Network Management

Agent Node Polling failing on Windows server due to corrupted PerfProc WMI counters

After upgrading to SWOES – Network Performance Monitor 2026.1, a Windows server monitored via agent starts generating “Node polling failing” alerts even though statistics still appear in the web console.

First published date

3/24/2026 7:16 PM

Last published date

3/24/2026 8:46 PM

Overview

After upgrading to SolarWinds Platform 2026.1 and upgrading the agent on the additional web server, the out-of-the-box Node polling failing alert starts firing for that node, even though the node still returns some statistics in SolarWinds. On the node detail page, it displays this error:

 

Agent logs show WinRM/WMI query failures against Win32_PerfRawData_PerfProc_Process, indicating a problem with the underlying PerfProc performance counters on the server.

Product section

Network Performance Monitor

Cause

The Windows server’s PerfProc performance counters / Win32_PerfRawData_PerfProc_Process WMI class in root\cimv2 are corrupted or not functioning correctly.

Agent WMI queries such as:

select IDProcess, PercentProcessorTime, TimeStamp_Sys100NS, WorkingSet, IOReadOperationsPersec, IOWriteOperationsPersec from Win32_PerfRawData_PerfProc_Process where (IDProcess = …)

fail with errors like “The WQL query is invalid” and WinRM error code 0x80041017, causing SolarWinds to report node polling failing even though basic stats are still collected.

 

Resolution

1. Verify whether the PerfProc class is the cause. Open PowerShell as Administrator on the affected server and run the following command:

 

Get-CimInstance -Namespace root\cimv2 -ClassName Win32_PerfRawData_PerfProc_Process -ErrorAction Stop

 

If you receive an error such as “The WQL query is invalid” or 0x80041017, this confirms that the PerfProc performance counters / WMI class are corrupted or not functioning properly.

 

2. Restart WMI service on the same server.

- Run services.msc.

- Restart Windows Management Instrumentation (WMI) service.

 

3. Rebuild perf counters and resync to WMI

- In an elevated Command Prompt on that server:

 

cd %windir%\system32

lodctr /R
cd %windir%\syswow64

lodctr /R

wmiadap.exe /f

 

- lodctr /R rebuilds the performance counter registry data.

- wmiadap.exe /f forces WMI to resync from the counters. 

- Then restart the WMI service again, or reboot the server if possible.

 

4. Make sure PerfProc counters aren’t disabled

- Run regedit.

- Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance

- Check Disable Performance Counters: It must be 0 (enabled). If it’s 1, change it to 0 and reboot. 

 

5. You can also enable the PerfOS counters via lodctr

- lodctr /E:PerfOS — enabled the PerfOS counters.
- lodctr /Q:PerfOS — confirmed [PerfOS] Performance Counters (Enabled).
- wmiadap.exe /f — refreshed WMI performance classes.
- winmgmt.exe /resyncperf — resynchronized performance libraries with WMI; no output is normal.  
- Restart Windows Management Instrumentation

 

6. Rerun the Get-CimInstance test

 

If this returns instances and values (no error), the agent/WinRM query should also start working and the SolarWinds error should clear on the next polls.