивирована 532 или 4625 — Отказ входа в систему – Срок использования указанной учетной записи истек533 или 4625 — Отказ входа в систему – Пользователю не разрешается осуществлять вход в систему на данном компьютере 534 или 4625 или 5461 — Отказ входа в систему – Пользователь не был разрешен запрашиваемый тип входа на данном компьютере535 или 4625 — Отказ входа в систему – Срок действия пароля указанной учетной записи истек539 или 4625 — Отказ входа в систему – Учетная запись заблокирована540 или 4624 — Успешный сетевой вход в систему (Только Windows 2000, XP, 2003)

    Типы входов в систему (Logon Types)

    Тип входа в систему — Описание2 — Интерактивный (вход с клавиатуры или экрана системы)3 — Сетевой (например, подключение к общей папке на этом компьютере из любого места в сети или IIS вход — Никогда не заходил 528 на Windows Server 2000 и выше. См. событие 540)4 — Пакет (batch) (например, запланированная задача)5 — Служба (Запуск службы)7 — Разблокировка (например, необслуживаемая рабочая станция с защищенным паролем скринсейвером) 8 — NetworkCleartext (Вход с полномочиями (credentials), отправленными в виде простого текст. Часто обозначает вход в IIS с “базовой аутентификацией”) 9 — NewCredentials10 — RemoteInteractive (Терминальные службы, Удаленный рабочий стол или удаленный помощник) 11 — CachedInteractive (вход с кешированными доменными полномочиями, например, вход на рабочую станцию, которая находится не в сети)

    Коды отказов Kerberos

    Код ошибки — Причина6 — Имя пользователя не существует12 — Ограничение рабочей машины; ограничение времени входа в систему18 — Учетная запись деактивирована, заблокирована или истек срок ее действия23 — Истек срок действия пароля пользователя24 — Предварительная аутентификация не удалась; обычно причиной является неверный пароль32 — Истек срок действия заявки. Это нормальное событие, которое логгируется учетными записями компьютеров37 — Время на рабочей машины давно не синхронизировалось со временем на контроллере домена

    Коды ошибок NTLM

    Код ошибки (десятичная система) — Код ошибки (16-ричная система) — Описание 3221225572 — C0000064 — Такого имени пользователя не существует 3221225578 — C000006A — Верное имя пользователя, но неверный пароль 3221226036 — C0000234 — Учетная запись пользователя заблокирована 3221225586 — C0000072 — Учетная запись деактивирована 3221225583 — C000006F — Пользователь пытается войти в систему вне обозначенного периода времени (рабочего времени) 3221225584 — C0000070 — Ограничение рабочей станции 3221225875 — C0000193 — Истек срок действия учетной записи 3221225585 — C0000071 — Истек срок действия пароля 3221226020 — C0000224 — Пользователь должен поменять пароль при следующем входе в систему Еще раз продублируем ссылку на скачивание документа на сайте Рэнди Франклина Смита www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx. Нужно будет заполнить небольшую форму, чтобы получить к нему доступ.P.S. Хотите полностью автоматизировать работу с журналами событий? Попробуйте новую версию NetWrix Event Log Manager 4.0, которая осуществляет сбор и архивирование журналов событий, строит отчеты и генерирует оповещения в режиме реального времени. Программа собирает данные с многочисленных компьютеров сети, предупреждает Вас о критических событиях и централизованно хранит данные обо всех событиях в сжатом формате для удобства анализа архивных данных журналов. Доступна бесплатная версия программы для 10 контроллеров доменов и 100 компьютеров. Используемые источники:

    • https://gamesqa.ru/kompyutery/0x80041003-10007/
    • https://www.q2w3.ru/2011/03/24/3365/
    • https://habr.com/post/148501/

    Понравилась статья? Поделить с друзьями:

    Читайте также:

  • Wmi activity ошибка 5858
  • Wmf 1400 presto коды ошибок
  • Wmf 1100 ошибки
  • Wma 347 failed to create the wma source filter как исправить
  • Wlf 20171 ce сброс ошибок

  • 0 0 голоса
    Рейтинг статьи
    Подписаться
    Уведомить о
    guest

    0 комментариев
    Старые
    Новые Популярные
    Межтекстовые Отзывы
    Посмотреть все комментарии