Every 5 minutes I have a couple of failed login attempts from a Biztalk server to the SQL server.

Login failed for user 'DOMAIN\SERVER01$'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors

I traced the failed logins to back to a service on the Biztalk server. The failed PIDs were pointing to a wmiprvse.exe that was using a LOCAL SERVICE.

I know I could either grant the Biztalk server access to the SQL server or I could change that service to run with a different account BUT I'd like to know what is using the WMI service before doing this.

How can you tell what is using the WMI service?

  • Check the application event log for errors on the Biztalk server?
    – Jon Seigel
    Commented Aug 20, 2012 at 17:33
  • After more digging in the Ops Manager Log, it turns out it was some Biztalk discovery tool. Still looking for a way to find out how to troubleshoot the WMI service though. Commented Aug 20, 2012 at 20:03

1 Answer 1


tracing WMI activity


Logging WMI activity


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.