Win2k Event Errors

[pikapan 0]

Just recently I've been receiving error messages in my application and system event logs when I reboot my computer under Win2k. The first error is an application error caused by WinMgmt that says, "WMI ADAP was unable to load the the winspool.drv performance library due to an unknown problem within the library: 0x0". The other error is in the system event log and it's a warning that's caused by the Browser server and states, "The value for the parameter DirectHostBinding to the browser service was illegal." Both of these come up everytime I reboot. Never got them before, but I just noticed this problem starting yesterday for some reason. Any advice?

[jaywallen 0]

Hi,

 

For some reason, actually a variety of reasons, W2K seems to like to pepper users on certain systems with bogus performance monitor errors. There are a variety of causes, and a variety of cures. I don't claim to know all of them. These are the ones I've run across, and what I did about them to successfully get rid of the errors.

 

Sometimes the Performance Library Dredger mistakenly identifies a library as being invalid. To check if this is the case you can open Task Manager, and determine the Process ID of the WinMgmt process. Then you can open a CMD prompt, and issue BOTH of the following commands in the order listed -- "winmgmt /clearadap" and "winmgmt /resyncperf -p <WinMgmt Process ID>".

 

I have seen cases where this "cures" the problem permanently. More often, however, it provides a temporary solution, but the problem comes back. If the problem comes back, then it is likely that either slow response of the system during startup is causing the value allowed by the default CollectTimeout value for the pertinent counter to be exceeded and/or that slow response has caused the ADAPPerflbTimeout value to be exceeded. And it is also possible that the concerned performance counter (or its registry entries) is simply corrupted.

 

Since you're getting the specific winspool.drv error, you could just use regedt32.exe to go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Spooler\Performance. (You would just go to the same general area of the registry and look for other service names if you were getting errors about other counters. You can find them easily by searching on Keys for "Performance".) See if there's a Collect Timeout REG_DWORD value here named CollectTimeout. The default value is 2000 (decimal), I think. I fixed two portable (notebook) systems that were displaying this error by setting that value to 10000 (decimal). (Note: When you okay the value, the display of the value in the right-hand pane of regedt32.exe reverts to the hex radix, so don't let that throw you. Sorry if this warning is not needed. I just don't know how familiar you are with the registry.)

 

In this same location in the registry you should see a REG_DWORD value named WbemAdapStatus. If adjusting the CollectTimeout value upward doesn't cause the winspool.drv error to go away, you can set this value to 0 (zero).

 

In the case of more generalized perfproc.dll errors from WMI ADAP, you might attempt to prevent the performance library timeout value from being exceeded. You can use regedt32.exe to go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\CIMOM location in the registry and set the ADAPPerflibTimeout REG_DWORD value to 180 (decimal), up from the default 60 seconds.

 

Another, and easier, way to deal with these issues is just to turn the bloomin' counters off! If you have exctrlst.exe (from the W2K Resource Kit), you can use it to turn off offending counters. (This tool may be downloadable. It wasn't at one time, but I think there's been a lot of demand.)

 

You can also just use the registry editor to go to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\<ServiceName>\Performance locations where the offending performance counter entries are located and use the editor to create a REG_DWORD named "DisablePerformanceCounters" (no quotes) in that location. If you set the value to 1 (one), you disable the counter.

 

I have never seen the DirectHostBinding error you mention. I know that it has something to do with enabling the Master Browser functions. Maybe if you gave us some information on your networking setup (protocols / bindings / general network environment) someone would have some suggestions to make.

 

I hope this is of some help.

 

Regards,

Jim

[pikapan 0]

Thanks a lot for the help jaywallen. The winmgmt commands cleared up the problem and they haven't returned. If they do, I think I'm just going to turn off the counters. As for the DirectHostBinding error, I'm not sure what caused it since I'm fairly certain I didn't change any settings or install any new software when the warning started appearing. Some general info as to my networking setup is that I'm on a LAN connection within my dorm at school, T3 connection. I'm currently running Client for MS Networks, File and Printer Sharing for MS Networks, NetBEUI, NWLink IPX/SPX/NetBIOS, and TCP/IP. When I look it up in the registry, the value for DirectHostBinding that's reported as being illegal by Event Viewer is set to \Device\NWInkIPX\Device\NWInkNB. I have no idea what that means though.

[jaywallen 0]

Hi,

 

I'm glad you were able to at least get rid of the WinMgmt error(s). I'll keep my fingers crossed on that one!

 

I might get a little time to look into the DirectHostBinding issue this weekend. I don't deal with IPX/SPX or Netware any more than I absolutely have to. I'm an old guy. I just started learning Windows a bit over a year ago. I ain't got enough time left for Novell, too.

 

BTW, just to satisfy my curiosity, how come you're using all those protocols? Required by the school network? Gaming?

 

Regards,

Jim

[Dragon-Lord 0]

Jim gets my vote for "This Mo-Fo knows of what he speaks!" Well done, sir!

 

:}

[pikapan 0]

Well, TCP/IP is a given. I have the IPX protocol installed for games. The rest I have installed so I can print on my roommate's printer over the network. He's running Win98 SE and unless I have those installed, I can't seem to see him. I have a feeling the DirectHostBinding issue is caused by either the NetBEUI protocol or the IPX/SPX protocol. I tried to check and see what legal values there were for DirectHostBinding by searching through my friend's Win2k registry. No instances of it showed up and he doesn't have IPX or NetBEUI installed on his comp so it's probably one of those I'm guessing.

[jaywallen 0]

pikapan:

 

Is your online gaming suffering any? I'm wondering if this warning message really means anything.

 

http://www.microsoft.com/TechNet/winnt/ntwrkstn/Tips/ewn9662.asp is all I could find at Microsoft regarding the term DirectHostBinding. It's to allow Windows for Workgroups to access an NT server directly using IPX/SPX without NetBIOS? Sheesh!

 

I looked in the W2K Resource Kit for the System Log error, and I found only this:

 

=== begin quote ===

 

Event Message:

The value for the parameter parameter to the browser service was illegal.

 

Source Event Log Event ID Event Type

Browser System 8023 Warning

 

User Action:

Ask your network administrator to correct the parameter in your configuration information.

 

=== end quote ===

 

I guess you could ask the network admins if they know anything about it. Sounds like it's something they set from their end. I don't even have any references (other than the Internet) to look for more info.

 

I'll let you know if I do learn something, and I hope you'll post if you learn something.

 

Dragon-Lord:

 

Oh, I'm no expert. I'm just scratching around in a new environment. Keeps me out of trouble in my retirement. These little computers are a lot of fun. I fiddled around with some personal computers with my kids when Atari and Apple //e were popular. I wish I'd stuck with it, but I was a physicist. I used big iron for most of my work. It really is a whole other kind of computing, isn't it?

 

Regards,

Jim

[pikapan 0]

I think my computer's still running fine and I don't notice any problems. I don't think this is something major since it's only listed as a warning rather than an error in event viewer. I'll search around online later tonight and see if I can figure out what's causing this. Thanks for the help though!

[pikapan 0]

Well, I looked around online for a good hour or so and couldn't find anything at all. I was also pretty sure it was caused by either the NetBEUI or the IPX/SPX protocol since my friend didn't have the DirectHostBinding entry in his registry and the only difference between our computers was that he didn't have those two protocols loaded. I just uninstalled and re-installed both protocols and now the error messages are gone. I guess my stupid person's solution worked!

[Nemesis 1]

Pikapan,

 

Jaywallen advised of a program EXCTRLST, this is available on Micro$ofts FTP site:

 

ftp://ftp.microsoft.com/reskit/win2000

 

look for EXCTRLST.ZIP (21674 bytes)

 

Nemesis

[jaywallen 0]

pikapan:

 

Nothing dumb about uninstalling and re-installing. It's likely that the installation process is the source of most registry corruptions. It was actually an extremely good idea to do what you did. This is the sort of situation that causes me to have hunched shoulders and a sloping forehead. When I'm asked the question I shrug, and when I'm told the answer I slap my forehead!

 

Nemesis:

 

Thanks for two things -- for posting the location of the downloadable exctrlst.exe and for reminding me that I want to install and play Zork Nemesis this weekend!

 

Regards,

Jim

[pikapan 0]

thanks for the link. i did a little more research on performance counters and an easy way to enable them is through the diskperf command at the command prompt. diskperf -n will disable all disk related performance counters. if you ever wish to re-enable them, you can use diskperf -yd to start them up again.

[jaywallen 0]

Yes, indeed. The diskperf -n command is especially useful since the performance counters that monitor the disks have more influence on system performance than the other counters.

 

Regards,

Jim