Hi I seem to have a few errors in my Event Viewer.

I am here>Event Viewer (Local)>Window Logs>Applications.
I shall process one error code at a time.

Error>WMI>10>None?

Log Name: Application
Source: Microsoft-Windows-WMI
Date: 3/12/2010 8:32:22 AM
Event ID: 10
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Charlie Brown
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
<EventID Qualifiers="49152">10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-12-03T00:32:22.000Z" />
<EventRecordID>96981</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Charlie Brown-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage &gt; 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>


Coments.

This item seems to be the problem.
TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Is this a Security privileges issue?

As I had a look here.WMI MGMT-(Console Root)

Right click WMIMGMT>Properties>Root>Security

Authenticated Users
Local Service
Network Services
Administrators Charlie Brown


None of these services or administrator have inherited privliges?
Is that the reason for the WMI error code 10?

Example.

Type>Allow

Name>Administrator Charlie Brown

Permissions>Special

Inherited From>Not Inherited?



Apply To>This Names Space And Sub Names Space


Thanks.

Originally Posted by Lottiemansion

Hi,

Run this script from the uploaded file by, run as an administrator: -

An extract from: - Event ID 10 is logged in the Application log after you install Windows Vista Service Pack 1 or Windows Server 2008

You will need to delete the old referrences in the event log.

Ok its harmless error code.

Thanks.

Originally Posted by Lorien

Hi Conrad,

Welcome to Vista Forums!

The above procedure does seem applicable; however, I notice you have SP2. Has this been a problem since you installed SP1 and you just noticed or is this something new that occurred or did you just do a massive update installation including both service packs? Before you try this procedure, create a System Restore point AND backup the registry (just to be on the safe side in case this makes things worse - I'm a bit concerned that SP2 is installed and yet you still have this issue and I'm not completely certain how this will affect the system given all the subsequent updates). I'd give it a try and then test your system thoroughly (not just for that error message but to make sure everything else works as it should). Be prepared to restore if you encounter any problems.

If that doesn't work, try the following (which also has risks, so take the same System Restore and Registry Backup precautions first):

Boot into safe mode. First, open services and stop the Windows Management Instrumentation Service. Take ownership and give yourself full rights of the folder and the contents of the folder "C:\Windows\System32\wbem\Repository." Copy the entire Repository folder and make a backup folder called Repository-old in the wbem directory. Go to the Repository folder and delete the contents of the folder - but not the folder itself. Reboot. When you boot into Vista, you might notice a half dozen or so application errors...it's OK.

Reboot again, and Event ID 10 should be gone, along with the afore mentioned application errors.

If this doesn't work or causes more or different problems, then replace the Repository folder with the Repository-old folder you saved before you started and reboot and things should return to normal (though the Event 10 problem will not yet have been solved). If you can't get in to do that, then do the System Restore to get back to how it was before you started.

I hope this helps. If not, post back and we'll examine some other options after further research.

Good luck!

That WMI error code 10 was in SP1 also.

Thanks.

Ok thanks for the info on WMI Error code 10.


This Error Code 1530 was in SP1 also. Details 1 user registry handles leaked.
Now SP2 1530 has increased. Details 17 user registry handles leaked.

Warning 1/12/2010 11:02:03 PM User Profile Service 1530 None

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 1/12/2010 11:02:03 PM
Event ID: 1530
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: Charlie Brown-PC
Description:
Windows detected your registry file is still in use by other applications or services.
The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
17 user registry handles leaked from \Registry\User\S-1-5-21-1211916979-2642572776-351638372-1003:
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\My
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\CA
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\Root
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\TrustedPeople
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\trust
Process 1600 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1600 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\Disallowed

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" EventSourceName="profsvc" />
<EventID Qualifiers="32768">1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-12-01T15:02:03.000Z" />
<EventRecordID>96897</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Charlie Brown-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">17 user registry handles leaked from \Registry\User\S-1-5-21-1211916979-2642572776-351638372-1003:
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\My
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\CA
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\Root
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\TrustedPeople
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\trust
Process 1600 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1600 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Policies\Microsoft\SystemCertificates
Process 2848 (\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1211916979-2642572776-351638372-1003\Software\Microsoft\SystemCertificates\Disallowed
</Data>
</EventData>
</Event>

This Error Code 1530 seems aggressive in action.

Originally Posted by Lottiemansion

Hi,

Look through this thread: -

Warning - Event ID 1530

this: -

Event ID: 1530 may be logged in the Application log on a Windows 7-based or Windows Vista-based client computer

& this: -

Stop, Delete WLIDSVC.EXE and WLIDSVCM.EXE

Ok well that's interesting Microsoft Quotes >> Note: Event ID 1530 is logged as a Warning event. However, this behavior is expected. Usually, you can safely ignore this event.
According to Microsoft it's ok.
Sort makes me wonder why? though.
Must be like crossing live electrical wires>causes a spark'
Hence user application in use? causes 1530 error code.
Would a restore point? fix Error Code 1530
Okay well at he moment i shall leave that as it's not serious.