Event ID 41 WinMgmt Warning 5 times per minute

[shorty545]

I am receiving 5 different errors every minute in the application log of the event viewer for my windows 2000 server. The errors are all Event ID 41 and the source is WinMgmt.

The errors are as follows:

WMI ADAP was unable to create object index 5136 for Performance Library TermService because no value was found in the 009 subkey


WMI ADAP was unable to create object index 3006 for Performance Library NTDS because no value was found in the 009 subkey

WMI ADAP was unable to create object index 9712 for Performance Library FileReplicaSet because no value was found in the 009 subkey

WMI ADAP was unable to create object index 9896 for Performance Library FileReplicaConn because no value was found in the 009 subkey

WMI ADAP was unable to create object index 6256 for Performance Library DNS because no value was found in the 009 subkey

I can't seem to find any info on these particular errors, so if anyone can help I would gratly appreciate it.

Thanks,

Jeremy

 

[itsp1965]

Usually errors like this are generated if you have disabled certain services in order to harden your server. This usually generates perf monitor application log errors (damned if you do and damned if you don't). Try running the resource kit tool EXCTRLST which will list all services with associated counters and you can disable them. Delete the application log and then check to see if they return.

 

[shorty545]

I used the EXCTRLST and found the 5 performance counters that I am having problems with. The interesting thing is that when I look at the "Counter ID Range" the numbers for these services are followed by a *.

For example DNS has a "Counter ID Range: 6256* to: 6380*"
and a "Help ID Range: 6257* to: 6381*"

These are the only ones that have an * following the numbers.

Any thoughts? Should I just disable these counters? I'm not sure what they are used for.

 

[itsp1965]

Don't know off hand, but I have used perfmon without any errors after applying changes so I think it is pretty safe to disable the counters.

 

[shorty545]

Solved the problem.

What I did if anyone is interested is:

Unload the 5 performance counters:
unlodctr DNS
unlodctr NTDS
unlodctr TermService
unlodctr FileReplicaSet
unlodctr FileReplicaConn

Then reloaded the 5 performance counters:
lodctr dnsperf.ini
lodctr ntdsctrs.ini
lodctr tslabels.ini
lodctr ntfrsrep.ini
lodctr ntfrscon.ini

Don't know how these counters got corrupt, but this seemed to solve the problem for now.

Thanks for your help