windows服务器WMI错误事件Event filter with query造成死机重启的解决方法

主机因WMI的事件10出现自动重启或死机：

错误日志：

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

XML日志：

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System>  <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />  <EventID Qualifiers="49152">10</EventID>  <Version>0</Version>  <Level>2</Level>  <Task>0</Task>  <Opcode>0</Opcode>  <Keywords>0x80000000000000</Keywords>  <TimeCreated SystemTime="2023-12-28T17:17:53.000000000Z" />  <EventRecordID>16509</EventRecordID>  <Correlation />  <Execution ProcessID="0" ThreadID="0" />  <Channel>Application</Channel>  <Computer>A-201705061927</Computer>  <Security />  </System> <EventData>  <Data>//./root/CIMV2</Data>  <Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99</Data>  <Data>0x80041003</Data>  </EventData>  </Event>

解决办法：

建立一个 test.vbs 文件，贴入如下内容，保存，然后以管理员模式运行cmd，在cmd里执行test.vbs

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _

& "{impersonationLevel=impersonate}!\\" _

& strComputer & "\root\subscription")

Set obj1 = objWMIService.ExecQuery("select * from __eventfilter where name='BVTFilter' and query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ""Win32_Processor"" AND TargetInstance.LoadPercentage > 99'")

For Each obj1elem in obj1

set obj2set = obj1elem.Associators_("__FilterToConsumerBinding")

set obj3set = obj1elem.References_("__FilterToConsumerBinding")

For each obj2 in obj2set

WScript.echo "Deleting the object"

WScript.echo obj2.GetObjectText_

obj2.Delete_

next

For each obj3 in obj3set

WScript.echo "Deleting the object"

WScript.echo obj3.GetObjectText_

obj3.Delete_

next

WScript.echo "Deleting the object"

WScript.echo obj1elem.GetObjectText_

obj1elem.Delete_

Next

或者到这里下载VBS文件http://soft.jy6d.com/v/20240114104852.html