Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Troubleshooting
  New Posts New Posts RSS Feed: How to Solve GetUserDefaultLCID failed Error
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

How to Solve GetUserDefaultLCID failed Error
 Post Reply Post Reply Page  12>
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
alan12345 View Drop Down
Newbie
Newbie


Joined: 09 September 2009
Location: lancs uk
Online Status: Offline
Posts: 6 		Post Options Post Options   Quote alan12345 Quote  Post ReplyReply Direct Link To This Post Topic: How to Solve GetUserDefaultLCID failed Error
    Posted: 14 March 2010 at 2:13pm
Thanks

Alan
Alan
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Offline
Posts: 440 		Post Options Post Options   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 14 March 2010 at 12:14pm
Hi Alan,

Originally posted by alan12345

I also find wbemcore.dll in   c:\windows\system32\dllcache\
Can I delete it to save space ?
Or should I roll that back to the SP2 version as well ?

Thanks for this remark. It is a good idea to also roll back wbemcore.dll in c:\windows\system32\dllcache\ (I have updated my previous post accordingly)
Better not to delete any file in this folder.
Back to Top
alan12345 View Drop Down
Newbie
Newbie


Joined: 09 September 2009
Location: lancs uk
Online Status: Offline
Posts: 6 		Post Options Post Options   Quote alan12345 Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2010 at 10:26pm
Originally posted by dirbase

On the XP3 system, in safe mode, rename wbemcore.dll to something else, for example wbemcoreSP3.dll, in two locations:
      1. c:\windows\system32\wbem\
      2. c:\windows\servicepackfiles\i386\


I also find wbemcore.dll in   c:\windows\system32\dllcache\

Can I delete it to save space ?
Or should I roll that back to the SP2 version as well ?

I am using XP Home edition with SP3 on a 5 year old Acer Laptop TravelMate 244LM

Regards
Alan
Alan
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Offline
Posts: 440 		Post Options Post Options   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 31 January 2010 at 6:03pm
Hi marlbrook,

Good to know that the roll-back to the SP2 version of wbemcore.dll that I described above solved your problem!
Back to Top
marlbrook View Drop Down
Newbie
Newbie


Joined: 31 October 2009
Online Status: Offline
Posts: 2 		Post Options Post Options   Quote marlbrook Quote  Post ReplyReply Direct Link To This Post Posted: 31 January 2010 at 11:15am
Thanks for the above. Very useful.
 
I was experiencing a problem which showed up when trying to play .avi files, causing them to stutter. I realised something was slowing the PC, and discovered, by examining the Sysinternals Process Monitor log, that GetUserDefaultLCID failed error in the wbemcore.log was being called repeatedly.
 
I had upgraded to XP SP3. Reverting back to the SP2 wbemcore.dll solved the problem
 
Cheers
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Offline
Posts: 440 		Post Options Post Options   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 30 March 2009 at 2:37pm
Could you please paste the details of the dcom errors you get in your event log (the system event log, I presume..). Are the timestamps the same for the wbemcore.log errors and the DCOM events?


Edited by dirbase - 30 March 2009 at 2:46pm
Back to Top
chj124 View Drop Down
Newbie
Newbie


Joined: 26 March 2009
Online Status: Offline
Posts: 5 		Post Options Post Options   Quote chj124 Quote  Post ReplyReply Direct Link To This Post Posted: 30 March 2009 at 2:09pm
thanks for the info...

do you think the dcom errors i see are related? and from the other things i noticed, is it related to the software metering agent? Dead
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Offline
Posts: 440 		Post Options Post Options   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 30 March 2009 at 2:05pm
This error is generated inside wbemcore.dll due to a bug in the SP3 version; more precisely a bug in the wbemcore!GetDefaultLocale routine which has been modified from the SP2 version.
AFAIU, the error is logged if a certain memory value is 0; the problem is that this value is initialized with 0, and is not modified in standard cases! Confused

Edited by dirbase - 30 March 2009 at 2:06pm
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Offline
Posts: 440 		Post Options Post Options   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 27 March 2009 at 10:41pm
I can see about the same verbose messages in my wbemcore.log as you do; the only error message is "GetUserDefaultLCID failed, restorting to system verion".

If you are using XP SP3, a way to get rid of these errors is to roll back to the XP SP2 version of wbemcore.dll (which is version 5.1.2600.2180 with 530,944 bytes).
  • First try to grab a copy of wbemcore.dll from a system running XP SP2.
  • On the XP SP3 system, in safe mode, rename wbemcore.dll to something else, for example wbemcoreSP3.dll, in three locations:
      1. c:\windows\system32\wbem\
      2. c:\windows\servicepackfiles\i386\
      3. c:\windows\system32\dllcache
  • Copy the SP2 version of wbemcore.dll in each of these two folders.
  • Reboot.
In wbemcore.log, you will still see many comments in verbose mode but the "GetUserDefaultLCID failed, restorting to system verion" error should not show up. With error logging mode set, the file should be pretty quiet.


Edited by dirbase - 14 March 2010 at 12:18pm
Back to Top
chj124 View Drop Down
Newbie
Newbie


Joined: 26 March 2009
Online Status: Offline
Posts: 5 		Post Options Post Options   Quote chj124 Quote  Post ReplyReply Direct Link To This Post Posted: 27 March 2009 at 2:35pm
i have turned on verbose logging and found this...

(Fri Mar 27 10:19:04 2009.88312296) : CALL ConnectionLogin::NTLMLogin
   wszNetworkResource = \\.\root\ccm\SoftwareMeteringAgent
   pPreferredLocale = (null)
   lFlags = 0x0
(Fri Mar 27 10:19:04 2009.88312296) : DCOM connection from NT AUTHORITY\SYSTEM at authentiction level Privacy, AuthnSvc = 10, AuthzSvc = 0, Capabilities = 0
(Fri Mar 27 10:19:04 2009.88312296) : GetUserDefaultLCID failed, restorting to system verion(Fri Mar 27 10:19:04 2009.88312296) : CALL CWbemNamespace::GetObject
   BSTR ObjectPath = __SystemClass
   long lFlags = 0
   IWbemClassObject ** pObj = 0x20CF918
(Fri Mar 27 10:19:14 2009.88322296) : CALL ConnectionLogin::NTLMLogin
   wszNetworkResource = \\.\root\ccm\SoftwareMeteringAgent
   pPreferredLocale = (null)
   lFlags = 0x0
(Fri Mar 27 10:19:14 2009.88322296) : DCOM connection from NT AUTHORITY\SYSTEM at authentiction level Privacy, AuthnSvc = 10, AuthzSvc = 0, Capabilities = 0
(Fri Mar 27 10:19:14 2009.88322296) : GetUserDefaultLCID failed, restorting to system verion(Fri Mar 27 10:19:14 2009.88322296) : CALL CWbemNamespace::GetObject
   BSTR ObjectPath = __SystemClass
   long lFlags = 0
   IWbemClassObject ** pObj = 0x240F918

and i am seeing DCOM errors in my event log
and i also found this in mtrmgr.log

<![LOG[Creation event received for process 1796]LOG]!><time="10:31:35.461+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:252">
<![LOG[Process ID 1796 is for process C:\Program Files\McAfee\Common Framework\McScript_InUse.exe]LOG]!><time="10:31:35.554+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="processdata.cpp:141">
<![LOG[No matching rule found for process 1796]LOG]!><time="10:31:35.554+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="3008" file="activeprocesses.cpp:65">
<![LOG[Termination event received for process 1796]LOG]!><time="10:31:37.086+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:287">
<![LOG[Termination event received for process 2444]LOG]!><time="10:34:05.179+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:287">
<![LOG[Creation event received for process 2832]LOG]!><time="10:34:28.539+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:252">


what else should i be lookin for?
Back to Top
 Post Reply Post Reply Page  12>

Forum Jump Forum Permissions View Drop Down