| Event Id | 9102 |
| Source | MSExchangeSA |
| Description | The MAD Monitoring thread was unable to read the state of cluster resources, error 0x80010108 |
| Event Information | As per Microsoft CAUSE This issue occurs because the monitoring thread that is run by the System Attendant service (Mad.exe) cannot query Microsoft Windows Management Instrumentation (WMI) for the state of any of the following items: • Cluster resources • CPU usage information • Instances of the ExchangeLink class or other classes provided by the Exchange WMI provider (Exwmi.dll) The errors may be caused by one of the following issues: • Corruption in the WMI infrastructure • Transient problems with the WMI infrastructure • Network connectivity issues To identify the exact cause of the event, see the error code in the "Description" section of the event. For example, event ID 9102 with the error 0x80010108 translates to RPC_E_DISCONNECTED. This error means that the remote procedure call (RPC) connection was lost, possibly because of network connectivity issues. For more information, see the "Error Codes" section in this article. RESOLUTION If these events occur occasionally, they can be safely ignored. However, if they occur frequently (for example, every five minutes), you should investigate the cause of the event. To do so, follow these steps: 1. Make sure that WMI is installed correctly. 2. Use the Windows Management Instrumentation Tester (Wbemtest.exe) to make sure that WMI is responding, the Exchange 2000 namespace still exists, the appropriate class exists, and the Exchange WMI provider can enumerate instances of that class. Wbemtest.exe is installed in the %windir%\system32\Wbem folder in your Windows system folder. 3. Check network connectivity. |
| Reference Links | Event ID 9102 Messages Are Logged in the Application Event Log |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.