我需要解决一些我们正在遭受的WMI崩溃。 不幸的是，事件日志没有显示任何细节，因为描述丢失。 这是日志说：
The description for Event ID 5612 from source **Microsoft-Windows-WMI** cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event. The following information was included with the event: HandleCount 4116 4096 10508 我已经通过微软的知识库文章了解如何解决“找不到事件消息”的问题（ https://support.microsoft.com/en-us/kb/166902 ），但没有任何运气。
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\**WMI.NET Provider Extension**下的registry项EventMessageFile指向存在的C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EventLogMessages.dll 。
将registry项与正确显示此特定事件ID的系统进行比较不会显示任何差异。 另外EventLogMessages.dll具有相同的版本和校验和。
我正在查看正确的registry项吗？
pathHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\WinMgmt只包含一个名为ProviderGuid的键。 但是，这似乎是好的，因为描述显示在具有相同（且仅此）密钥的系统上。
[编辑]
我的确在查看错误的registry项。 正确的是HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Microsoft-Windows-WMI完全缺失。 在HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}find提供程序configuration中缺less的一个名为Enabled和ChannelReferences子项的键。
添加这些键使得WMI事件正确显示。 然而它只能持续到系统重启。 现在的registry键在那里，因为他们应该是，但仍然没有适当的事件显示…任何想法？
这是我从一个工作系统导出的确切的registry设置：
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Microsoft-Windows-WMI] "ProviderGuid"="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" "EventMessageFile"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,\ 00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\ 5c,00,77,00,62,00,65,00,6d,00,5c,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,\ 00,52,00,2e,00,64,00,6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}] @="Microsoft-Windows-WMI" "ResourceFileName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,\ 00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\ 5c,00,77,00,62,00,65,00,6d,00,5c,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,\ 00,52,00,2e,00,64,00,6c,00,6c,00,00,00 "MessageFileName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\ 6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\ 00,77,00,62,00,65,00,6d,00,5c,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,00,\ 52,00,2e,00,64,00,6c,00,6c,00,00,00 "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}\ChannelReferences] "Count"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}\ChannelReferences\0] @="Application" "Id"=dword:00000009 "Flags"=dword:00000001
使用EventCreate命令行命令可以轻松地添加缺less的事件ID。 有关更多信息， 请访问https://technet.microsoft.com/en-us/library/bb490899.aspx 。