Windows 10: Failed to start service WMS - Error Id 1010

TMSharks, I can't believe it, you have described to the letter exactly where I have come from. All the points you highlight are on my system right down to the existence of the netmon.exe file which I was looking at being very suspicious at first but, it "seems" harmless all beit it shouldn't by rights even be there.

I will run the diag tool you mention above and maybe we could compare lists to see if there are even more comparisons. I suppose it is just possible that it could be case of what is loaded/running on our systems which is causing a "perfect storm"?

 

Well...........here is one of my printouts from the WMI Diag prog. I think this may need some detective work to figure out what is going on, apart from the fact that 1 machine is 100% not working correctly. ??

 

Ed, I am showing WmiPrvSE.exe in all the places you highlighted as well.

Don't make no sense...................

 

Yep, this is crazy. Exactly the same errors here.



Honestly I'm kind of befuddled by this. There's no way we're the first and only people to have ended the WmiPrvSE.exe in Task Manager, yet there's absolutely no info that I can find anywhere on this issue.

It gets even weirder with the WMS (display name WMI) service, which doesn't exist on the normal reference PC I checked, as well as the C:/Windows/wmi folder that also does not exist on that normal PC. Did ending the process create a new service entirely? At this point, I honestly don't know.

The most likely fix for this would be a complete reset of the PC. I've already tried a repair using the Windows 10 setup tool (in order to keep all my files), but that didn't fix anything. I'm just reluctant about that, as it'd be a lot of effort to get everything set up again as I don't have a backup from before this issue got started.

Looking through the event viewer, this problem has apparently been going on for over a week. Only reason I figured it out is because I tried to install the Battle.net launcher by Blizzard Entertainment for some videogames, which wouldn't install. After going to System Information to find the details required in a support ticket, I found that WMI wasn't working, leading me to here.

Besides this one failed installation, I haven't found any direct issues that this problem has caused. All programs, apart from obviously System Information and this Battle.net, seem to work just fine. I've installed other programs in the meantime as well, which was completely without any issues. pdoth, have you experienced any loss in functionality because of this issue yet?

 

I can't be absolutely certain but it would appear that the first instance I can find of the 1010 error appearing was on 22/01/18 after several hours use. I'm trying to think back if that was the date/time I first noticed the high CPU use and stopped the service ?

The problem is my event log only starts 22/01/18 but has 5,575 events logged.

From Event Viewer 'Admin' log
15:19 event ID 7024 - "The WMS service terminated with the following service-specific error: The system cannot find the path specified."
15:21 - "The WMI service terminated with the following service-specific error: The system cannot find the path specified."

From Event Viewer 'Windows System log'
15:24 event 1010 - "Failed to start service WMS. Program C:\Windows\wmi\WmiPrvSE.exe couldn't be launched. CreateProcess() failed: The system cannot find the file specified."

 

To answer your last question TMSharks, I don't 'think' there are any major issues that I have become aware of as a result on the situation but, from experience simple problems seem to have a habit of escalating fairly quickly into major system shutdowns unless they are addressed as soon as you find them.

You can bet your life that something will go wrong at the exact time you need it most.

 

Sounds like nothing seriously bad is going on, so with no easy or well-documented fixes at hand, all you can do is to keep an eye on things, and report back here if stuff goes weird in a hurry. This is starting to remind me of the well-known DCOM errors that show up in Event Viewer. They keep recurring but Windows keeps chugging along and working anyway. I'm starting to think that you should either decide to go with the current flow, or perhaps try an in-place upgrade repair install to see if that helps.
HTH,
--Ed--

 

Funny you should mention the famous (or infamous more like it) DCOM error. I'm assuming you are referring to this one:

ID 10010 - "The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout."

ID 10016 - "The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool."

Been there, done that, still got it.......... I think. Problem is, with this new error currently recording over 7,700 events its hard to find it mentioned anywhere in the log.

I wonder if there is a connection? The 'problem' is as I see it, it can't be right for this situation to just continue ad infinitum. It makes checking the Event log virtually impossible. With the number of machines running Windows world wide I still find it unbelievable that only 2 users are reporting this, plus, an error code reported which is not correct.

Perhaps you are right. The best approach maybe to just give in and start again. I'm busily backing up everything I can find prior to a fresh start. I have tried a new UAC, no change.

I will keep this thread open for the time being, just in case, and will update as and when there is any change.

Thanks for all your help this far............. you never know *Smile

 

I would try an in-place upgrade repair install, before taking the clean install route. Something bizarre (and apparently neither totally unique nor completely endemic) is going on. I wish I could offer more insight, but this one's going to take some work to puzzle through. Please keep us posted.
Thanks,
--Ed--

 

Not sure if you guys have seen the following links or if it's applicable to your issue, but might be worth looking into. This stuff looks pretty involved, so please do your homework on it *Smile

WMI: Missing or Failing WMI Providers or Invalid WMI Class | Ask the Performance Team Blog

WMI: Repository Corruption, or Not? | Ask the Performance Team Blog

 

Zounds! No kidding about the homework, Eagle51. Nice find, though. Thanks for sharing!
--Ed--

 

Have you gotten rid of that netmon.exe yet? That COULD be the source of your problem. You did say they were in the same folder , correct? Here's what I found about it :
"netmon.exe is a process which is registered mass-mailing worm. "This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open its hostile attachment. ". The worm has it's own SMTP mailing engine which means it gathers E-mails from your local computer and re-distributes itself." (Oh, that's from process library btw.)

A very thorough Virus scan may aid you.

 

Oh, Oh, that was something I didn't want to hear. When I looked this up originally I thought it was:

"A packet analyzer from Microsoft, NetMon.exe tracks packets sent and received through a Windows network. It is used for troubleshooting issues and routing problems. In 2014, Microsoft replaced Network Monitor with Microsoft Message Analyzer. Founded in 1975, Microsoft's flagship product is the Windows operating system, which is installed on over 90% of workstations worldwide."


Before I say any more I had better go and do some more homework on it.


Where did you get this from

indianacarnie

 

Something definitely screwy going on here. I tried Eagle51's suggestion but got back a - "this file does not exist" from the results. I wonder if things have changed since it was written in 2014?

Since my last post I have been trying a few things out which "appear" to have altered the situation. Following indianacarnie's pointer I looked again at the netmon.exe file at C/Windows/wmi. I have always "felt" this was somehow peculiar so, I changed the name and re-booted. Low and behold, no error messages. Not surprising really I suppose as what ever was calling it could now no longer find it, but, you would have thought even this would have produced another error message by it self? Oh, but I do have the DCOM error back !

I have also been looking at my other systems which is pretty much identical to my main one apart from the amount of software installed.

There is another difference though, this pc does not have the latest update KB4056892 (cumulative update for v1709) installed. To my surprise it also does not have a C/Windows/wmi file present. So, I am in the process of downloading and installing this and will see if the missing file magically appears (also of course if the error appears along with it).

In the meantime I am continuing to run with the netmon file renamed and will be looking for any issues as a result.

 

From Process Library, they're usually pretty good. Been using them for information for years.

netmon.exe - What is netmon.exe?