< Blog

How to Enable WMI Logging

By Garth Jones

One day, I couldn’t get ConfigMgr 2012 to inventory a particular WMI class. The normal troubleshooting routine of running psexec –s –i cmd and launching wbemtest.exe as the local system indicated that everything was correct.

How to Enable WMI Logging

Querying the WMI class worked correctly as myself (elevated), additionally querying the WMI class as the local system account was successful. However, when the ConfigMgr 2012 client queried the WMI class, it would fail.

Only two items were left to test. The x86 process and to test querying the WMI class non-interactively. I began testing the x86 process as this seemed like the most logical next step.

In order to review the log file I needed to enable WMI logging.

If you do an internet search of how to enable WMI logging you will get a lot of information about using Event Viewer. In this instance, however, I didn’t find Event Viewer useful. It regularly overloaded and would only store a very limited number of events.

My recommendation is to ignore the posts about Event Viewer, and instead follow this Microsoft article to enable the WMI log file, “Logging WMI Activity,” which is found on the Developer Network.

https://msdn.microsoft.com/en-us/library/aa392285%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396

Important: If your computer is running an x64 version of Windows, make sure that you enable logging under BOTH the x86 and x64 registry keys!

I don’t recommend that you leave WMI logging enabled for long periods of time due to the performance hit you will take on your computer, so remember to turn it off once you have finished reviewing the log files.

Tip: If you are troubleshooting hardware inventory you might want to increase the log file sizes. The default size is 65KB. I simply added a “0” to increase it to 650KB.