WMI Unhealthy on 2008R2 Domain Controllers - WBEM_E_QUOTA_VIOLATION

Posted by Ahmed Nabil In | 0 comments»
Windows Management Instrumentation (WMI) is a key core windows management technology. It provides a consistent approach to carry day to day management operations with programming or scripting languages.

I recently started getting WMI failures on daily basis on my 2008R2 domain controllers accompanied by several scripts failure and DNS performance degradation.

Also I noticed that the Configuration Manager SCCM evaluation rules on this domain controller failed and SCCM is reporting errors. The policy Request date on the SCCM is few hours back and it will never report back to SCCM till the DC/Server is rebooted.

Troubleshooting Steps:

  1. I started by running the WMI diagnosis tool from http://www.microsoft.com/en-us/download/details.aspx?id=7684
  2. The WMI diag log file reported WBEM_E_QUOTA_VIOLATION as follows:
.5265 16:34:02 (0) ** 981 error(s) 0x8004106C - (WBEM_E_QUOTA_VIOLATION) WMI is taking up too much memory
.5266 16:34:02 (0) ** => This error is typically due to the following major reasons:
.5267 16:34:02 (0) **    - The requested WMI operation is extremely costly in terms of resources and
.5268 16:34:02 (0) **      the WMI provider handling this operation has exceeded the authorized limits.

 3.  tried later to check whether the basic WMI function is working by running the below test:

1.     From Elevated Command Prompt type Run wbemtest, connect the namespace root\cimv2
2.     Click Query… and enter the following query “Select * from Win32_ComputerSystem”
3.     This test failed and the following error was reported.

0x80041017 Facility: WMI  Description: Invalid Query

1   4. I tried fixing and rebuilding the WMI Repository as follows:

  • Disable and stop the WMI service. sc config winmgmt start= disabled and net stop winmgmt
  • At a command prompt (cmd), change to the WBEM folder. cd %windir%\system32\wbem
  • Rename the repository folder. rename repository repository.old
  • Re-enable the WMI service. sc config winmgmt start= auto
  • Run the following command to manually recompile all of the default WMI .mof files and .mfl files
  • cd %windir%\system32\wbem
  • for /f %s in ('dir /b *.mof *.mfl') do mofcomp %s

The only way to get around this issue was to manually reboot the server. After Rebooting the server, it works for  few hours without a problem then the failures start again. One thing else to be noticed is that the WMIPRVSE.exe process is consuming huge amount of memory during this problem.

Resolution Steps:

  1. Increased the "MemoryPerHost” value to 1 GB (1073741824), by default it should be 536870912 which means 512 MB as per attached article

2. Install the following WMI fixes

KB Article Number (s) : 2705357  
Language: All (Global)  
Platform: x64  

KB Article Number (s) : 2692929  
Language: All (Global)  
Platform: x64  

KB Article Number (s) : 2617858  
Language: All (Global)  
Platform: x64  

KB Article Number (s) : 2465990  
Language: All (Global)  
Platform: x64  

KB Article Number (s) : 2492536  
Language: All (Global)  
Platform: x64  

For a list of suggested WMI hotfixes on different windows platform, please check this blog which is maintained and updated regularly.

AD CS not configured for Revocation checking of all certificates

Posted by Ahmed Nabil In | 1 comments»
Recently the SCOM server (One of your best friends on the network) started reporting the error "AD CS not configured for Revocation checking of all certificates", SCOM reported Event 128 as a warning

Event 128 is normally reported when someone try to use Certificate Request with all time-valid CA certificates to request a certificate. However y default CA doesn't support such request and event 128 gets reported.

After checking this issue and consulting Microsoft tech support, this issue will normally occur only after renewal of CA certificate. When the CA certificate is renewed, the OCSP Response signing certificate used for validation of existing certificates must still be signed by the CA certificate that was used to issue the existing certificates and new CA certificate. However by default CA doesn't support the renewal of OCSP Response signing certificate by using a previous CA certificate.

This issue/behavior can be fixed as follows:

  1. From elevated CMD run the certutil -setreg ca\UseDefinedCACertInRequest 1
  2. Restart the CA services

This command will enable the CA support for certificate request signed by old certificate. If the OCSP is not renewed, you need to go ahead and renew it as per the following articles