Auditor Help: Testing and Correcting WMI Hanging

The WMI repository on some systems may become corrupt, causing an attempted connection to the system to hang. If a hang occurs, the software attempting the connection (Auditor or wbemtest) must be killed using the Task Manager. The following instructions describe testing for this situation.

Test WMI on a target machine using the wbemtest.exe utility, which usually comes with WMI installation. Search for it on the disk, generally in the windows/system32/wbem directory where the WMI installation is located.

  1. From a command prompt, run wbemtest.exe.
  2. Press the Connect button.
  3. In the server/namespace field, enter the server name using UNC path, followed by root\cimv2.
    For example: \\servername\root\cimv2 or, via IP, \\192.168.0.172\root\cimv2
  4. For the connection field, use defaults (Using: IWbemLocator(Namespaces) and Returning: IWbemServices).
  5. Enter credentials using domain\account format.
  6. Leave the Authority field blank (defaults to NTLMdomain).
  7. Leave the Locale field blank.
  8. Impersonation level - set to Impersonate.
  9. Authentication level - set to Connection.
  10. Press Connect.
  11. If everything is ok, the next dialog box contains buttons enabled.
  12. Press the Enum Classes button to see a list of the WMI classes.
  13. Click through, leaving Superclass Name field empty.
  14. If there is a problem with credentials, a dialog appears indicating the access problem.
  15. If there is a major problem with WMI, the utility will hang. Bring up Task Manager and look at the memory delta to verify.
  16. If there is a problem with WMI, go to the physical machine and try to run wbemtest locally. (No need to enter server name - just enter root\CIMv2.)
  17. If WMI is problematic, wbemtest tool will hang.
  18. If WMI is a problem, try to stop and restart the service. If the service does not respond to restart, rebooting may fix issue. If not, the WMI repository may be damaged - in this case, follow instructions in the following MSDN article:
     http://whidbey.msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/reinstalling_wmi.asp.