Windows Vista Forums

Event Viewer=Error Codes

  1. #1



    Banned
    Join Date : Nov 2010
    Perth Australia WA
    Posts : 19
    Vista Business 32bit SP2
    Local Time: 02:20 PM
    australia au west australia

    Event Viewer=Error Codes

    Hi I seem to have a few errors in my Event Viewer.

    I am here>Event Viewer (Local)>Window Logs>Applications.
    I shall process one error code at a time.

    Error>WMI>10>None?

    Log Name: Application
    Source: Microsoft-Windows-WMI
    Date: 3/12/2010 8:32:22 AM
    Event ID: 10
    Task Category: None
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: Charlie Brown
    Description:
    Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
    <EventID Qualifiers="49152">10</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-12-03T00:32:22.000Z" />
    <EventRecordID>96981</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Charlie Brown-PC</Computer>
    <Security />
    </System>
    <EventData>
    <Data>//./root/CIMV2</Data>
    <Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage &gt; 99</Data>
    <Data>0x80041003</Data>
    </EventData>
    </Event>


    Coments.

    This item seems to be the problem.
    TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Is this a Security privileges issue?

    As I had a look here.WMI MGMT-(Console Root)


    Right click WMIMGMT>Properties>Root>Security

    Authenticated Users
    Local Service
    Network Services
    Administrators Charlie Brown



    None of these services or administrator have inherited privliges?
    Is that the reason for the WMI error code 10
    ?

    Example.

    Type>Allow

    Name>Administrator Charlie Brown

    Permissions>Special

    Inherited From>Not Inherited?

    Apply To>This Names Space And Sub Names Space



    Thanks.

      My System SpecsSystem Spec

  2.   


  3. #2
    Lottiemansion's Avatar

    Senior Member



    Join Date : Sep 2010
    Sheffield
    Posts : 1,884
    Vista Home premium 32 bit (SP2 plus)
    Local Time: 07:20 AM
    uk uk yorkshire

     

    Re: Event Viewer=Error Codes

    Hi,

    Run this script from the uploaded file by, run as an administrator: -

    An extract from: - Event ID 10 is logged in the Application log after you install Windows Vista Service Pack 1 or Windows Server 2008

    You will need to delete the old referrences in the event log.

      My System SpecsSystem Spec

  4. #3



    Account Suspended

    Join Date : Aug 2010
    Laytonsville, Maryland, USA
    Posts : 2,212
    Vista Business 32bit SP2 (build 6002)
    Local Time: 01:20 AM
    usa us maryland

     

    Re: Event Viewer=Error Codes

    Hi Conrad,

    Welcome to Vista Forums!

    The above procedure does seem applicable; however, I notice you have SP2. Has this been a problem since you installed SP1 and you just noticed or is this something new that occurred or did you just do a massive update installation including both service packs? Before you try this procedure, create a System Restore point AND backup the registry (just to be on the safe side in case this makes things worse - I'm a bit concerned that SP2 is installed and yet you still have this issue and I'm not completely certain how this will affect the system given all the subsequent updates). I'd give it a try and then test your system thoroughly (not just for that error message but to make sure everything else works as it should). Be prepared to restore if you encounter any problems.

    If that doesn't work, try the following (which also has risks, so take the same System Restore and Registry Backup precautions first):

    Boot into safe mode. First, open services and stop the Windows Management Instrumentation Service. Take ownership and give yourself full rights of the folder and the contents of the folder "C:\Windows\System32\wbem\Repository." Copy the entire Repository folder and make a backup folder called Repository-old in the wbem directory. Go to the Repository folder and delete the contents of the folder - but not the folder itself. Reboot. When you boot into Vista, you might notice a half dozen or so application errors...it's OK.

    Reboot again, and Event ID 10 should be gone, along with the afore mentioned application errors.

    If this doesn't work or causes more or different problems, then replace the Repository folder with the Repository-old folder you saved before you started and reboot and things should return to normal (though the Event 10 problem will not yet have been solved). If you can't get in to do that, then do the System Restore to get back to how it was before you started.

    I hope this helps. If not, post back and we'll examine some other options after further research.

    Good luck!

    Last edited by Lorien; 03 Dec 2010 at 09:24 AM. Reason: clarification
      My System SpecsSystem Spec

  5. #4



    Banned
    Join Date : Nov 2010
    Perth Australia WA
    Posts : 19
    Vista Business 32bit SP2
    Local Time: 02:20 PM
    australia au west australia

      Thread Starter

    Re: Event Viewer=Error Codes

    Quote Originally Posted by Lottiemansion View Post
    Hi,

    Run this script from the uploaded file by, run as an administrator: -

    An extract from: - Event ID 10 is logged in the Application log after you install Windows Vista Service Pack 1 or Windows Server 2008

    You will need to delete the old referrences in the event log.
    Ok its harmless error code.

    Thanks.

      My System SpecsSystem Spec

  6. #5



    Banned
    Join Date : Nov 2010
    Perth Australia WA
    Posts : 19
    Vista Business 32bit SP2
    Local Time: 02:20 PM
    australia au west australia

      Thread Starter

    Re: Event Viewer=Error Codes

    Quote Originally Posted by Lorien View Post
    Hi Conrad,

    Welcome to Vista Forums!

    The above procedure does seem applicable; however, I notice you have SP2. Has this been a problem since you installed SP1 and you just noticed or is this something new that occurred or did you just do a massive update installation including both service packs? Before you try this procedure, create a System Restore point AND backup the registry (just to be on the safe side in case this makes things worse - I'm a bit concerned that SP2 is installed and yet you still have this issue and I'm not completely certain how this will affect the system given all the subsequent updates). I'd give it a try and then test your system thoroughly (not just for that error message but to make sure everything else works as it should). Be prepared to restore if you encounter any problems.

    If that doesn't work, try the following (which also has risks, so take the same System Restore and Registry Backup precautions first):

    Boot into safe mode. First, open services and stop the Windows Management Instrumentation Service. Take ownership and give yourself full rights of the folder and the contents of the folder "C:\Windows\System32\wbem\Repository." Copy the entire Repository folder and make a backup folder called Repository-old in the wbem directory. Go to the Repository folder and delete the contents of the folder - but not the folder itself. Reboot. When you boot into Vista, you might notice a half dozen or so application errors...it's OK.

    Reboot again, and Event ID 10 should be gone, along with the afore mentioned application errors.

    If this doesn't work or causes more or different problems, then replace the Repository folder with the Repository-old folder you saved before you started and reboot and things should return to normal (though the Event 10 problem will not yet have been solved). If you can't get in to do that, then do the System Restore to get back to how it was before you started.

    I hope this helps. If not, post back and we'll examine some other options after further research.

    Good luck!
    That WMI error code 10 was in SP1 also.

    Thanks.

      My System SpecsSystem Spec

  7. #6
    Lottiemansion's Avatar

    Senior Member



    Join Date : Sep 2010
    Sheffield
    Posts : 1,884
    Vista Home premium 32 bit (SP2 plus)
    Local Time: 07:20 AM
    uk uk yorkshire

     

    Re: Event Viewer=Error Codes

    Hi & thank you for the reply.

    So where does that leave you?

    Do you need further assistance or are you sorted? You have left me

      My System SpecsSystem Spec

  8. #7



    Banned
    Join Date : Nov 2010
    Perth Australia WA
    Posts : 19
    Vista Business 32bit SP2
    Local Time: 02:20 PM
    australia au west australia

      Thread Starter

    Re: Event Viewer=Error Codes

    Ok thanks for the info on WMI Error code 10.


    This Error Code 1530 was in SP1 also. Details 1 user registry handles leaked.
    Now SP2 1530 has increased. Details 17 user registry handles leaked.

    Warning 1/12/2010 11:02:03 PM User Profile Service 1530 None

    Log Name: Application
    Source: Microsoft-Windows-User Profiles Service
    Date: 1/12/2010 11:02:03 PM
    Event ID: 1530
    Task Category: None
    Level: Warning
    Keywords: Classic
    User: SYSTEM
    Computer: Charlie Brown-PC
    Description:
    Windows detected your registry file is still in use by other applications or services.
    The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

    DETAIL -
    17 user registry handles leaked from \Registry\User\S-1-5-21-1211916979-2642572776-351638372-1003:
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\My
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\CA
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\SmartCardRoot
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\Root
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\TrustedPeople
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\trust
    Process 1600 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    Process 1600 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\Disallowed

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" EventSourceName="profsvc" />
    <EventID Qualifiers="32768">1530</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-12-01T15:02:03.000Z" />
    <EventRecordID>96897</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Charlie Brown-PC</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    <EventData Name="EVENT_HIVE_LEAK">
    <Data Name="Detail">17 user registry handles leaked from \Registry\User\S-1-5-21-1211916979-2642572776-351638372-1003:
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\My
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\CA
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\SmartCardRoot
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\Root
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\TrustedPeople
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\trust
    Process 1600 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    Process 1600 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
    Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\Disallowed
    </Data>
    </EventData>
    </Event>


    This Error Code 1530 seems aggressive in action.

      My System SpecsSystem Spec

  9. #8
    Lottiemansion's Avatar

    Senior Member



    Join Date : Sep 2010
    Sheffield
    Posts : 1,884
    Vista Home premium 32 bit (SP2 plus)
    Local Time: 07:20 AM
    uk uk yorkshire

     

    Re: Event Viewer=Error Codes

      My System SpecsSystem Spec

  10. #9



    Banned
    Join Date : Nov 2010
    Perth Australia WA
    Posts : 19
    Vista Business 32bit SP2
    Local Time: 02:20 PM
    australia au west australia

      Thread Starter

    Re: Event Viewer=Error Codes

    Quote Originally Posted by Lottiemansion View Post
    Hi & thank you for the reply.

    So where does that leave you?

    Do you need further assistance or are you sorted? You have left me
    Ok thanks for the information to repair Error Code WMI 10.
    At the moment i will not do anything.
    As its not to serious.
    There is 9 error codes i want to get sorted in Event Viewer.
    I have posted the second one>Error Code 1530
    When i can gather all the information about the Error Codes.
    I will do the most serious one first.

    Till then be patient thanks.

    Last edited by Conrod; 04 Dec 2010 at 06:05 AM.
      My System SpecsSystem Spec

  11. #10



    Banned
    Join Date : Nov 2010
    Perth Australia WA
    Posts : 19
    Vista Business 32bit SP2
    Local Time: 02:20 PM
    australia au west australia

      Thread Starter

    Re: Event Viewer=Error Codes

    Ok well that's interesting Microsoft Quotes >> Note: Event ID 1530 is logged as a Warning event. However, this behavior is expected. Usually, you can safely ignore this event.
    According to Microsoft it's ok.
    Sort makes me wonder why? though.
    Must be like crossing live electrical wires>causes a spark'
    Hence user application in use? causes 1530 error code.
    Would a restore point? fix Error Code 1530
    Okay well at he moment i shall leave that as it's not serious.

      My System SpecsSystem Spec

Page 1 of 3 123 LastLast

Event Viewer=Error Codes
Similar Threads
Thread Forum
Event Viewer Error Help Please General Discussion
Event Viewer Error Vista General
Event Viewer Error Vista General
Event viewer error Vista performance & maintenance
Event viewer error Vista performance & maintenance