Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 47 Source: WinMgmt

Source
Level
Description
WMI ADAP was unable to retrieve data from the PerfLib subkey: SYSTEM\CurrentControlSet\Services\<service name>\Performance Library, error code: <error code or description>
Comments
 
I received this event after upgrading from Windows 2000 to Windows 2003. In my case, the solution was to disable the counter from being loaded. I used the "Exctrlst tool" to do that.
I too just uninstalled terminal services and ended up with the same error. I found Steven Bauer’s post helpful; however you do not have to delete the entire "Terminal Services" registry key. Instead, simply delete the “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Performance” key. I then installed the default values from a clean Windows 200 SP4 system.
- Error: 0x80041009 - See ME834475 for details.

For a list of errors that can be returned by WMI and some explanation about them see Windows® Management Instrumentation (WMI) Errors.

As per Microsoft: "This is not a performance library error but may indicate other problems, such as missing performance counter classes in Windows Management Instrumentation (WMI)". See MSW2KDB for additional information on this event.
We found several suggestions on running "winmgmt /clearadap" in order to fix this problem but we could not confirm if this really helped. One can also try using the Window 2000 Resource Kit utility ExCtrLst (extensible counter list).

The most common error code is 0x80041009 = "WBEM_E_NOT_AVAILABLE" (see ME295821 - Windows Management Instrumentation Error Return Codes). This error code means that the resource, typically a remote server, is not currently available.
Using the "Winmgmt /clearadap" did not fix this error.  Instead I found multiple event ID 2003 along with event 47. Unloading and reloading IIS Performance dynamic-link libraries(DLL's) as referenced to the Microsoft article ME267831 (under eventID 2003) took care of all of my 2003 event ID errors as well as this event (47).


Service: TermService, Error code: "0x80041009" - The error started once Terminal Services was removed from a Windows 2000 Server. To fix the error I deleted the registry key: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...