The MSExchangeIS performance counters are not available when they are accessed remotely for a server that is running Exchange Server 2007

For a server that is running Microsoft Exchange Server 2007, you try to load the MSExchangeIS performance counters remotely. The performance counters do not load, and you receive the following results:

• For the Performance Monitor tool, the counters are not displayed.
• For a WMI Query, the remote computer returns an "Invalid Class" error.

This issue occurs because the MSExchangeIS Performance Counter library (Mdbperf.dll) does not load its performance counters. These performance counters must be used in the security context of the remote caller. In this case, the remote caller does not have permission to register "MSExchangeIS" as an event log source within the Application log. The MSExchangeIS event log source is created to support the logging of performance counter failures. The failure to register the event log source causes the MSExchangeIS Performance Counter library not to load, and this omits the MSExchangeIS performance counters from the list of available performance counters.

By default, only members of the Administrators group, system accounts, service accounts, and the interactive user (NT AUTHORITY\INTERACTIVE) accounts are granted permissions to register an event log source that is used to write to the event log. Be aware that this permission is not granted to BUILTIN\Users accounts.

To work around this issue, you have to grant the BUILTIN\Performance Monitor Users group (S-1-5-32-558) permissions to Write to the Application log on the Exchange 2007 server. Then, you must use the BUILTIN\Performance Monitor Users group to grant remote access to the performance counters. To do this, follow these steps.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate, and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application
3. Right-click CustomSD, and then click Modify.
4. In the Edit String dialog box, append the following string to the value that appears in the Value data box:
   (A;; 0x2;;; S-1-5-32-558)
5. Exit Registry Editor.
6. Restart the computer.

The remote user must have permissions on the server to view the performance counters. To grant these, follow these steps.

For Performance Monitor

1. Create a domain user. This user will monitor the server. For example, create MyDomain\PerformanceMonitorUser.
2. Add the domain user to the BUILTIN\Performance Monitor Users group on the Exchange 2007 server.
3. Make sure that the Remote Registry Service is enabled. To do this, follow these steps:
   1. Click Start, point to Programs, point to Administrative Tools, and then click Services.
   2. Locate the Remote Registry Service. If it is stopped, right-click Remote Registry Service, and then click Properties.
   3. On the Startup type drop-down list, click Automatic.
   4. Under Service status, click Start.
   5. Click OK, and then close Services.

For WMI Query

1. Create a domain user. This user will monitor the server. For example, create MyDomain\WMIUser.
2. Add the domain user to the following groups on the Exchange 2007 server:
   • BUILTIN\Performance Monitor Users
   • BUILTIN\Distributed COM Users