| Event Id | 5601 |
| Source | Microsoft-Windows-WMI |
| Description | The WMI Service failed to load the repository files under the directory %windir%\system32\wbem\repository. This can be caused by a corruption in the repository files, security settings on this directory, lack of disk space, or other system resource issues like lack of memory. If this error happens every time the machine is rebooted then the administrator on this machine may need to stop WMI Service, delete all files and directories under this location, and restarting the WMI Service. |
| Event Information | According to Microsoft : Cause : This event is logged when the WMI Service failed to load the repository files under the directory %windir%\system32\wbem\repository. Resolution : Run the WMI Diagnosis Utility (WMIDiag) The WMIDiag tool is a script that automates various troubleshooting steps that you can use to determine whether WMI is working correctly. It provides a comprehensive report about the state of the WMI infrastructure. Download WMIDiag. The download is a self-extracting executable. Run the executable and, when prompted, specify a folder into which to extract the files. The result should be a folder named wmidiag with three files in it: WMIDiag.doc, WMIDiag.vbs, and WMIDiag.xls. To run the WMIDiag tool:
Verify : Restart the WMIDiag tool. If the problem is resolved, the tool should display the message, "SUCCESS: WMIDiag determined that WMI works CORRECTLY". If it does not report success, then it will describe the problems found and suggest steps to resolve them. |
| Reference Links | Event ID 5601 from Source Microsoft-Windows-WMI |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.