WMI does not release message DLLs and program files (321240)


The information in this article applies to:

  • Microsoft Windows Management Instrumentation 1.5, when used with:
    • the operating system: Microsoft Windows 2000
    • the operating system: Microsoft Windows XP
  • Microsoft Windows Server 2003, Datacenter Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Datacenter Edition for Itanium-based Systems
  • Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
This article was previously published under Q321240

SYMPTOMS

The Windows Management Instrumentation (WMI) Windows NT Event Log provider does not release message dynamic-link libraries (DLLs) and program files (.exe files) that are used for mapping event messages to instances of Win32_NTLogEvent. This can prevent these message resources from being updated while the Winmgmt service is running.

CAUSE

Message DLLs and .exe files are cached by the Windows NT Event Log provider to improve the overall performance of the provider. If these resources were released, they would have to be reloaded every time a corresponding Windows NT Log event occurred. Instead, these cached resources are released only when the Windows NT Event Log provider is unloaded.

WORKAROUND

The WMI Windows NT Event Log provider must be unloaded to update an event message resource that has been locked. The quickest way to unload the provider is to stop the Winmgmt service. To stop the service, type net stop winmgmt.

STATUS

This behavior is by design.
Modification Type:MajorLast Reviewed:11/30/2004
Keywords:kbprb KB321240
©2004 Microsoft Corporation. All rights reserved.