| Event Id | 9099 |
| Source | MSExchangeAdmin |
| Description | The MAD Monitoring thread was unable to read the state of the services, error error code |
| Event Information | "According to Microsoft: Cause: The Microsoft Exchange System Attendant was unable to query Window Management Instrumentation (WMI) for instances of Win32_Service class. This class is provided by the standard Win32 provider shipped with Windows 2000. The Monitoring thread will recover from these errors if they are isolated. If you receive more than six of these events every hour, then the underlying cause needs to be investigated.The most common cause of this event is that the workflow event sink, Cdowfevt.dll, is not correctly registered User Action : 1. Register cdowfevt.dll manually. 2. Use Wbemtest.exe to determine if the components are registered and if the directory structure in WMI was built correctly. 3. Follow the steps outlined in Q326011." |
| Reference Links | The MAD Monitoring thread was unable to read the state of the services, error error code. Q326011:The System Attendant generates Event ID 9098 and 9099 messages every five minutes |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.