Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Troubleshooting
  New Posts New Posts RSS Feed - How to Solve GetUserDefaultLCID failed Error
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

How to Solve GetUserDefaultLCID failed Error

 Post Reply Post Reply Page  12>
Author
Message
chj124 View Drop Down
Newbie
Newbie


Joined: 26 March 2009
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote chj124 Quote  Post ReplyReply Direct Link To This Post Topic: How to Solve GetUserDefaultLCID failed Error
    Posted: 26 March 2009 at 12:45pm
is there a way using sysinternals to determin what is causing the GetUserDefaultLCID failed error in the wbemcore.log?

something is generating this error constantly causing my virus program to constantly scan this file.

its very anoying...
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Status: Offline
Points: 503
Post Options Post Options   Thanks (0) Thanks(0)   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 26 March 2009 at 9:32pm
Hi chj124,

If you are talking of the messages "GetUserDefaultLCID failed, restorting to system verion" logged in wbemcore.log under XP SP3, I suggest you could read my recent post on this topic.
If this case applies, these messages can be safely ignored and you could configure your virus program to ignore this file or disable wmi  loggings (command window for wmimgmt.msc > right click on WMI control /properties >logging tab > disable
Back to Top
chj124 View Drop Down
Newbie
Newbie


Joined: 26 March 2009
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote chj124 Quote  Post ReplyReply Direct Link To This Post Posted: 27 March 2009 at 12:51pm
i am interested in determining the application causing it (besides the dll change)

everything else is working so that i would say, yes, it can be ignored... except for the virus scanning of the file which is something we have no control over since this is corporate controlled and the paperwork involved, or time to get a change, is ridiculous.

anyway, it would be nice to determine the app the error is generated for.
Back to Top
chj124 View Drop Down
Newbie
Newbie


Joined: 26 March 2009
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote chj124 Quote  Post ReplyReply Direct Link To This Post Posted: 27 March 2009 at 2:35pm
i have turned on verbose logging and found this...

(Fri Mar 27 10:19:04 2009.88312296) : CALL ConnectionLogin::NTLMLogin
   wszNetworkResource = \\.\root\ccm\SoftwareMeteringAgent
   pPreferredLocale = (null)
   lFlags = 0x0
(Fri Mar 27 10:19:04 2009.88312296) : DCOM connection from NT AUTHORITY\SYSTEM at authentiction level Privacy, AuthnSvc = 10, AuthzSvc = 0, Capabilities = 0
(Fri Mar 27 10:19:04 2009.88312296) : GetUserDefaultLCID failed, restorting to system verion(Fri Mar 27 10:19:04 2009.88312296) : CALL CWbemNamespace::GetObject
   BSTR ObjectPath = __SystemClass
   long lFlags = 0
   IWbemClassObject ** pObj = 0x20CF918
(Fri Mar 27 10:19:14 2009.88322296) : CALL ConnectionLogin::NTLMLogin
   wszNetworkResource = \\.\root\ccm\SoftwareMeteringAgent
   pPreferredLocale = (null)
   lFlags = 0x0
(Fri Mar 27 10:19:14 2009.88322296) : DCOM connection from NT AUTHORITY\SYSTEM at authentiction level Privacy, AuthnSvc = 10, AuthzSvc = 0, Capabilities = 0
(Fri Mar 27 10:19:14 2009.88322296) : GetUserDefaultLCID failed, restorting to system verion(Fri Mar 27 10:19:14 2009.88322296) : CALL CWbemNamespace::GetObject
   BSTR ObjectPath = __SystemClass
   long lFlags = 0
   IWbemClassObject ** pObj = 0x240F918

and i am seeing DCOM errors in my event log
and i also found this in mtrmgr.log

<![LOG[Creation event received for process 1796]LOG]!><time="10:31:35.461+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:252">
<![LOG[Process ID 1796 is for process C:\Program Files\McAfee\Common Framework\McScript_InUse.exe]LOG]!><time="10:31:35.554+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="processdata.cpp:141">
<![LOG[No matching rule found for process 1796]LOG]!><time="10:31:35.554+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="3008" file="activeprocesses.cpp:65">
<![LOG[Termination event received for process 1796]LOG]!><time="10:31:37.086+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:287">
<![LOG[Termination event received for process 2444]LOG]!><time="10:34:05.179+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:287">
<![LOG[Creation event received for process 2832]LOG]!><time="10:34:28.539+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:252">


what else should i be lookin for?
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Status: Offline
Points: 503
Post Options Post Options   Thanks (0) Thanks(0)   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 27 March 2009 at 10:41pm
I can see about the same verbose messages in my wbemcore.log as you do; the only error message is "GetUserDefaultLCID failed, restorting to system verion".

If you are using XP SP3, a way to get rid of these errors is to roll back to the XP SP2 version of wbemcore.dll (which is version 5.1.2600.2180 with 530,944 bytes).
  • First try to grab a copy of wbemcore.dll from a system running XP SP2.
  • On the XP SP3 system, in safe mode, rename wbemcore.dll to something else, for example wbemcoreSP3.dll, in three locations:
      1. c:\windows\system32\wbem\
      2. c:\windows\servicepackfiles\i386\
      3. c:\windows\system32\dllcache
  • Copy the SP2 version of wbemcore.dll in each of these two folders.
  • Reboot.
In wbemcore.log, you will still see many comments in verbose mode but the "GetUserDefaultLCID failed, restorting to system verion" error should not show up. With error logging mode set, the file should be pretty quiet.


Edited by dirbase - 14 March 2010 at 12:18pm
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Status: Offline
Points: 503
Post Options Post Options   Thanks (0) Thanks(0)   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 30 March 2009 at 2:05pm
This error is generated inside wbemcore.dll due to a bug in the SP3 version; more precisely a bug in the wbemcore!GetDefaultLocale routine which has been modified from the SP2 version.
AFAIU, the error is logged if a certain memory value is 0; the problem is that this value is initialized with 0, and is not modified in standard cases! Confused

Edited by dirbase - 30 March 2009 at 2:06pm
Back to Top
chj124 View Drop Down
Newbie
Newbie


Joined: 26 March 2009
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote chj124 Quote  Post ReplyReply Direct Link To This Post Posted: 30 March 2009 at 2:09pm
thanks for the info...

do you think the dcom errors i see are related? and from the other things i noticed, is it related to the software metering agent? Dead
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Status: Offline
Points: 503
Post Options Post Options   Thanks (0) Thanks(0)   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 30 March 2009 at 2:37pm
Could you please paste the details of the dcom errors you get in your event log (the system event log, I presume..). Are the timestamps the same for the wbemcore.log errors and the DCOM events?


Edited by dirbase - 30 March 2009 at 2:46pm
Back to Top
marlbrook View Drop Down
Newbie
Newbie


Joined: 31 October 2009
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote marlbrook Quote  Post ReplyReply Direct Link To This Post Posted: 31 January 2010 at 11:15am
Thanks for the above. Very useful.
 
I was experiencing a problem which showed up when trying to play .avi files, causing them to stutter. I realised something was slowing the PC, and discovered, by examining the Sysinternals Process Monitor log, that GetUserDefaultLCID failed error in the wbemcore.log was being called repeatedly.
 
I had upgraded to XP SP3. Reverting back to the SP2 wbemcore.dll solved the problem
 
Cheers
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Status: Offline
Points: 503
Post Options Post Options   Thanks (0) Thanks(0)   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 31 January 2010 at 6:03pm
Hi marlbrook,

Good to know that the roll-back to the SP2 version of wbemcore.dll that I described above solved your problem!
Back to Top
 Post Reply Post Reply Page  12>
  Share Topic   

Forum Jump Forum Permissions View Drop Down