Thursday, December 20, 2007

WQL Queries Fail Against Valid Performance Counters

I was trying to run WQL queries against remote Windows systems to read things such as the current IIS connections. The query looks like the following:

SELECT CurrentConnections FROM Win32_PerfFormattedData_W3SVC_WebService

I kept getting an 0x80041010 ("Invalid Class") error from the remote DCOM objects even though the performance objects clearly were visible and monitorable in perfmon. This error code means that either:

- You are trying to query a non-existant performance object;
- The performance object exists and has not been registered; or
- The performance object is not registered properly.

I went through a number of troubleshooting steps, including jacking around with dcomcnfg (launch/activation permissions, default authentication levels), re-registering performance counter DLLs, etc. and nothing helped. Finally, executing the following command on the target servers proved to be the key:

winmgmt /clearadap (thanks to this site for advising about this clear command)
winmgmt /resyncperf

This tool fixes invalid registry entries around the performance DLLs and fixed all of my WQL problems.

Some other steps that may help:

If the performance objects haven't been registered, install the Windows Server Support Tools, and run exctrlst. This tool allows you to uncheck and re-check the registered performance objects and may help with the above. If you use this tool on any classes, follow the execution with a call to winmgmt as above.

To rebuild all Performance counters including extensible and third party counters in Windows Server 2003, type the following commands at a command prompt. Press ENTER after each command.

cd \%windir%\system32
lodctr /R

Additional WMI Troubleshooting Resources

WMI Troubleshooting (MSDN)

WMI Isn't Working! (TechNet--good troubleshooting tips)

Scriptomatic 2.0: This tool shows you a list of all registered WMI classes on the machine with the WQL format class names.

WMI Explorer: Another good tool for exploring registered WMI classes.