Windows 10: Repeated WMI Provider Host Application Error 1000

Hi -about two weeks after starting to use a new pc I started to get regular (1 or 2 a day) WMI Provider Host Application Errors. It does not seem to have an impact on my using the computer (so far).

Most online references to this error are in the context of it consuming a large percentage of the CPU time or older references to Windows Server machines.

I would appreciate any help with this - do I even need to worry about it? Reliability Monitor classifies these errors as critical events.

I am running Windows 10 Pro, up to date with updates. I have tried sfc /scannow - no integrity violations found and dism /Online /Cleanup-Image /Scanhealth with no component store corruption detected.

Thanks.

Here are the details from Event ViewerFaulting application name: wmiprvse.exe, version: 10.0.14393.0, time stamp: 0x57899ab2
Faulting module name: ntdll.dll, version: 10.0.14393.479, time stamp: 0x5825887f
Exception code: 0xc0000374
Fault offset: 0x00000000000f8283
Faulting process id: 0x1070
Faulting application start time: 0x01d292eaea0f91c9
Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 7e593b99-2058-43c0-b87b-f944763ade4f
Faulting package full name:
Faulting package-relative application ID:

:)

 

Repeated WMI Provider Host Application Error 1000

I just installed the Creator's update of Windows 10. I then rebooted twice and got the WMI error both times. So, since the latest update (KB4015217) replaced all the system files, you would think it's NOT the system files. However, a clean boot still
gets the problem which tells you it's NOT a non-Microsoft application problem. So what could the problem be?

It might be worth finding out if the ntdll.dll file was replaced in this Windows 10 upgrade since it is the file that has the problem. Was it?

Stu

 

Repeated WMI Provider Host Application Error 1000

P.S. I tried a Clean Boot where I used MSconfig to disable all non-Microsoft services and used Task Manager to disable all startup programs. It did NOT help. I still got the error on each reboot.

I also tried rebooting into Safe Mode with Networking. It did NOT cause the error. Of course, the Winmgmt service was not running, explaining why there was no problem. So I started Winmgmt service in Safe Mode. Still no problem. So I rebooted back to
normal Windows 10. To my surprise, there was no problem getting back into normal Windows 10. Go figure!

I still think it's a timing problem. For example, if I stop the Winmgmt service (which also stops all services dependent on Winmgmt) and then restart Winmgmt followed by restarting the dependent services, it does NOT crash.

Here you can see the Winmgmt service dependencies for my PC:

https://1drv.ms/i/s!Au5lxLjuFt5FoEfSNYn2fAT-HX4W

That's why I thought delaying the start of Winmgmt would help, since the services it depends on (DCOM and RPC Endpoint Mapper) are NOT delayed. However, it's flaky at best, sometimes working and sometimes not. Maybe if the Winmgmt service could be delayed
a little longer, but I don't know how to do that when there are services depending on Winmgmt.

The error involves an "APPCRASH" as shown here:

https://1drv.ms/i/s!Au5lxLjuFt5FoEj9ejaFCAf47Fkd

So it could be something else entirely. I feel strongly BOTH ways!

One thing is for sure, its not any non-Microsoft software causing this problem. This is assuredly a Microsoft problem.

P.P.S. I've rebooted 3 times now WITHOUT having the problem. This is how I've set the services:

1. All services that Winmgmt depends on running before Winmgmt (i.e. DCOM & RPC Endpoint Mapper) are set to "Automatic".

2. Winmgmt (Windows Management Instrumentation) is set to "Automatic (Delayed Start)".

3. All services that depend on Winmgmt running first (i.e. Security Center & IP Helper) are set to "Automatic (Delayed Start)".

If you are having this problem, please try what I've described above to see if it fixes your problem and post back here to let everyone know.

Thanks,

Stu

Okay, this is truly flaky. After a few more reboots it stopped working. I now have the problem at every boot. So I've gone a bit further. I've placed the dump file here for anyone to examine:

https://1drv.ms/u/s!Au5lxLjuFt5FoEkqu0OLscVrOl0v

I've also run my own analysis of the dump file using The Microsoft Debug Diagnostic Tool from here:

Download Debug Diagnostic Tool v2 Update 2 from Official Microsoft Download Center

The resulting summary description was:

"In WmiPrvSE.exe.4272.dmp the assembly instruction at ntdll!RtlReportCriticalFailure+97 in C:\Windows\System32\ntdll.dll from Microsoft Corporation has caused a corrupted heap exception (0xC0000374) when trying to perform an unknown operation on memory location
0x000000a4 on thread 18".

It appears to be a Microsoft problem that only they can fix.

Stu

 

Try this command:

winmgmt /salvagerepository


But on technet they mention this:

"The error is an application crash. If you didn’t get any issue, you may ignore that event."

 

Thanks - ran winmgmt /salvagerepository and it said the repository was clean.

The error occurs at startup. For now I will ignore it.