Microsoft KB Archive/321240

= WMI does not release message DLLs and program files =

Article ID: 321240

Article Last Modified on 2/24/2007

-

APPLIES TO

 Microsoft Windows Management Instrumentation 1.5, when used with:  Microsoft Windows 2000 Standard Edition

 Microsoft Windows XP Professional  Microsoft Windows Server 2003, Datacenter Edition (32-bit x86) Microsoft Windows Server 2003, Enterprise Edition (32-bit x86) Microsoft Windows Server 2003, Standard Edition (32-bit x86)</li> Microsoft Windows Server 2003, Web Edition</li> Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems</li> Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems</li></ul>

-

<div class="notice_section">

This article was previously published under Q321240

<div class="symptoms_section">

SYMPTOMS
The Windows Management Instrumentation (WMI) Windows NT Event Log provider does not release message dynamic-link libraries (DLLs) and program files (.exe files) that are used for mapping event messages to instances of Win32_NTLogEvent. This can prevent these message resources from being updated while the Winmgmt service is running.

<div class="cause_section">

CAUSE
Message DLLs and .exe files are cached by the Windows NT Event Log provider to improve the overall performance of the provider. If these resources were released, they would have to be reloaded every time a corresponding Windows NT Log event occurred. Instead, these cached resources are released only when the Windows NT Event Log provider is unloaded.

<div class="workaround_section">

WORKAROUND
The WMI Windows NT Event Log provider must be unloaded to update an event message resource that has been locked. The quickest way to unload the provider is to stop the Winmgmt service. To stop the service, type net stop winmgmt.

<div class="status_section">

STATUS
This behavior is by design.

Keywords: kbprb KB321240

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.