How to Fix Windows WMI Error Event ID 10 in Windows 7
PROBLEM:
A WMI error occurs if a “WMI Filter” is accessed without sufficient permission. This originated in the Windows 7 SP1 DVD/ISO creation process. There was an issue in the creation process that caused a WMI registration to remain in the DVD/ISO. Since the registration is designed to work only during the DVD/ISO creation process, it fails to run on a live system and causes these events.
These events are not indicative of any issue in the system and can be safely ignored. If however you want to prevent these events from getting generated and want to remove this specific WMI registration manually, please follow the steps mentioned in this article for running the workaround script.
When you click on the DETAILS tab in the error message and select XML view , you receive a message similar to this:
Event Xml:
<Event xmlns=”https://schemas.microsoft.com/win/2004/08/events/event”>
<System>
<Provider Name=”Microsoft-Windows-WMI” Guid=”{1edeee53-0afe-4609-b846-d8c0b2075b1f}” EventSourceName=”WinMgmt” />
<EventID Qualifiers=”49152″>10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”2008-01-18T22:37:27.000Z” />
<EventRecordID>187</EventRecordID>
<Correlation />
<Execution ProcessID=”0″ ThreadID=”0″ />
<Channel>Application</Channel>
<Computer>adsd-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>
How to Fix It:
To resolve this problem, you need to run a script to stop the Event ID 10 messages. This article applies to all versions of Windows 7 and Server 2008 R2.
1. In a text editor such as notepad, create a new text document name “workaround.vbs”
2. Copy and paste the following code into “workaround.vbs”. Do NOT copy <start> and <end> tags.
<START>
strComputer = “.”
Set objWMIService = GetObject(“winmgmts:” _
& “{impersonationLevel=impersonate}!\\” _
& strComputer & “\root\subscription”)
Set obj1 = objWMIService.ExecQuery(“select * from __eventfilter where name=’BVTFilter’ and query=’SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “”Win32_Processor”” AND TargetInstance.LoadPercentage > 99′”)
For Each obj1elem in obj1
set obj2set = obj1elem.Associators_(“__FilterToConsumerBinding”)
set obj3set = obj1elem.References_(“__FilterToConsumerBinding”)
For each obj2 in obj2set
WScript.echo “Deleting the object”
WScript.echo obj2.GetObjectText_
obj2.Delete_
next
For each obj3 in obj3set
WScript.echo “Deleting the object”
WScript.echo obj3.GetObjectText_
obj3.Delete_
next
WScript.echo “Deleting the object”
WScript.echo obj1elem.GetObjectText_
obj1elem.Delete_
Next
<END>
3. Save and close notepad.
4. Open an “elevated command prompt” (Start/Programs and RIGHT click on command prompt –choose “run as administrator”.
5. Changed Directory (CD x.x) to the location of “workaround.vbs” text document
6. Run script.
7. After you run this script, the Event ID 10 messages stop appearing in the Application log. However, you have to manually clear any previous Event ID 10 messages