Abstract:You get the error message “The Open Procedure for service XXX in DLL “C:\Windows\System32\XXX.dll” failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code” and wish to solve that.
The full error messages you got are:
Log Name: Application
Source: Microsoft-Windows-Perflib
Date: 09.03.2017 09:12:09
Event ID: 1008
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: server01.int.contoso.com
Description:
The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" />
<EventID Qualifiers="49152">1008</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-03-09T08:12:09.000000000" />
<EventRecordID>10416</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>server01.int.contoso.com</Computer>
<Security />
</System>
<UserData>
<EventXML xmlns="Perflib">
<param1>BITS</param1>
<param2>C:\Windows\System32\bitsperf.dll</param2>
<binaryDataSize>8</binaryDataSize>
<binaryData>0200000000000000</binaryData>
</EventXML>
</UserData>
</Event>
or
Log Name: Application
Source: Microsoft-Windows-Perflib
Date: 09.03.2017 09:12:09
Event ID: 1008
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: server01.int.contoso.com
Description:
The Open Procedure for service "WmiApRpl" in DLL "C:\Windows\system32\wbem\wmiaprpl.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" />
<EventID Qualifiers="49152">1008</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-03-09T08:12:09.000000000Z" />
<EventRecordID>261692</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>server01.int.contoso.com</Computer>
<Security />
</System>
<UserData>
<EventXML xmlns="Perflib">
<param1>WmiApRpl</param1>
<param2>C:\Windows\system32\wbem\wmiaprpl.dll</param2>
<binaryDataSize>8</binaryDataSize>
<binaryData>1500000000000000</binaryData>
</EventXML>
</UserData>
</Event>
To solve that different solutions might apply here:
Solution 01:
1.) Open a CMD via run as admin
2.) enter
C:\Windows\system32\lodctr.exe /R
and then
C:\Windows\SysWOW64\lodctr.exe /R
If you get the error “Error: Unable to rebuild performance counter setting from system backup store, error code is 2” repeat step 2.
3.) Now re-registers the computer´s performance libraries with the following (for more infos see):
C:\Windows\System32\wbem\winmgmt.exe /RESYNCPERF
C:\Windows\SysWOW64\wbem\winmgmt.exe /RESYNCPERF
Solution 02:
On some websites it is requested to use the PerfStringBackup.ini located in %systemroot%\system32\. However this file do not include all performance counters. The reason here is that the PerfStringBackup.ini is created before an application added new performance counters. That means the file is never aktuell and therefore using this might cause issues with the performance counters!
So please be carefull if you use:
%windir%\system32\lodctr /r: perfstringbackup.ini
Solution 03 (SharePoint only):
The issue occurs when the Local Service Account has insufficient registry permissions. To solve that add the local service account to the applicable registry keys and sub keys for the Service as noted in the description of the particular event.
Caution! This fix requires you to edit the registry. Using Registry Editor incorrectly can cause serious problems that might require you to reinstall your operating system. We cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.
So for the error messages seen above this means give read access for the COMPUTERNAME\WSS_WPG group to the following keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Performance
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance
Cross information:
