On Sun, 18 Dec 2005 12:50:28 -0700, Wesley Vogel wrote:
> I did not post anything about the Windows Management Instrumentation
> service. Leave it set to Automatic in services.msc.
> I suggested disabling WMI logging.

Oh. OK. I am less confused now. Thank you for your patience. I've never
encountered this thing called windows management instrumentation before so
I'm starting with a knowledge base of zero (other than what I glean from
google and learn from you from your kind efforts).

I right clicked on the WinXP SP2 "My Computer", pressed "Manage", "Services
and Applications", and right clicked on "WMI Control", "Properties" which
then said "Connecting to Windows Management" and brought up a 5-tab "WMI
Control Properties" form.

Pressing on the "Logging" tab for the first time, I see it was actually set
to "Errors only". As a test, I set it next to "Verbose" and noticed LOTS of
new logs showed up in C:\windows\system32\wbem\Logs, e.g., Framework.log,
provss.log, wbemcore.log, WinMgmt.log, wbemprox.log, etc.

Looking in the various logs, I find strange reports such as:
CWbemProviderGlue::Init 12/18/2005 11:14:14.228 thread:3982
[d:\xpsprtm\admin\wmi\wbem\sdk\framedyn\wbemglue.cp p.199]
Failed to open thread token: (1008) 12/18/2005 11:14:14.228 thread:3984
But my D: drive is almost wholly empty (except for something hidden called
"System Volume Information" and "MSOCache".

Do these tell us anything?