Things seem to be working OK but errors in Application Event log

Our client came to us with failed backups. Upon investigation we found that
the backup sems to have worked and verified but right at the end there was a
message saying CWMI.ExecQuery failed (0x80040154), GetResultsFromEvents
failed.

We were investigating this and discovered that from time to time a Disk bad
block was being reported (amongst other things... see below). We have copied
of the disk onto a new disk and all is working again (apparently). I have
not tested backup yet, but have a horrible feeling it will fail again,
because of an apparent linkage with the three errors shown below, which
started to appear at the same time as the backup started to fail. (I suspect
there was something kind of important in that bad block!)

MSExchangeSA Event_ID 9098
The MAD Monitoring thread was unable to read its configuration from the DS,
error '0x80040154'.

Userenv Event_ID 1065
Windows cannot perform filter check for Group Policy object
CN={CA92866C-65E0-419A-8E8F-FDFA2E0D2E81},CN=Policies,CN=System,DC=soi,DC=local.
Group Policy processing aborted.

Userenv Event_ID 1030
Windows cannot query for the list of Group Policy objects. Check the event
log for possible messages previously logged by the policy engine that
describes the reason for this.


The client only has 5 backup tapes and overwrote all of them before
reporting the problem, so they do not have a definitely good backup.

We could resolve the problem by completely reinstalling the server, of
course, but maybe there is another way. Any help or advise would be much
appreciated.

Pete Smith

 

Hi Pete:

Have you looked up the errors on www.eventid.net? you will need the event
id and the source.

Larry

 

Hi Larry,
Thanks for the help, we were looking there but it takes a
long time and as usual it's about the last thing you look at! Customer was
jumping up and down because they had no backup. Anyway, one of those
eventid.net comments eventually pointed us more or less the right way and we
got it sorted. It was WMI causing the grief. It obviously got broken when
the disk went. This was the fix:

for %i in (*.dll) do RegSvr32 -s %i
in the C:\WINDOWS\system32\wbem directory, as per:

http://www.microsoft.com/technet/scriptcenter/topics/help/wmi.mspx#EQFAC


Pete