Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. A Service Control Manager (SCM) event cannot be logged in the System event log on a Windows Server 2003-based computer

A Service Control Manager (SCM) event cannot be logged in the System event log on a Windows Server 2003-based computer

View products that this article applies to.

Symptoms

A Service Control Manager (SCM) event cannot be logged in the System event log on a Windows Server 2003-based computer when the following conditions are true:
  • You apply Windows Server 2003 Service Pack 1 or Service Pack 2 on this computer.
  • You run the Sysprep.exe command on this computer, or you run the Active Directory Installation Wizard (Dcpromo.exe) on this computer.

Additionally, if you enable the Audit logon events local policy on the computer, the following event ID error message is logged in the Security log:

↑ Back to the top

Cause

This issue occurs when the user who is logged on is not the user who is registered in the Windows Management Instrumentation (WMI) repository. WMI will not allow for events to be written to the System event log if the user who is logged on is not registered in the WMI repository.

↑ Back to the top

Workaround

To work around this issue, follow these steps:
  1. Click Start, click Run, type control panel, and then click
    OK.
  2. Double-click Scheduled Tasks, click
    Advanced, and then click AT Service Account.
  3. In the AT Service Account Configurationdialog box, select System Account.
  4. Click Start, click Run, type cmd, and then click OK.
  5. At the command prompt, type the following command:
    AT 12:00/i mofcomp %windir%\system32\wbem\scm.mof


    Note This step re-compiles the Scm.mof file.

    Note The AT command schedules commands and programs to run on a computer at a specified time and date, such as /every: date[2005:05:16:12:00:00]. You can run the /every: date[...] command on each specified day of the week or month. If the date is omitted, the current day of the month is assumed. The Schedule service must be running to use the AT command. The /i switch allows for the job to interact with the desktop of the user who is logged on when the job runs.
  6. Close the command prompt, and then restart the computer.

↑ Back to the top

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

↑ Back to the top

Keywords: kb, kbserver, kbscm, kbtshoot, kbbug

↑ Back to the top

Article Info
Article ID : 917463
Revision : 5
Created on : 4/17/2018
Published on : 4/18/2018
Exists online : False
Views : 379