Windows 10: Repeated WMI Error 0x80041032 Event 5858 caused by swiservice.exe, cause "Unknown"

Hi everyoneI came across this while looking into what's gobbling up CPU power at startup. This is the output from Event Viewer > Applications and Service Logs\Microsoft\Windows\WMI-Activity\Operational:Log Name: Microsoft-Windows-WMI-Activity/OperationalSource: Microsoft-Windows-WMI-ActivityDate: 29/12/2021 11:56:42Event ID: 5858Task Category: NoneLevel: ErrorKeywords: User: SYSTEMComputer: GK-NotebookDescription:Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = GK-NOTEBOOK; User = NT AUTHORITY\SYSTEM; Clie

:)

 

Windows not shutting down, caused by Event Error 5858 ? (WMI Activity)

Regularly my pc does not shut down, it gets stuck on the blue screen with "Shutting Down"
After a while I need to shut down the pc, using the power-button on the case.

I already untagged "Turn on fast start-up (recommended)"
under Control Panel->All Control Panel Items->Power Options->System Settings under 'Shut-down settings"

Regretfully that did not solve the issue.

I checked the event log between me initiating shutdown (event 1074) and rebooting.

There are quite a number of entries reading like this:

Event : 5858
Source : Microsoft-Windows-WMI-Activity
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-JFFLEA5; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2908; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "MSStorageDriver_ClassErrorLogEntry"; ResultCode = 80041032; PossibleCause Unknown
-
Event : 5858
Source : Microsoft-Windows-WMI-Activity
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-JFFLEA5; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2908; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "USBSTOR\\Disk&Ven_WD&Prod_My_Book_1230&Rev_1065\\57583231443934374E345956&0_0-{05901221-D566-11d1-B2F0-00A0C9062910}"; ResultCode = 80041032; PossibleCause = Unknown
=

Note that I did have external drives running, but they were properly removed (ejected) and then, before shutting down, they were switched/powered off, i.e. they didn't exist anymore for Windows.

Does anybody out there know how to handle this and what is causing this error?
Any solutions?

Thanks!

=

 

WMI issue with event id 5858

I have Windows 10. I have an issue with the CPU usage and it seems to be connected to WMI. It means that my fan is constantly running and the machine seems to be always doing something. I have done a bit of research and have identified that the error seems
to be caused by Event ID 5858. It keeps showing up as an error on the log.

I'm not very IT savvy so any help would be appreciated

Terry

 

WMI events 5858 on a Windows Server 2016, what to do?

Good morning,

On a customer's system, I've installed a program, which launches quite some WMI queries, for determining the status of the machine.

Regularly those WMI queries are failing, and in event logs, there are lots of errors (event ID 5858), hereby a typical example (I've obfuscated computer name, customer name and GUID for security reasons):

Code:

Log Name:      Microsoft-Windows-WMI-Activity/Operational

Source:        Microsoft-Windows-WMI-Activity

Date:          1/04/2019 14:54:06

Event ID:      5858

Task Category: None

Level:         Error

Keywords:      

User:          SYSTEM

Computer:      Computer_Name.Customer.intra

Description:

Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = Computer_Name; User = NT AUTHORITY\SYSTEM; ClientProcessId = 6968; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\ccm\policy\machine : select * from InventoryAction where InventoryActionID="{00000000-0000-0000-0000-000000000001}";
 ResultCode = 0x80041032; PossibleCause = Unknown

Event Xml:

<Event xmlns="[url]http://schemas.microsoft.com/win/2004/08/events/event[/url]">

  <System>

    <Provider Name="Microsoft-Windows-WMI-Activity" Guid="{........-....-....-....-............}" />

    <EventID>5858</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x4000000000000000</Keywords>

    <TimeCreated SystemTime="2019-04-01T12:54:06.515593700Z" />

    <EventRecordID>570075</EventRecordID>

    <Correlation />

    <Execution ProcessID="1736" ThreadID="30436" />

    <Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>

    <Computer>Computer_Name.Customer.intra</Computer>

    <Security UserID="S-1-5-18" />

  </System>

  <UserData>

    <Operation_ClientFailure xmlns="[url]http://manifests.microsoft.com/win/2006/windows/WMI[/url]">

      <Id>{00000000-0000-0000-0000-000000000000}</Id>

      <ClientMachine>Computer_Name</ClientMachine>

      <User>NT AUTHORITY\SYSTEM</User>

      <ClientProcessId>6968</ClientProcessId>

      <Component>Unknown</Component>

      <Operation>Start IWbemServices::ExecQuery - root\ccm\policy\machine : select * from InventoryAction where InventoryActionID="{00000000-0000-0000-0000-000000000001}"</Operation>

      <ResultCode>0x80041032</ResultCode>

      <PossibleCause>Unknown</PossibleCause>

    </Operation_ClientFailure>

  </UserData>

</Event>

There are 210 such events, the different "ResultCode" values are shown here:

[table][tr][td]Amount of occurences[/td][td]ResultCode[/td][/tr][tr][td]1[/td][td]0x80041033[/td][/tr][tr][td]1[/td][td]0x800706BE[/td][/tr][tr][td]2[/td][td]0x80041017[/td][/tr][tr][td]6[/td][td]0x80070422[/td][/tr][tr][td]14[/td][td]0x80041001[/td][/tr][tr][td]18[/td][td]0x80041010[/td][/tr][tr][td]42[/td][td]0x80041002[/td][/tr][tr][td]44[/td][td]0x80041032[/td][/tr][tr][td]82[/td][td]0x8004101D[/td][/tr][/table]

The customer has Windows Server 2016.

Why are those error logs appearing and what can I do in order to avoid them? (Windows update, patch installation (which one?), …)

Thanks in advance

Dominique