Windows Event ID 1006 – WinMgmt: WMI Performance Adapter Registration Failure

Start by checking the current status of WMI services and performing a controlled restart to clear temporary registration issues.

1. Open PowerShell as Administrator and check WMI service status:

Get-Service -Name "Winmgmt" | Select-Object Name, Status, StartType
Get-Service -Name "WmiApSrv" | Select-Object Name, Status, StartType

2. Stop WMI services in the correct order:

Stop-Service -Name "WmiApSrv" -Force
Stop-Service -Name "Winmgmt" -Force

3. Wait 30 seconds, then restart services:

Start-Service -Name "Winmgmt"
Start-Service -Name "WmiApSrv"

4. Verify the services started successfully and check Event Viewer for new 1006 events:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1006; StartTime=(Get-Date).AddMinutes(-10)} -ErrorAction SilentlyContinue

Rebuild the WMI performance counter registration to resolve corrupted adapter mappings.

1. Open Command Prompt as Administrator and navigate to the WMI directory:

cd /d %windir%\system32\wbem

2. Re-register WMI performance providers:

for /f %s in ('dir /b *.dll') do regsvr32 /s %s
for /f %s in ('dir /b *.exe') do %s /RegServer

3. Rebuild WMI repository and performance counters:

winmgmt /resetrepository
winmgmt /resyncperf

4. Restart the system to complete the registration process, then verify using PowerShell:

Get-WmiObject -Class Win32_PerfRawData_PerfOS_System | Select-Object Name, Timestamp_Sys100NS

5. Check for successful registration in Event Viewer: Applications and Services Logs → Microsoft → Windows → WMI-Activity → Operational

Manually repair corrupted performance counter registry entries that prevent WMI adapter registration.

1. Create a registry backup before making changes:

reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" C:\Temp\perflib_backup.reg

2. Check for corrupted performance counter entries:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009" -Name "Counter" | Select-Object -ExpandProperty Counter | Measure-Object

3. Rebuild performance counters using lodctr:

lodctr /R
cd /d %windir%\inf
lodctr dfrg.ini
lodctr inetinfo.ini

4. Verify WMI can access performance data:

Get-WmiObject -Class Win32_PerfFormattedData_PerfOS_Processor | Where-Object {$_.Name -eq "_Total"} | Select-Object Name, PercentProcessorTime

5. Check registry permissions for WMI service account:

$acl = Get-Acl "HKLM:\SOFTWARE\Classes\WMI"
$acl.Access | Where-Object {$_.IdentityReference -like "*WMI*"} | Format-Table IdentityReference, FileSystemRights

Locate and remove problematic third-party WMI providers causing registration conflicts.

1. List all registered WMI providers and identify potential conflicts:

Get-WmiObject -Namespace "root\cimv2" -Class "__Win32Provider" | Select-Object Name, CLSID, HostingModel | Sort-Object Name

2. Check for providers with registration errors:

Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='WinMgmt'; Level=2} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Identify problematic provider CLSIDs from event messages and query their details:

$problemCLSID = "{GUID-FROM-EVENT}"
Get-WmiObject -Class "__Win32Provider" | Where-Object {$_.CLSID -eq $problemCLSID} | Select-Object Name, CLSID, HostingModel

4. Unregister problematic providers (replace with actual CLSID):

regsvr32 /u "C:\Program Files\VendorApp\problematic_provider.dll"

5. Clean up orphaned registry entries:

Remove-Item -Path "HKLM:\SOFTWARE\Classes\CLSID\{PROBLEMATIC-CLSID}" -Recurse -Force

6. Restart WMI services and verify provider list:

Restart-Service -Name "Winmgmt" -Force
Get-WmiObject -Class "__Win32Provider" | Measure-Object

Perform a complete WMI repository reconstruction when standard repairs fail to resolve persistent 1006 events.

1. Stop all WMI-dependent services and create service list backup:

$wmiServices = Get-Service | Where-Object {$_.ServicesDependedOn.Name -contains "Winmgmt"}
$wmiServices | Export-Csv -Path "C:\Temp\wmi_dependent_services.csv" -NoTypeInformation
$wmiServices | Stop-Service -Force

2. Stop WMI services and backup repository:

Stop-Service -Name "Winmgmt" -Force
Copy-Item -Path "C:\Windows\System32\wbem\Repository" -Destination "C:\Temp\WMI_Repository_Backup" -Recurse

3. Delete existing repository and rebuild from scratch:

cd /d %windir%\system32\wbem
rd /S /Q repository
winmgmt /resetrepository

4. Re-register all WMI components systematically:

for /f %s in ('dir /b *.mof *.mfl') do mofcomp %s
for /f %s in ('dir /b *.dll') do regsvr32 /s %s

5. Restart services in dependency order and verify functionality:

Start-Service -Name "Winmgmt"
Start-Sleep -Seconds 30
$wmiServices | Start-Service

6. Validate repository integrity and performance adapter registration:

winmgmt /verifyrepository
Get-WmiObject -Class Win32_OperatingSystem | Select-Object Caption, Version, TotalVisibleMemorySize