Windows Event ID 1023 – Perflib: Performance Counter Registry Corruption

Start by examining the specific error details and assessing the scope of performance counter corruption.

1. Open Event Viewer → Windows Logs → Application
2. Filter for Event ID 1023 from source Perflib:

   Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1023; ProviderName='Perflib'} -MaxEvents 20 | Format-Table TimeCreated, LevelDisplayName, Message -Wrap

3. Check Performance Monitor functionality by running perfmon.exe and attempting to add counters
4. Test basic performance counter access:

   Get-Counter "\Processor(_Total)\% Processor Time" -MaxSamples 1

5. Verify WMI performance provider status:

   Get-WmiObject -Class Win32_PerfRawData_PerfOS_Processor | Select-Object Name, PercentProcessorTime

Use the built-in Lodctr utility to rebuild corrupted performance counter registry entries.

1. Open Command Prompt as Administrator
2. Stop dependent services that might interfere with counter rebuilding:

   Stop-Service -Name "WinRM", "WMI", "PerfHost" -Force -ErrorAction SilentlyContinue

3. Rebuild all performance counters from system manifests:

   lodctr /R

4. If the rebuild fails, force recreation of the performance registry:

   cd /d %windir%\system32
   lodctr /R
   cd /d %windir%\sysWOW64
   lodctr /R

5. Restart the system and verify counter functionality:

   Restart-Computer -Force

6. After restart, test performance counter access:

   Get-Counter "\Memory\Available MBytes", "\Processor(_Total)\% Processor Time" -MaxSamples 3

Perform manual registry cleanup when automated rebuilding fails to resolve persistent corruption.

1. Create a registry backup before making changes:

   reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" C:\Backup\Perflib_backup.reg

2. Stop all performance-related services:

   $services = @('WinRM', 'WMI', 'PerfHost', 'PLA', 'WdiServiceHost')
   $services | ForEach-Object { Stop-Service -Name $_ -Force -ErrorAction SilentlyContinue }

3. Navigate to the performance library registry key and examine corruption:

   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009

4. Check for invalid or missing Counter and Help values:

   Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009" -Name "Counter", "Help" | Format-List

5. If Counter or Help values are corrupted, restore from a known good system or use system file checker:

   sfc /scannow
   Dism /Online /Cleanup-Image /RestoreHealth

6. Rebuild counters after registry cleanup:

   lodctr /R

Rebuild the WMI repository when performance counter corruption extends to WMI performance providers.

1. Stop WMI and dependent services:

   Stop-Service -Name "Winmgmt" -Force
   Stop-Service -Name "WMI*" -Force -ErrorAction SilentlyContinue

2. Reset WMI repository to default state:

   winmgmt /resetrepository

3. If repository reset fails, manually rebuild it:

   cd /d %windir%\system32\wbem
   for /f %s in ('dir /b *.dll') do regsvr32 /s %s
   for /f %s in ('dir /b *.exe') do call :FixSrv %s
   wmiprvse /regserver
   winmgmt /regserver

4. Recompile MOF files for performance providers:

   mofcomp cimwin32.mof
   mofcomp rsop.mof
   mofcomp wmipcima.mof

5. Restart WMI service and verify performance provider functionality:

   Start-Service -Name "Winmgmt"
   Get-WmiObject -Class Win32_OperatingSystem | Select-Object TotalVisibleMemorySize, FreePhysicalMemory

6. Rebuild performance counters after WMI restoration:

   lodctr /R

Perform comprehensive system file restoration when corruption affects core Windows performance components.

1. Run comprehensive system file checker with component store repair:

   Dism /Online /Cleanup-Image /CheckHealth
   Dism /Online /Cleanup-Image /ScanHealth
   Dism /Online /Cleanup-Image /RestoreHealth

2. Execute system file checker to repair corrupted performance library files:

   sfc /scannow

3. Check for specific performance library file corruption:

   $perfFiles = @('perflib.dll', 'perfdisk.dll', 'perfnet.dll', 'perfos.dll', 'perfproc.dll')
   $perfFiles | ForEach-Object {
       $file = Get-Item "$env:SystemRoot\System32\$_" -ErrorAction SilentlyContinue
       if ($file) { Write-Host "$_ - Version: $($file.VersionInfo.FileVersion)" }
       else { Write-Host "$_ - MISSING" -ForegroundColor Red }
   }

4. Reset Windows performance toolkit components:

   regsvr32 /s pdh.dll
   regsvr32 /s perfmon.exe
   regsvr32 /s wmiprvse.exe

5. Rebuild performance infrastructure from scratch:

   lodctr /R
   winmgmt /resyncperf
   wmiadap /f

6. Verify complete restoration with comprehensive counter test:

   $testCounters = @(
       "\Processor(_Total)\% Processor Time",
       "\Memory\Available MBytes",
       "\PhysicalDisk(_Total)\Disk Reads/sec",
       "\Network Interface(*)\Bytes Total/sec"
   )
   $testCounters | ForEach-Object {
       try {
           $result = Get-Counter $_ -MaxSamples 1 -ErrorAction Stop
           Write-Host "✓ $_ - Working" -ForegroundColor Green
       } catch {
           Write-Host "✗ $_ - Failed: $($_.Exception.Message)" -ForegroundColor Red
       }
   }