Repairing WMI repository issues

Question

Workstations log Event ID 1085 at startup because GPO WMI filters cannot be evaluated due to a corrupted local WMI repository. What is the best way to repair the WMI repository silently using a script ?

Answer 1

Try the following:

@echo off

:: Check repository consistency
winmgmt /verifyrepository | find /I "inconsistent" >nul
if %errorlevel%==0 (
    net stop winmgmt /y
    winmgmt /salvagerepository
    winmgmt /verifyrepository | find /I "inconsistent" >nul
    if %errorlevel%==0 (
        winmgmt /resetrepository
    )
    net start winmgmt
)

:: Recompile MOF files (optional but recommended)
for /f %%i in ('dir /b /s "%windir%\System32\wbem\*.mof" "%windir%\System32\wbem\*.mfl"') do mofcomp "%%i" >nul 2>&1

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Use the least-destructive approach first, and avoid deleting or rebuilding the repository as a first step. Microsoft explicitly warns that deleting or rebuilding the WMI repository can damage the system or installed applications, and rebuilding resets WMI to its initial OS-install state.

A silent repair script can follow this sequence from an elevated command prompt or startup script:

1. Verify repository consistency:

winmgmt /verifyrepository

2. If WMI-related errors persist, re-register WMI provider DLLs and recompile MOF files:

sc config winmgmt start= disabled
net stop winmgmt /y
%systemdrive%
cd %windir%\system32\wbem
for /f %%s in ('dir /b *.dll') do regsvr32 /s %%s
sc config winmgmt start= Auto
net start winmgmt
dir /b *.mof *.mfl | findstr /v /i uninstall > moflist.txt & for /F %%s in (moflist.txt) do mofcomp %%s

Notes:

• Run it elevated.
• This restarts the WMI service.
• regsvr32 /s runs silently.
• Recompiling MOF files restores built-in providers in the default path.

For the specific GPO WMI filter startup issue, also check whether the filter itself is inefficient. A documented cause of slow or failed evaluation is a broad query such as:

Select * from Win32_NTDomain where ClientSiteName = "XYZ"

A more targeted query is:

Select * from Win32_NTDomain where DomainName = "Domain_name" AND ClientSiteName = "XYZ"

This can reduce timeout-related Event ID 1085 scenarios when the repository is not the only problem.

If the affected systems are Windows Server 2008 R2 SP1, Microsoft also documents a related hotfix requirement for GPO WMI filter issues.

---

References:

• Scenario guide: Troubleshoot WMI connectivity and access issues
• WMI Troubleshooting
• Group policy with WMI filters can be denied or cause slow logon/boot