Windows Event ID 301 – Unknown: System Performance Counter Collection Error

The most effective first-line approach involves rebuilding the performance counter registry using built-in Windows utilities.

Step 1: Open Command Prompt as Administrator

Step 2: Stop the Performance Logs and Alerts service:

Stop-Service -Name "pla" -Force

Step 3: Rebuild performance counters using lodctr:

cd /d c:\windows\system32
lodctr /R

Step 4: If the above fails, use the more aggressive rebuild:

cd /d c:\windows\inf
lodctr /R

Step 5: Restart the Performance Logs and Alerts service:

Start-Service -Name "pla"

Step 6: Verify the fix by checking Event Viewer for new Event ID 301 occurrences and test Performance Monitor functionality.

When specific performance counters cause the issue, identify and remove the problematic entries manually.

Step 1: Query current performance counter status:

Get-Counter -ListSet * | Where-Object {$_.CounterSetName -like "*error*"}

Step 2: Check Event Viewer for additional details:

Navigate to Event Viewer → Windows Logs → System and filter for Event ID 301 to identify specific counter names mentioned in error details.

Step 3: Access the performance counter registry:

Set-Location "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009"

Step 4: Backup the registry key before modification:

reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" C:\temp\perflib_backup.reg

Step 5: Remove problematic counter entries using unlodctr:

unlodctr "ProblemCounterName"

Step 6: Restart the system and verify resolution.

Address underlying system file corruption that may affect performance counter infrastructure.

Step 1: Run System File Checker scan:

sfc /scannow

Step 2: Check SFC results and run DISM if corruption found:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Step 3: Verify Windows component store integrity:

Get-WindowsImage -Online | Select-Object ImageHealthState

Step 4: Re-register performance counter DLLs:

regsvr32 /s pdh.dll
regsvr32 /s winmm.dll
regsvr32 /s perfproc.dll

Step 5: Restart Windows Management Instrumentation service:

Restart-Service -Name "winmgmt" -Force

Step 6: Test performance counter functionality using Performance Monitor or PowerShell Get-Counter cmdlets.

For persistent issues requiring deep registry investigation and manual counter reconstruction.

Step 1: Export and analyze performance counter registry structure:

$PerfLib = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009"
$PerfLib.Counter | Out-File C:\temp\counter_analysis.txt

Step 2: Compare against known good system or use Microsoft's performance counter reference:

typeperf -qx | Out-File C:\temp\available_counters.txt

Step 3: Identify missing or corrupted counter definitions by examining the Counter and Help registry values for inconsistencies or null entries.

Step 4: Manually reconstruct problematic entries using lodctr with specific INI files:

lodctr /M:C:\Windows\inf\perfc009.ini
lodctr /M:C:\Windows\inf\perfh009.ini

Step 5: Verify counter database consistency:

lodctr /Q | findstr "Error\|Warning"

Step 6: Test specific counter categories that were problematic:

Get-Counter "\Processor(_Total)\% Processor Time" -SampleInterval 1 -MaxSamples 5

Nuclear option for severe corruption requiring complete performance counter infrastructure reset.

Step 1: Create comprehensive system backup and registry backup:

wbadmin start backup -backupTarget:E: -include:C: -allCritical -quiet

Step 2: Stop all performance-related services:

$Services = @("pla", "winmgmt", "pcasvc", "PerfHost")
$Services | ForEach-Object { Stop-Service -Name $_ -Force -ErrorAction SilentlyContinue }

Step 3: Remove entire performance counter registry structure:

Remove-Item "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" -Recurse -Force

Step 4: Rebuild from Windows installation files:

cd /d %windir%\inf
lodctr /R:perfc009.ini
lodctr /R:perfh009.ini
lodctr /R:perfd009.ini

Step 5: Re-register all system performance counter providers:

for /f %i in ('dir /b %windir%\system32\*.dll ^| findstr perf') do regsvr32 /s %windir%\system32\%i

Step 6: Restart services and verify complete functionality:

$Services | ForEach-Object { Start-Service -Name $_ -ErrorAction SilentlyContinue }
Get-Counter -ListSet * | Measure-Object