Troubleshooting Windows monitoring errors
We have collected the most helpful troubleshooting hints that fix most common Windows systems monitoring issues.
Introduction
WMI (Windows Management Instrumentation) is Microsoft’s take on the Web-Based Enterprise Management (WBEM) initiative. It’s aimed at standardization of accessing of management information in a Windows environment. Using WMI you can remotely check for system hardware information, get a list of running processes, lookup event logs and get complex data on the configuration and status of the machine.
Usually, given the proper credentials, monitoring your computers via WMI should be a breeze. However, if you do run into problems, here are five troubleshooting tips to solve the problem.

-
Make sure that Port 135 (TCP) is not blocked by a program such as Firewall. WMI uses Port 135 (TCP) by default, and therefore this port needs to be unblocked on all of your network devices and machines that you want to monitor.
-
Make sure that you have proper administration credentials. Unless you have the proper administration credentials on the machine you are trying to monitor, WMI monitoring will not work. Be sure that you choose a user that is a system administrator on a local machine or a user that has a full access to WMI. To authorize a user to have full access to WMI, please complete the steps outlined in the following Microsoft Technet article
-
Allow Remote Administration exception in firewall group policies. Especially in computers running Windows XP, the Windows Firewall Group Policy may need to be set to “Allow Remote Administration exception” in order for WMI monitoring to work. To allow this exception, please follow the steps outlined in Microsoft Technet article
-
Check if Anti-virus is blocking WMI connections. In some rare occurrences, anti-virus programs may prohibit traffic or flat-out block access to WMI connections. Please make an exception in the antivirus program configuration in order to make sure that the antivirus program is not interfering with proper access to WMI. Temporarily disabling the anti-virus protection might be an option in a testing environment.
Additional content:
This article contains even more examples and solutions related to WMI errors.
- [06.07.2018]Analyze Windows failed login events with a custom log view
This article will demonstrate how to simply display the particular type of Event Log entries in a separate view for better analysis of the existing issues.
- [28.05.2018]Monitoring Windows Event Logs for Warnings and Errors.
This article will demonstrate how to specify Event Log entries for monitoring by setting alerting rules in Monitoring Packs and assigning Alert Escalation Scripts.
- [12.02.2018]Process Monitoring with NetCrunch WMI Sensors.
Learn how to configure a node-specific WMI Object sensor to monitor a specific Windows process and generate an event when the process is restarted. This sensor-based monitoring strategy leverages the uniqueness of PID, against the generic name of a process.
- [24.05.2016] Correct Monitoring of Windows Processes on multi-core machines
This article will explain how NetCrunch monitors Windows processes and why these values are wrong in perfmon.