Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

WMI does not release message DLLs and program files

View products that this article applies to.

This article was previously published under Q321240

↑ Back to the top


The Windows Management Instrumentation (WMI) Windows NT Event Log provider does not release message dynamic-link libraries (DLLs) and program files (.exe files) that are used for mapping event messages to instances of Win32_NTLogEvent. This can prevent these message resources from being updated while the Winmgmt service is running.

↑ Back to the top


Message DLLs and .exe files are cached by the Windows NT Event Log provider to improve the overall performance of the provider. If these resources were released, they would have to be reloaded every time a corresponding Windows NT Log event occurred. Instead, these cached resources are released only when the Windows NT Event Log provider is unloaded.

↑ Back to the top


The WMI Windows NT Event Log provider must be unloaded to update an event message resource that has been locked. The quickest way to unload the provider is to stop the Winmgmt service. To stop the service, type net stop winmgmt.

↑ Back to the top


This behavior is by design.

↑ Back to the top

Keywords: KB321240, kbprb

↑ Back to the top

Article Info
Article ID : 321240
Revision : 9
Created on : 2/24/2007
Published on : 2/24/2007
Exists online : False
Views : 399