Today I noticed that some Windows servers were not applying the correct GPOs (Group Policy Objects). Troubleshooting the problem, I found the event id 1065 in the Windows eventlog:
A GPO was indeed configured with a WMI filter and the server, not being able for some reason to perform a filter check, aborted all the processing of the policies.
I therefore opened the WMI management console with the wmimgmt.msc command:
and found that all the WMI subsystem was probably corrupted:
For a deeper analysis, I downloaded the WMIdiag utility from Microsoft’s website and ran it on my server. In its log, I found that the WMI repository state was INCONSISTENT:
To completely rebuild the repository I first stopped the Windows Management Instrumentation service, then I renamed the Repository folder (in C:\Windows\System32\wbem) to Repository.old:
I restarted the service to create a new repository.
I needed also to re-add to the repository all the third-party WMI classes present in my system. I opened a command prompt, changed the working directory to C:\ and executed the following command:
for /f %%s in ('dir /s /b *.mof *.mfl') do mofcomp %%s
After a reboot, the server correctly applied all the policies and the WMI subsystem was available again.