WMI Error in event log every boot: EventID 5605

windows-event-logwmi

I have a few servers that I keep getting the EventID error 5605

The root\cimv2\TerminalServices namespace is marked with the
RequiresEncryption flag. Access to this namespace might be denied if
the script or application does not have the appropriate authentication
level. Change the authentication level to Pkt_Privacy and run the
script or application again.

The issue is I have no clue where this script is being run from so I can't update the script to solve the issue like every other post I have found on Event 5605. I checked the GPO for startup scripts, I checked all of my domain's SYSVOL share for a VBScript or Powershell script. I can't find this script anywhere. How can I track down this script and fix it so it stops throwing this error?

Best Answer

Use WMI Event Tracing in the Event Viewer, this will allow you to link WMI queries to a specific process.

  1. Open Event Viewer.
  2. On the View menu, click Show Analytic and Debug Logs.
  3. Locate the Trace channel log for WMI under Applications and Service Logs | Microsoft | Windows | WMI Activity.
  4. Right-click the Trace log and select Log Properties.
  5. Click the Enable Logging check box to start the WMI event tracing.

WMI events appear in the event window for WMI-Activity.

This event log is sometimes painful to use, so you can use a script like this to start tracing and view events, with process name attached to the WMI queries:

$wmiLog = "Microsoft-Windows-WMI-Activity/Trace"
echo y | Wevtutil.exe sl $wmiLog /e:true
Read-Host -Prompt "Tracing WMI Started. Press [ENTER] to stop"
echo y | Wevtutil.exe sl $wmiLog /e:false
$events = Get-WinEvent -LogName $wmiLog -Oldest | Where-Object {$_.message.Contains("Operation = Start") -or $_.message.Contains("Operation = Provider") }

if ($events -eq $null)
{
    Write-Host "No WMI events in trace!"
    return
}

$table = New-Object System.Data.DataTable
[void]$table.Columns.Add("Computer")
[void]$table.Columns.Add("Namespace")
[void]$table.Columns.Add("Type")
[void]$table.Columns.Add("Query")
[void]$table.Columns.Add("UserName")
[void]$table.Columns.Add("Process")

ForEach ($event in $events)
{
    switch ($event.Properties.Count)
    {
        6 {
            $typeStart = $event.Properties[1].Value.IndexOf("::")+2
            $typeEnd = $event.Properties[1].Value.IndexOf(" ",$typeStart) 
            $type = $event.Properties[1].Value.Substring($typestart,$typeEnd-$typeStart)
            $query = $event.Properties[1].Value.Substring($event.Properties[1].Value.IndexOf(":",$typeEnd)+2)
            $process = Get-Process -Id ($event.Properties[2].Value) -ErrorAction SilentlyContinue
            if ($process -eq $null) 
            { 
                $process = "($($event.Properties[2].Value))"
            }
            else
            {
                $process = "$($process.Name) ($($process.Id))"
            }      

            [void]$table.Rows.Add(`
                $env:COMPUTERNAME,`
                "\\.\root\cimv2",`
                $type,`
                $query,`
                "N/A",
                $process)
        }
        8 {
            $typeStart = $event.Properties[3].Value.IndexOf("::")+2
            $typeEnd = $event.Properties[3].Value.IndexOf(" ",$typeStart) 
            $type = $event.Properties[3].Value.Substring($typestart,$typeEnd-$typeStart)
            $query = $event.Properties[3].Value.Substring($event.Properties[3].Value.IndexOf(":",$typeEnd)+2)
            $process = Get-Process -Id ($event.Properties[6].Value) -ErrorAction SilentlyContinue
            if ($process -eq $null) 
            { 
                $process = "($($event.Properties[6].Value))"
            }
            else
            {
                $process = "$($process.Name) ($($process.Id))"
            }

            [void]$table.Rows.Add(`
                $event.Properties[4].Value,`
                $event.Properties[7].Value,`
                $type,`
                $query,`
                $event.Properties[5].Value,
                $process)
        }
        default
        {
            Write-Error "Unexpected number of event properties."
            Write-Host $event
            Write-Host $event.Properties
        }
    }
}

$table | Out-GridView

Tracelog.exe and tracefmt.exe from Windows Driver Kit (WDK) can also be used for WMI tracing.

Related Topic