Windows 7 and WMI

[plox]

Hello

I've been using  windows_repair_all_in_one Free version for years (as well as CleanMem) and it has been a lifesaver on many, many occasions for which I am eternally grateful.

I am on win 7 Ultimate and over the last couple of months I've had some severe problems which seemed to have been resolved by doing a repair installation however there is one  recurring problem which occurs whenever I do a repair of the WMI  and restore services in Safemode - not sure if this is caused by  Windows Repair or some bug in my system which is reported as being clean by Avast and HitmanPro.

WMI service would not start nor the Security Center service. Malwarebytes Anti-Ransomware Service I've just discovered relies on WMI to be running and I could not work out why it kept telling me that it had stopped working or clicking on the Fix it button did not work.

I also kept getting "Error 1083  The executable program that this service is configured to run in does not implement the service" whenever I clicked on the Dependencies tab in services.msc. Tried all sorts of repairs to no avail and was convinced that I had a hidden rootkit lurking somewhere but undetected by any of the tools like Combofix and others.

After a lot of searching and researching I finally came across the solution. It seems ( I may be wrong, please correct me if I am) that WR adds the following path for WMI which causes it and all associated dependencies to fail:

C:\Windows\system32\svchost.exe -k netsvcs

I've discovered that changing HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winmgmt's Image path to:

%systemroot%\system32\svchost.exe -k winmgmt

has solved all the problems I've been having with WMI and the other services.

Can you please check that WR does indeed add "netsvcs" to the path when doing Repair WMI  / Reset Service Permissions /  Restore Important important Windows Services / Set Windows Services to Default Startup and if so please replace it with "winmgmt"?

Thank you.

I also notice that one of WR's scripts enables the Security Centre in Safemode ( WMI Repair, I think) can you  please let me know if this can be achieved with the Technicians Toolbox or by other means.

Thanks again for a marvelous and indispensable set of programs, only wished I could afford the Pro versions to help support your altruism, dedication and responsiveness  to your grateful users.

All the best.

PS - I recall asking this query years ago and not sure if thing have changed since but is it also possible to add an option to restore Windows services according to Black Viper's !Safe_W7_reg configurations - mine is win32  (http://www.blackviper.com/downloads/Win7/Registry_Files/Safe_W7_Ultimate_32_SP1_Start_v100.zip)?

Cheers.

[Boggin]

There are a couple of elevated cmds you can use to repair WMI but Shane has already incorporated these into the program.

They are -

winmgmt /standalonehost

winmgmt /resetrepository

However, I'll pass your query onto Shane.

[Willy2]

- If you run #5 then it will stop the WMI Service. But since the "Security Center" and "Iphelper" are dependent on WMI, those 2 Services will be stopped as well. But these 2 are NOT started when WMI is started at the end of the repair.
- Same story for repair #18 ("Repair VSS"). In that repair WMI is also stopped and started but NOT the Security Center.

(@Boggin: this remains a topic of discussion. Does those 2 Services need to be (re-)started as well in a future version of Windows Repair ??)

- If you want to start manually these 2 Services then put the following 2 lines in a *.bat file:

     net start wscsvc      (for Security Center)
     net start iphlpsvc    (for IpHelper)

and run this file with admin rights.

[Boggin]

I've already passed this onto Shane but I'll give him a Bump on it.

[Willy2]

- I just ran the Tweaking's "Svchost look up" tool

http://www.tweaking.com/content/page/tweaking_com_svchost_exe_lookup_tool.html

and on my Win 7 64 bit PRO system the program reports the following path and switches:

"C:\windows\system32\svchost.exe -k netsvcs"

See also the content of the attachment.

[chuckpete]

"Windows 7 and WMI" fix applies to Vista32, also.  I 'tweaked' my vista and lost system updates and security center.  They worked before I ran the 'tweak'.

SOLUTION:  "After a lot of searching and researching I finally came across the solution. It seems ( I may be wrong, please correct me if I am) that WR adds the following path for WMI which causes it and all associated dependencies to fail:    C:\Windows\system32\svchost.exe -k netsvcs

I've discovered that changing HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winmgmt's Image path to:    %systemroot%\system32\svchost.exe -k winmgmt"

In Vista, after I changed 'netsvcs' to 'winmgmt' things started working again.

[Boggin]

"Windows 7 and WMI" fix applies to Vista32, also.  I 'tweaked' my vista and lost system updates and security center.  They worked before I ran the 'tweak'.

SOLUTION:  "After a lot of searching and researching I finally came across the solution. It seems ( I may be wrong, please correct me if I am) that WR adds the following path for WMI which causes it and all associated dependencies to fail:    C:\Windows\system32\svchost.exe -k netsvcs

I've discovered that changing HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winmgmt's Image path to:    %systemroot%\system32\svchost.exe -k winmgmt"

In Vista, after I changed 'netsvcs' to 'winmgmt' things started working again.

I've passed your findings onto Shane.

[Willy2]

- Odd, very odd. I assume you ran all repairs ???
- I know how Windows Repair fixes/repairs the info for the WMI Service in repair #25. (No, no details). It seems that the info Windows Repair uses needs to be reviewed.
- WMI is used to pull up A LOT OF info from one's system. That's why it puzzles me so much that the switch "-netsvc" works on my Win 7 system (see above) and not on the systems reported above.

[plox]

Hello again.

Thank you all for your contributions.

After another repair of Win7 and fearing that I had locked myself out the system I finally got it working again. Sorry about the delay in responding.

Not done any repairs apart from resetting registry permissions (#1) ,  reset file permissions (#2), repair safe mode, (#23) and ($22) repair file associations.

Windows Management Instrumentation is started  (set to automatic) while Winmgmt's path in services.msc is definitely :

C:\Windows\system32\svchost.exe -k netsvcs

Maybe there was a bug before that stopped it from starting.

Exploring a bit further when you look at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost and netsvcs, winmgmt is present in the  list of services that it controls. It could be that the repairs omit to add it to that list!!!! which could explain the problem of the WMI service not starting.

*********

There's a couple of other queries I'd like to raise not related to this but rather than start a new post can I please ask them here, if not please redirect?

Reset file permissions
I am using version 4.0.5, looking at All Repairs (45) and I am sure that in previous version there was an option to reset file permissions on other drives - the present one only does C: drive from what I can see. Has this option been withdrawn?

***********

Backup Tools - System Restore
I always click on the create button and a confirmation comes back pretty well immediately  that one has been created with the date and time using an Admin loggin in Safemode.

While trying to sort out the computer I was looking for these restore points but could not find any.

I created one just now (in normal mode using a restricted account not sure if it makes a difference though it ought not to) - the response ->  Restore point created at Fri 15 Sep 2017 - 18:49:36.

I click on the button to Open System Restore and when it opens there is no mention of it.   Please check this out as one can easily be led  in the belief that these restore points are being created but in reality not (at least on my system).

Can you also please let me know what is entered in the Description and Type in System Restore when one is created through WR?

I manually created one a couple of hours ago before installing Zone Alarm and that is the last one displayed.

Many thanks again for your help and assistance.

[Boggin]

Others have also commented on the actual restore point not being created in Win 10 even though it says it has with a date and time stamp.

There's no such problem in Win 7.

Initially from Win 8 a new restore point wouldn't be created within 24hrs of the last one but Shane has told me that WR changes that frequency, although it hasn't resolved it for me and the restriction has never applied because of the time difference of days since the last one was created.

It is the same on both of my upgraded Win 10 laptops.

It's better to rely on the Registry Backup than on any restore point WR has said it has created, but unless you know about the lack of physical restore points and you try to restore from within the program then you could have problems.

I'll raise this again to see if it can be resolved.

[Willy2]

- Some (final ??) additional thoughts:

- "Security Center" and "IPhelper" are stopped by repair #5 & #18 but not (re-)started. The PRO version of Windows Repair allows the user to automatically run the *.bat script (see one of my previous replies in this thread) that will start those 2 Services.

- But the start-up states of these 2 Services are not changed. So, when the user restartes one's system then these 2 Services will be (automatically) started again.

- If the user wants to then he/she can modify the startup states of one or more Services. Instructions on how to do that are provided in the "Repair Info" of repair #26.

- This question/problem makes it clear that I need to do some additional research. (I know what  to look for).

[Still_Game]

Others have also commented on the actual restore point not being created in Win 10 even though it says it has with a date and time stamp.

There's no such problem in Win 7.

Initially from Win 8 a new restore point wouldn't be created within 24hrs of the last one but Shane has told me that WR changes that frequency, although it hasn't resolved it for me and the restriction has never applied because of the time difference of days since the last one was created.

It is the same on both of my upgraded Win 10 laptops.

It's better to rely on the Registry Backup than on any restore point WR has said it has created, but unless you know about the lack of physical restore points and you try to restore from within the program then you could have problems.

I'll raise this again to see if it can be resolved.

Actually, Boggin, I've found that System Restore points are not reliably created on my laptop under Windows 7 Home Premium 64 bit from within WRAIO but work OK when created and restored using the inbuilt Windows 7 procedures. I've reported this before.

[Boggin]

Sorry, I'd assumed all reports related to Win 10 - bad memory.

[Still_Game]

No problems - though it's something that needs fixing (not your memory😀).

[win7user]

Same issue here on Windows 7 SP1 Home Premium 32-bit...

Using Tweaking.com v4.0.7, and after running Windows Repair, a number of services wouldn't start or work. Spent a considerable amount of time trying to troubleshoot the issue, but fortunately had done a Registry Backup.

Restoring the registry seems to have fixed the affected services, but continuing to have other residual problems. Overall the system is functioning worse than before running Windows Repair. Currently leaning toward reformatting the drive and reinstalling the O/S.

It appears that at a minimum Windows Repair causes bad/corrupted image paths for the services... very disappointing.

[Boggin]

As I've said, a restore point is created on my Win 7.

You can reinstall any Win 7 services and check what their status should be from https://www.sevenforums.com/tutorials/236709-services-restore-default-services-windows-7-a.html

What other residual problems are you having ?

Sometimes running the program a second time can complete the repairs.

I've recently ran it on my Win 7 laptop with all of the repairs except those for Win 8/8.1 and 10 without any untoward after effects.

Does Event Viewer or reliability history record anything specific ?

[Willy2]

- I just re-installed Win 7 Pro 64 bit and the switche(s) for svchost.exe is -k netsvcs. A new fresh re-install is a good way to get rid of A LOT OF "pollution" of the registry (think: permissions, obsolete registry entries, etc.)
- Perhaps the users that have problems have installed some software that changes those/that switch(es) for WMI ??

[win7user]

What other residual problems are you having ?

Does Event Viewer or reliability history record anything specific ?

- 2057 errors of all kinds in last 24 hours: top three: Service Control Manager,  Application Hang, DistributedCOM
- sfc found errors it could not fix
- very slow system response
- very slow Internet access
- various application programs would not load or run
- permission errors trying to access various data files
- previously installed windows update KBs missing

In my opinion the System Restore function is most viable immediately after installing problematic software or a faulty uninstall, but not so much when there have been significant configuration/permission changes deep in the operating system and/or registry.

I wasn't prepared to spend anymore time troubleshooting this issue and went straight to the nuclear option of reformatting the hard drive and reinstalling the O/S. Over the years I've devoted way too much time trying to fix these type of problems and no longer have the patience for it. For me a good rule of thumb is to keep all important data files on storage media separate from the O/S storage media.

For now I would caution anyone from attempting to use Windows Repair in Tweaking.com v4.0.7 on a Windows 7 system.     

[Willy2]

- Then I would check the SMART condition of the HD first. Run GSmartControl and see if any pink lines show up in the "Attributes" tab of that program (assuming you have HD and not a SSD). If the HD is (in the 1st stages of) failing then a re-install won't help either.
- Windows Repair sometimes puts a lot of strain on your HD.

(And I Always keep the last say 10 versions of WR)