Windows Server

Robert Zahm · Guest

I found the warnings listed below in the event logs of our Windows SBS2003
SP1 machine after startup. They were also logged when I attempted to email
myself the performance monitoring report (along with an error dialog that
told me that an error had occured, and that I should check the configuration
settings). I saw some things about unloading/reloading DLLs, reseting
performance counters, reinstalling IIS and updating registry entries, but I
would like a little more information and some reassurance before doing
anything like that.

Thanks,

Rob

Here are the events that are logged (from what I gather, I can ignore the
duplicate 5603 errors, but I'm guessing my problem lies with that last one):

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 10/15/2005
Time: 9:29:39 PM
User: NT AUTHORITY\SYSTEM
Computer: BRADFORDDC01
Description:
A provider, PerfProv, has been registered in the WMI namespace,
ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
HostingModel property. This provider will be run using the LocalSystem
account. This account is privileged and the provider may cause a security
violation if it does not correctly impersonate user requests. Ensure that
provider has been reviewed for security behavior and update the HostingModel
property of the provider registration to an account with the least
privileges possible for the required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 10/15/2005
Time: 9:29:39 PM
User: NT AUTHORITY\SYSTEM
Computer: BRADFORDDC01
Description:
A provider, PerfProv, has been registered in the WMI namespace,
ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
HostingModel property. This provider will be run using the LocalSystem
account. This account is privileged and the provider may cause a security
violation if it does not correctly impersonate user requests. Ensure that
provider has been reviewed for security behavior and update the HostingModel
property of the provider registration to an account with the least
privileges possible for the required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: Perflib
Event Category: None
Event ID: 2003
Date: 10/15/2005
Time: 9:29:43 PM
User: N/A
Computer: BRADFORDDC01
Description:
The configuration information of the performance library
"C:\WINDOWS\system32\inetsrv\w3ctrs.dll" for the "W3SVC" service does not
match the trusted performance library information stored in the registry.
The functions in this library will not be treated as trusted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Jenny wu [MSFT] · Guest

Hi Robert,

Thanks for posting here!

For your description, I understand that you got warning event 5603 and 2003
warning event when reboot server box. If I am off base, please don't
hesitate to let me know.

1. Event 5603

Based on my research, this is a by-design behavior. The reasoning behind
the warning is that the operating system informs the administrators that a
WMI provider runs under the LocalSystem context. This is the reason why we
see this warning anytime the WMI service starts up.

Actually, this does not indicate a system error. We can safely ignore the
event. Please do not worry.

2. Event 2003

This event could occur when server was heavy loaded or some particular
third-party software was installed on the server. Could you please tell me
if there is any server management software ware such as HP agent service
installed on the SBS server? If so, you may disable the third-party
management software to see if the problem will occur again. If the warning
only occurs when the server is starting up, there will be no impact to your
SBS server. I''ve tested the steps of KB267831 on my SBS 2003 server. It''s
safely to use the steps on a SBS 2003 server.

You can refer to the KB 267831 article to resolve the issue:
Event ID 2003 Warning Message Logged When Loading Performance Counters
http://support.microsoft.com/?id=267831

And also you can try to remove the "Library Validation Code" value from
registry to try to resolve the issue:

Open Regedit, locate the
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Performance"
registry key and you will find the "Library Validation Code" value.

WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system. Please
backup the registry keys before edit it.

How about the result?

What is more, you can view the following link to get more information about
the 2003 error event:
http://www.eventid.net/display.asp?eventid=2003&eventno=705&source=Perflib&p
hase=1

Related information:

Create and Configure Performance Monitor Alerts in Windows 2000
http://support.microsoft.com/?id=302558

Troubleshooting Performance Monitor Counter Problems
http://support.microsoft.com/?id=152513

How to manually rebuild Performance Counter Library values
http://support.microsoft.com/?id=300956

Events for Performance Monitor Extensions
http://support.microsoft.com/?id=226494

Hope above information helps! If you have any further concern on the issue
please feel free to let me know. I am happy to be assistance of you!

Have a nice day!

Best Regards,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

Robert Zahm · Guest

Jenny,

Thanks for your reply, I will try the KB steps you outlined over the
weekend.

Thanks,

Rob

""Jenny wu [MSFT]"" <v-yanniw@online.microsoft.com> wrote in message
news:lQCWvET1FHA.3884@TK2MSFTNGXA01.phx.gbl...

Jenny wu [MSFT] · Guest

Hi Rob,

Thanks for your update!

I am sorry for the delayed response due to weekend. Please understand that
the newsgroups are staffed weekdays by Microsoft Support professionals to
answer your systems and applications questions. Your understanding is
greatly appreciated!

I appreciate you time and efforts to the issue. Please feel free to post
back when you need further assistance on this issue and you are always
welcome!

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

Robert Zahm · Guest

Jenny,

I didn't end up getting a chance to try this out this weekend, so most
likely I will have to push it back a week.

Thanks,

Rob

""Jenny wu [MSFT]"" <v-yanniw@online.microsoft.com> wrote in message
news:QFY3cVI2FHA.3220@TK2MSFTNGXA01.phx.gbl...

Jenny wu [MSFT] · Guest

Hi Rob,

Ok, I will wait for you . Just post back when you need further assistance
to the issue. I am happy to be assistance of you and you are always welcome!

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

Robert Zahm · Guest

Jenny,

With regards to the Library Validation Code registry entry, do I simply
delete the entire key, or modify the data and "clear" it out that way?

Thanks,

Rob

""Jenny wu [MSFT]"" <v-yanniw@online.microsoft.com> wrote in message
news:lQCWvET1FHA.3884@TK2MSFTNGXA01.phx.gbl...

Jenny wu [MSFT] · Guest

Hi Rob,

Thanks for your update!

Have you followed KB 267831 to try to unload and reload the IIS performance
DLLs? If not, please try to register these DLLs to try to remove the issue.

After done that, if the issue persists, you can try to delete the "Library
Validation Code" registry key to resolve the issue. Generally, the "Library
Validation Code" value is checked against the file creation time and the
file size of the "%systemroot%\system32\inetsrv\w3ctrs.dll" DLL. This 2003
event error will be posted if they do not match.

I am currently waiting for your test result and look forward to your reply!

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------