Clifton Griffin

At my organization, we use Nagios to monitor issues with our systems.  As part of this, we have many VB Scripts that check various aspects of a system, from disk space to available RAM. Occasionally some of these checks begin to fail.  Today I spent a couple of hours ironing out some of these issues. Even if you do not use Nagios, you may find them helpful as the concepts apply to any Microsoft VB Scripts that utilize the Windows Management Instrumentation (WMI) layer.

My scripts were failing with two error codes:

• Type mismatch: ‘FormatNumber’ 0×80041002
• Error (null): 0×80041010

At the start of this troubleshooting I knew next to nothing about troubleshooting WMI problems.  A quick Google search for “Type mismatch ‘FormatNumber’” revealed that my script was attempting to use FormatNumber (a function that returns a number) on a non-number. The reason it was being fed a non-numeric value is because it was attempting to poll the drive space on drives with disconnected storage. (The storage lives on a SAN)

To correct this, I used the following logic:

If IsNumeric(objDisk.FreeSpace) Then
'Some code
End If

This bypassed the problem in the script and ultimately was not a problem with WMI, just the script’s expectations of what WMI would return.

For the second error, my troubleshooting was much longer and more round-a-bout.  After some google searches, I found that Microsoft had written a WMI diagnostic script. Using this script revealed many problems.  Many WMI locations were unavailable and many default security entries were wrong. I decided that the easiest first step to take would be to rebuild the WMI repository. This can be done most simply with this command:

rundll32 wbemupgd, RepairWMISetup

Note: Read the article above before doing this all willy nilly. It is unlikely to actually break anything but may be unnecessary.

While this cleaned up the resulting log from the WMIdiag script, it did not correct the issue. I next decided to tackle the security problems listed in the log.

The log reports security problems in a format similar to this:

*28011 14:59:36 (0) ** WMI namespace security for 'ROOT/SERVICEMODEL': MODIFIED.
*28012 14:59:36 (1) !! ERROR: Actual trustee 'NT AUTHORITY\NETWORK SERVICE' DOES NOT match corresponding expected trustee rights (Actual->Default)
28013 14:59:36 (0) **        - ACTUAL ACE:
28014 14:59:36 (0) **          ACEType:  &h0
28015 14:59:36 (0) **                    ACCESS_ALLOWED_ACE_TYPE
28016 14:59:36 (0) **          ACEFlags: &h2
28017 14:59:36 (0) **                    CONTAINER_INHERIT_ACE
28018 14:59:36 (0) **          ACEMask:  &h1
28019 14:59:36 (0) **                    WBEM_ENABLE
28020 14:59:36 (0) **        - EXPECTED ACE:
28021 14:59:36 (0) **          ACEType:  &h0
28022 14:59:36 (0) **                    ACCESS_ALLOWED_ACE_TYPE
28023 14:59:36 (0) **          ACEFlags: &h12
28024 14:59:36 (0) **                    CONTAINER_INHERIT_ACE
28025 14:59:36 (0) **                    INHERITED_ACE
28026 14:59:36 (0) **          ACEMask:  &h13
28027 14:59:36 (0) **                    WBEM_ENABLE
28028 14:59:36 (0) **                    WBEM_METHOD_EXECUTE
28029 14:59:36 (0) **                    WBEM_WRITE_PROVIDER
28030 14:59:36 (0) **
*28031 14:59:36 (0) ** => The actual ACE has the right(s) '&h12 WBEM_METHOD_EXECUTE WBEM_WRITE_PROVIDER' removed!

To save you time, I have placed an asterisk in front of the lines with the information that is important for you.  To fix these, do the following steps.

1. Run WMIMGMT.MSC
2. Right click on WMI Control (Local) and go to properties.
   
3. Once there click on the Security tab and find the applicable object. (In this case, ROOT\SERVICEMODEL)
   
4. Click Security and add whatever user needs added.  In this example you would add NETWORK SERVICE and allow Execute Method and Provider Write.
   

Unfortunately, this did not fix my particular problem.

I finally found this article explaining how to resynch performance monitor statistics with WMI.  This can be done by funning the following command:

winmgmt /resyncperf

This solved the last of my problems.

I hope this experience is helpful to someone else.