Tuesday, March 17, 2009

Windows Vista, event ID 10 repeatedly shows up in log

I was diagnosing an issue with a Windows Vista laptop and ran across this. Event ID 10 errors were in the event log repeatedly, and even though I didn't think it was related, I found a solution. You can find it in MS KB 950375.

You need to create a visual basic file, .vbs, using NotePad, with the following code inside:

strComputer = "." 
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\subscription")

Set obj1 = objWMIService.Get("__EventFilter.Name='BVTFilter'")
set obj2set = obj1.Associators_("__FilterToConsumerBinding") 
set obj3set = obj1.References_("__FilterToConsumerBinding") 

For each obj2 in obj2set 
WScript.echo "Deleting the object" 
WScript.echo obj2.GetObjectText_ 

For each obj3 in obj3set 
WScript.echo "Deleting the object" 
WScript.echo obj3.GetObjectText_ 

WScript.echo "Deleting the object" 
WScript.echo obj1.GetObjectText_ 

To create the .vbs file, you'll either need to use Save As from within Notepad, or you'll have to show extensions on files so you can change them.

After you have your .vbs file with the code above inside, you need to run it with administrative priveleges. The easiest way to do this is from the command line. Right-click the shortcut to the command prompt, and select "Run as administrator". If you don't have a shortcut, you can find the program at C:\Windows\system32\cmd.exe on your computer. From here, run your .vbs file from the command prompt and it should take care of the problem. You can do that by simply typing in the full path to the file, e.g. C:\Users\username\Desktop\test.vbs, and pressing Enter. If there are spaces in any of the directory names in the path, be sure to surround the entire path with double-quotes.

No comments: