| Event Id | 9104 |
| Source | MSExchangeAdmin |
| Description | The MAD Monitoring thread was unable to read the CPU usage information, error error code. |
| Event Information | "According to Microsoft: Cause: This event indicates that the Monitoring Thread of the System Attendant Process (MAD.EXE) was unable to query WMI for CPU Usage Information. If this event appears occasionally, it can be safely ignored. If it happens every five minutes, then the causes need to be investigated. The causes can be varied, and the error code in the Description section will give a clue. For example, in the Sample Event shown below, error 0x80010108 translates to RPC_E_DISCONNECTED, which means the RPC connection was lost, posibly due to a network hiccup. This error can occur due to a corruption in the WMI infrastructure, other transient problems with the WMI infrastructure, or due to network connectivity issues. As mentioned, see the error code in the Description section of the event to understand the underlying cause. User Action : Verify that WMI is installed correctly. Check network connectivity. Use WBEMTEST.EXE to verify if WMI is responding, if the Exchange name space still exists, if the appropriate class exists and if the Exchange WMI provider can enumerate instances of that class. Proceed based on the error code. " |
| Reference Links | The MAD Monitoring thread was unable to read the CPU usage information, error error code |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.