Windows 2000::WMI

PROBLEM:
WMI services (winmgmt) is utilizing 100% cpu until manually stopped. Must be disabled because it will startup on it's own later.
SOLUTION:
Sometimes it works to stop the service and remove the Repository files under: C:\WINNT\SYSTEM32\WBEM\REPOSITORY
Then restart the service.
I am continuting to have this problem recur on several machines.
Any ideas for me? E-Mail Me

Windows 2000/XP::Default Services

From: Microsoft

The following table lists the default services for a typical installation of Windows XP Professional, along with their default startup settings. Your list of services might be different, depending on the components selected during installation and any additional programs that have been installed.

Service	Startup Type	Log On As	Additional information
Alerter	Manual	Local Service
Application Layer Gateway	Manual	Local Service
Application Management	Manual	Local System
Automatic Updates	Automatic	Local System
Background Intelligent Transfer Service	Manual	Network Service	For information about troubleshooting problems associated with this service, see Background Intelligent Transfer Service (BITS) inactive job timeout
ClipBook	Manual	Local System
COM+ Event System	Manual	Local System
COM+ System Application	Manual	Local System
Computer Browser	Automatic	Local System
Cryptographic Services	Automatic	Local System
DHCP Client	Automatic	Local System
Distributed Link Tracking Client	Automatic	Local System
Distributed Transaction Coordinator	Manual	Network Service
DNS Client	Automatic	Network Service
Error Reporting	Automatic	Local System
Event Log	Automatic	Local System
Fast User Switching Compatibility	Manual	Local System
Help and Support	Automatic	Local System
Human Interface Device Access	Disabled	Local System
IMAPI CD-Burning COM	Manual	Local System
Indexing Service	Manual	Local System	You can use Indexing Service to index documents and document properties on your disks and store the information in a catalog. For more information, see Indexing Service
Internet Connection Firewall (ICF)/Internet Connection Sharing	Automatic	Local System
Internet Connection Sharing	Manual	Local System
IPSec Services	Automatic	Local System
Logical Disk Manager	Automatic	Local System
Logical Disk Manager Administrative Service	Manual	Local System
Messenger	Automatic	Local Service	This service must be running for alert notifications to be received. For more information about performance, see Introduction to Performance This service must be running on recipient computers so that those computers can receive console messages. For more information about console messages, see Send Console Message
MS Software Shadow Copy Provider	Manual	Local System
Net Logon	Automatic	Local System
NetMeeting Remote Desktop Sharing	Manual	Local System
Network Connections	Manual	Local System
Network DDE	Manual	Local System
Network DDE DSDM	Manual	Local System
Network Location Awareness (NLA)	Manual	Local System
NT LM Security Support Provider	Manual	Local System
Performance Logs and Alerts	Manual	Network Service
Plug and Play	Automatic	Local System
Portable media serial number	Automatic	Local System
Print Spooler	Automatic	Local System	If you are having trouble with a printer not responding, you can try restarting this service. This cancels all pending print jobs.
Protected Storage	Automatic	Local System
QoS RSVP	Manual	Local System
Remote Access Auto Connection Manager	Manual	Local System
Remote Access Connection Manager	Manual	Local System
Remote Desktop Help Session Manager	Manual	Local System
Remote Procedure Call (RPC)	Automatic	Local System
Remote Procedure Call (RPC) Locator	Manual	Network Service
Remote Registry	Automatic	Local Service	For troubleshooting performance problems relating to this service, see Troubleshooting
Removable Storage	Manual	Local System
Routing and Remote Access	Manual	Local System
Secondary Logon	Automatic	Local System	For more information about the Secondary Logon service, see To start the Secondary Logon service
Security Accounts Manager	Automatic	Local System
Server	Automatic	Local System	Stopping this service disconnects any open sessions with a remote computer.
Shell Hardware Detection	Automatic	Local System
Smart Card	Manual	Local Service
Smart Card Helper	Manual	Local Service
SSDP Discovery	Manual	Local Service
System Event Notification	Automatic	Local System
System Restore Service	Automatic	Local System
Task Scheduler	Automatic	Local System
TCP/IP NetBIOS Helper	Automatic	Local Service
Telephony	Manual	Local System
Telnet	Manual	Local System
Terminal Services	Manual	Local System
Themes	Automatic	Local System
Uninterruptable Power Supply	Manual	Local Service
Universal Plug and Play Device Host	Manual	Local System
Upload Manager	Automatic	Local System
Utility Manager	Manual	Local System
Volume Shadow Copy	Manual	Local System
WebClient	Automatic	Local Service
Windows Audio	Automatic	Local System
Windows Image Acquisition (WIA)	Manual	Local System
Windows Installer	Manual	Local System
Windows Management Instrumentation	Automatic	Local System
Windows Time	Automatic	Local System
Wireless Zero Configuration service	Automatic	Local System
WMI Performance Adapter	Manual	Local System
Workstation	Automatic	Local System

Windows 2000::Disabling Unneeded Services

From: ZDNet

Service	You can set it to manual if…
DHCP Client	You're not connecting to a specific DHCP server on your local network
Distributed Link Tracking Client	You're not connected to a Windows 2000 domain
DNS Client	You're not connecting to a specific DNS server on your local network
FTP Publishing Service	You don't need your system to act as an FTP server
IIS Admin Service	You don't need your system to act as an WWW server
IPSEC Policy Agent	You're not connected to a Windows 2000 domain
Messenger	You're not connected to a Windows 2000 domain
Remote Registry Service	You don't remotely access the Registry of other systems on your local network
RIP Service	You don't need your system to act as a router
RunAs Service	You don't use any applications that run as an alias
World Wide Web Publishing Service	You don't need your system to act as an WWW server

Windows 2000::Disabling Windows File Protection

The value of 4 below sounds promising. This could make the BAT file approach work.
Change the value data for the SFCDisable (REG_DWORD) value to 1 in the
following
registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

NOTE: For the change to this value to become effective you must restart the
computer. Also, if you are disabling WFP, a kernel debugger must be
connected to
the computer.

Following is a complete list of values for SFCDisable:
- 0 = enabled (default)
- 1 = disabled, prompt at restart to re-enable
- 2 = disabled at next restart only, no prompt to re-enable
- 4 = enabled, with popups disabled
The problem is the restart thing - this complicates the implementation since we have to know the workstation has restarted since the registry change was merged.

Windows 2000::Windows File Protection::Disabling

From GROUPS.GOOGLE.COM:
---------- Forwarded message ----------
Date: Sat, 24 Jun 2000 06:16:46 -0400
From: Jeremy Collake
Reply-To: Windows NTBugtraq Mailing List
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: W2k undocumented registry setting fully disables Windows File
Protection

6:13am 6/24

Summary: Undocumented registry setting allows for
Windows File Protection (aka System File Checker)
to be fully disabled.

HowTo: Set the SFCDisable value (see Q222473) to
0xffffff9d.

Ok, after spending 6 hours in the guts of sfc.dll, sfcfiles.dll,
and winlogon.exe I have *finally* discovered how to permanently
disable windows file protection. The more I dug into the internals
of SFC, the more I began to think that it would not be as easy as
I first thought it would be - and indeed Microsoft does not want it
to be easy. Windows File Protection, while annoying, does provide
a good degree of system stability and even some level of virus/trojan
protection by preventing system files from being modified without
at least notifying the user. Therefore, I was *very* shocked when
I was looking through a disassembly of sfc.dll and came to the code
that checks the value of the SfcDisable in the WinLogon key.
I see in the code of ordinal 2 (which is the initialization function
that winlogon calls), sticking out like a sore thumb, this:

76986A89 push 1
76986A8B cmp eax, ebx
76986A8D pop esi
76986A8E jz loc_76986B97
76986A94 cmp eax, esi
76986A96 jz loc_76986B7A
76986A9C cmp eax, 2
76986A9F jz loc_76986B69
76986AA5 cmp eax, 3
76986AA8 jz short loc_76986AE0
76986AAA cmp eax, 4
76986AAD jz short loc_76986ACF
76986AAF cmp eax, 0FFFFFF9Dh
76986AB2 push ebx
76986AB3 jz loc_76986B86
76986AB9 push offset byte_76981898
76986ABE push edi
76986ABF call sub_7698877D
76986AC4 mov dword_769901D4, ebx
76986ACA jmp loc_76986B97

Ok, values 0, 1, 2, 3, and 4 are documented at
http://support.microsoft.com/support/kb/articles/Q222/4/73.ASP , but
what the heck is this 0ffffff9dh value that it accepts?! As you can
see, any value other than 0,1,2,3,4 and 0ffffff9dh are assumed to be
zero, which is the default of SFC enabled with popups enabled. So,
without further delay, I went and plugged 0ffffff9dh into the SfcDisable
value to see what was up. Rebooted. I'll be darned, Microsoft provided
a very,very simple way to fully disable WFP!

When booting with this value in the SFCDisable value in the WinLogon
key (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon), an
event is written to the system log, ID 64032 from Windows File
Protection, with the description:
"Windows File Protection is not active on this system. ".

All attempts to replace/delete protected system files succeeded,
just as if I were in safe mode :). I rebooted a few more times and
verified that it is the one value (other than 4=popus disabled) that
is not reset to 0 after the first boot.

Windows 2000::Windows File Protection::Automation

Eeeeeviiiil Solitaire
My highest priority today is I must create an invisible automatic "thing" to remove the games from all user machines. In simpler days I would have written a BAT file to remove the EXE files and the menu items. However when you do it that way, SOL.EXE, WINMINE.EXE, FREECELL.EXE mysteriously come back.
This is because Windows File Protection maintains control over the WINNT\SYSTEM32 directory. Since SOL.EXE is such a vital part of the Windows 2000 Professional operating system it was placed in this directory to ensure it is never deleted or overwritten with a different version.
WFP maintains it's "master" copy of these files in C:\WINNT\SYSTEM32\DLLCACHE (which BTW is cleverly flagged as hidden.) If my BAT removes SOL.EXE from that directory first and then from SYSTEM32 then the file doesn't come back, but a warning message comes up during it's execution about something diabolical happening to your system files and prompting for the Windows CD.
A commandline such as: RunDll32 advpack.dll,LaunchINFSection %windir%\INF\games.inf,FreecellUninstall does not run silently and doesn't appear to work either (even though it tells me it's removing files.)
There must be some way to execute the uninstall by whatever method the control panel-add remove programs applet does it.
Any ideas? E-Mail Me PLEEEESE.
Of course if I find an elegant solution I'll put it out here.