Windows Event ID 2004 – Perflib: Performance Counter Provider Registration Failed

Start by examining the specific details of Event ID 2004 to identify which performance counter provider failed.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log for Event ID 2004 by right-clicking the System log and selecting Filter Current Log
4. Enter 2004 in the Event IDs field and click OK
5. Double-click the most recent Event ID 2004 entry to view details
6. Note the counter provider name and any error codes in the event description
7. Use PowerShell to get detailed event information:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=2004} -MaxEvents 5 | Format-List TimeCreated, Id, LevelDisplayName, Message

Record the specific counter provider name and error code for use in subsequent troubleshooting steps.

Rebuild the performance counter registry to fix corrupted counter configurations.

1. Open Command Prompt as Administrator
2. Stop the Performance Logs and Alerts service:

net stop pla

3. Navigate to the system32 directory and rebuild counters:

cd /d %windir%\system32
lodctr /R

4. If the rebuild fails, reset the performance counter repository:

winmgmt /resyncperf

5. Restart the Performance Logs and Alerts service:

net start pla

6. Verify the fix by checking if new Event ID 2004 entries appear after reboot
7. Use PowerShell to confirm counter providers are loading:

Get-Counter -ListSet * | Where-Object {$_.CounterSetName -like "*Processor*"} | Select-Object CounterSetName, Description

Verify the integrity of performance counter DLL files and repair if necessary.

1. Identify the specific DLL mentioned in the Event ID 2004 error message
2. Check if the DLL exists in the expected location:

$dllPath = "C:\Windows\System32\[CounterDLL].dll"
Test-Path $dllPath
Get-ItemProperty $dllPath | Select-Object Name, Length, LastWriteTime

3. Run System File Checker to repair corrupted system files:

sfc /scannow

4. If SFC finds issues, run DISM to repair the Windows image:

DISM /Online /Cleanup-Image /RestoreHealth

5. Check the performance counter registry entries:

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009" | Select-Object Counter, Help

6. If the DLL is missing, extract it from a Windows installation source or use:

sxstrace trace -logfile:C:\temp\sxstrace.etl
# Reproduce the error, then:
sxstrace parse -logfile:C:\temp\sxstrace.etl -outfile:C:\temp\sxstrace.txt

7. Restart the system and monitor for Event ID 2004 recurrence

Reset permissions and service configurations for the performance counter subsystem.

1. Open Services.msc and verify these services are running:
2. Performance Logs and Alerts (pla)
3. Windows Management Instrumentation (winmgmt)
4. Reset WMI repository if performance counters are WMI-based:

net stop winmgmt /y
winmgmt /resetrepository
net start winmgmt

4. Check and reset performance counter permissions:

$acl = Get-Acl "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib"
$acl.Access | Format-Table IdentityReference, FileSystemRights, AccessControlType

5. Grant necessary permissions to the Performance Counter Users group:

net localgroup "Performance Log Users" /add "NT AUTHORITY\INTERACTIVE"
net localgroup "Performance Monitor Users" /add "NT AUTHORITY\INTERACTIVE"

6. Reset the performance counter security descriptor:

lodctr /S:"C:\temp\perfcounters_backup.ini"
lodctr /R:"C:\temp\perfcounters_backup.ini"

7. Restart the system and verify performance counter functionality:

Get-Counter "\Processor(_Total)\% Processor Time" -SampleInterval 1 -MaxSamples 3

Perform advanced troubleshooting by analyzing registry corruption and removing problematic third-party counters.

1. Export the performance counter registry for analysis:

reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" C:\temp\perflib_backup.reg

2. Analyze the performance counter registry structure:

$perflib = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib"
$perflib | ForEach-Object {
    $lang = $_.PSChildName
    $counters = Get-ItemProperty $_.PSPath -Name "Counter" -ErrorAction SilentlyContinue
    if ($counters) {
        Write-Output "Language: $lang, Counter entries: $($counters.Counter.Count)"
    }
}

3. Identify and remove problematic third-party performance counters:

$services = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\*" | Where-Object {$_.ObjectName -like "*PerfCounter*"}
$services | Select-Object PSChildName, DisplayName, ObjectName

4. Remove specific counter providers that are causing issues:

unlodctr "[CounterProviderName]"

5. Check for orphaned performance counter entries:

$orphaned = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009" -Name "Counter" | 
    ForEach-Object {$_.Counter} | Where-Object {$_ -match "[0-9]+"} | 
    ForEach-Object {if (!(Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\$_" -ErrorAction SilentlyContinue)) {$_}}
$orphaned

6. Clean up orphaned entries and rebuild the counter database:

lodctr /R
winmgmt /resyncperf

7. Monitor system performance and verify all critical counters are functional:

$criticalCounters = @("\Processor(_Total)\% Processor Time", "\Memory\Available MBytes", "\LogicalDisk(_Total)\% Disk Time")
$criticalCounters | ForEach-Object {
    try {
        Get-Counter $_ -MaxSamples 1
        Write-Output "$_ - OK"
    } catch {
        Write-Output "$_ - FAILED: $($_.Exception.Message)"
    }
}