Event ID - 1004

Event Id1004
SourceMicrosoft-Windows-Perflib
DescriptionThe instance length of an object returned by Extensible Counter DLL "%1!s!" for the "%2!s!" service was not correct. The sum of the instance lengths plus the object definition structures did not match the size of the object. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the object title index of the bad object.
Event InformationAccording to Microsoft :

Cause :
A non-Microsoft DLL caused the error
Resolution :
Contact a vendor
Contact the vendor who provided the performance counter DLLs. If operating system DLLs generated this error, contact Microsoft Customer Service and Support.
Cause :
The list of counters is corrupt
If the performance counter could not unload the strings for the specified service, the registry might be corrupted.
Resolution :
Rebuild the list of performance counters
Membership in the local Administrators group is required to complete this procedure.
To rebuild the list of counters in the registry:
  1. Click Start, expand All Programs, and expand Accessories.
  2. Right-click Command Prompt, and then click Run as administrator.
  3. At the command prompt, type lodctr /r, and then press ENTER.
Cause :
A required DLL is disabled
Resolution :
Re-enable a required DLL
Membership in the local Administrators group is required to complete this procedure.
To enable a performance library DLL:
  1. Click Start, click All Programs, and then click Accessories.
  2. Right-click Command Prompt, and then click Run as administrator.
  3. At the command prompt, type lodctr /e: and then press ENTER, where is the name of the library.
Cause :
The application is running as a user with insufficient privileges
To view performance counters, a user must be a member of the local Performance Monitor Users group, Performance Log Users group, Administrators group, or equivalent. Applications that run as a user or system account with insufficient privileges may not be able to load performance counters correctly.
Resolution :
Run the application as a user with sufficient privileges
By default, an application runs with the same privileges as the user who started it. You can configure services to run as the local system account or as a specific user. You can also start an application as Administrator, but in Windows Vista or Windows Server 2008 with User Account Control enabled, you must confirm that you want to start the application each time it runs if it is configured to run as Administrator.
Consider running services that collect performance counter data as the local system account to resolve privilege issues.
If for security reasons you do not want to run the application or service as the local system account, you can add the user the application runs as to the Performance Log Users group and assign the group the Log on as a Batch Job user right to enable performance counter collection each time the application runs.
Membership in the destination computer's local Administrators group is required to complete these procedures.
  • Add a user to the Performance Log Users group
  • Assign the Log on as a batch job user right to the Performance Log Users group
Cause :
The File and Printer Sharing firewall exception is not enabled
Resolution :
Enable the File and Printer Sharing firewall exception on a remote system running Windows Vista
In Windows Vista and Windows Server 2008, the File and Printer Sharing firewall exception must be enabled on the destination computer before performance counters can be collected remotely.
Membership in the destination computer's local Administrators group is required to change firewall settings.
To enable the File and Printer Sharing firewall exception:
  1. On the destination system, click Start and then click Control Panel.
  2. In the Control Panel search box, type firewall.
  3. In the search results, double-click Windows Firewall.
  4. In Windows Firewall, click Change settings.
  5. On the Exceptions tab, select the File and Printer Sharing check box.
Cause :
The Remote Registry service is not running on a remote system
Resolution :
Enable the Remote Registry service
Membership in the destination computer's local Administrators group is required to complete this procedure.
To enable the Remote Registry service:
  1. On the destination system, click Start.
  2. In the Start Search text box, type compmgmt.msc, and then press ENTER. Microsoft Management Console (MMC) will start.
  3. In the navigation tree, expand Services and Applications and click Services.
  4. In the Services list, right-click Remote Registry, and then click Start.
Verify :
You can use Windows Reliability and Performance Monitor to verify that netowkr performance counters are properly collected and displayed in a Performance Monitor graph. In addition, you can use the typeperf command to get a list of the available counters on the local system.
Membership in the local Administrators group is required to complete these procedures.
View counters in Performance Monitor
To view counters in Performance Monitor:
  1. On the computer where you want to view counters, click Start. In the Start Search text box, type perfmon.exe, and then press ENTER.
  2. In the navigation pane, expand Monitoring Tools, and then click Performance Monitor.
  3. Click the Add button to open a list of available performance counters.
  4. In the Add Counters dialog box, you can click Help for more information on adding counters. When you have finished adding counters to the list, click OK.
  5. Verify that the performance counters you selected are displayed in the Performance Monitor graph.
View a list of counters using the typeperf command
To view a list of counters at the command prompt:
  1. Click Start, click All Programs, and click Accessories. Right-click Command Prompt, and click Run as administrator.
  2. At the command prompt, type typeperf -qx and press ENTER.
  3. Verify that the performance counter list contains expected values.
Reference LinksEvent ID 1004 from Source Microsoft-Windows-Perflib

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.
 Refresh