There was an issue when you monitored DNS server roles on Windows Server 2012 R2 servers. The DNS PowerShell WMI provider would leak memory each time it was called. When you monitor DNS, and leverage this WMI provider, you would see an aggressive memory leak occur in ONE of the WmiPrvSE.exe processes on the server.
This leak would continue until the WMI process reached around 500 to 600 MB of private bytes, until the WMI process would eventually become unresponsive, and crash:
Log Name: Application
Source: Application Error
Date: 6/2/2014 4:15:39 PM
Event ID: 1000
Task Category: (100)
Faulting application name: wmiprvse.exe, version: 6.3.9600.16384, time stamp: 0x5215f9c9
Faulting module name: DnsServerPsProvider.dll, version: 6.3.9600.16384, time stamp: 0x5215e759
Exception code: 0xc0000005
Fault offset: 0x00000000000ef9d1
Faulting process id: 0x16b4
Faulting application start time: 0x01cf7c789301e26b
Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
Faulting module path: C:\Windows\System32\wbem\DnsServerPsProvider.dll
Report Id: 0b622ace-ea9b-11e3-80ce-00155d0ad51b
Faulting package full name:
Faulting package-relative application ID:
During this time just before the crash, SCOM management packs querying WMI might generate alerts, such as:
Script Based Test Failed to Complete.
The error returned was: 'Object required' (0x1A8)
Failed to convert to UTC time.
The error returned was: 'No more threads can be created in the system.' (0x800700A4)
Operations Manager failed to run a WMI query
Details: No more threads can be created in the system.
Windows DNS – WMI Validation Failed
Testing the WMI namespace root\MicrosoftDNS has failed twice in a row.
Details: Unexpected error
If you monitor the WMI process private bytes memory utilization, you will see the leak quite clearly:
There is now a hotfix to address this issue!
I recommend applying this hotfix as soon as possible to any DNS server or Domain Controller running the DNS server role.
The hotfix/KB article for this specific issue is located at:
You can apply the hotfix in one of two very specific ways:
Option 1: Apply the May 2014 Windows Server Hotfix Rollup for WS2012R2 (2955164) which includes this fix:
Option 2: Apply the April 2014 Windows Server Hotfix Rollup for WS2012R2 (2919355) *and* then the specific hotfix for the issue (2954185)
And remember – I also recommend the following hotfix in addition – to resolve a problem with the agents failing on Windows Server 2012 R2 Domain Controllers: http://blogs.technet.com/b/kevinholman/archive/2014/03/03/agents-on-windows-2012-r2-domain-controllers-can-stop-responding-or-heart-beating.aspx
I have added both of these to my recommended SCOM Hotfix list: