Troubleshooting Performance Monitor Counter Problems

Article translations Article translations
Article ID: 152513 - View products that this article applies to.
This article was previously published under Q152513
This article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy.
Expand all | Collapse all


The Performance Monitor utility Perfmon.exe may not display valid counter objects. Below are some troubleshooting methods that can be used to resolve the issue.


Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows

You could check the strings in the 009 key under the key described below and look for any garbled entries, entries that have two numbers, or entries that have two strings in succession (you should see ### string ### string, and so on in the multi-sz editor). This may not explain the different behavior between the local and remote cases because they both access the same registry values.

Perfmon does the following with the registry:
  • Reads the perfmon configuration from the following registry subkey. Entries not found will revert to the default values:
  • Opens the performance registry key, which does the following (on the computer that you are trying to connect to):
    • Opens the following registry subkey to read the name strings and explain text strings. If this fails, the computer connection fails:
      (009 assumes English)
    • Opens the following registry subkey to read any configuration information. If this fails, the default settings are used:
    • Enumerates the following registry subkey to find services that have registered extensible performance counter DLLs. If this fails, or any of the DLLs found fail, then the failed DLLs will not be loaded and the extensible counters provided by the DLLs will be returned. The connection to the computer (local or remote) will succeed with at least the standard counters:
The biggest difference between monitoring a local computer and a remote computer is that the performance counters are queried within the context of the Perfmon process when monitoring local computer counters, while remote performance counters are monitored within a thread of the Winlogon process on the remote computer.

Usually this type of failure is the result of one of the network related extensible counter DLLs. Another possibility could be the permissions enabled on the local machine are insufficient to allow the remote account access to the performance counter registry keys. The minimum permissions needed for each instance of the following registry subtree
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\service name\Performance

Everyone - Read (Query Value, Enumerate Subkeys, Notify, Read Control).
System - Full Control
Administrators - Full Control

As always check the security, application or system event logs for any "interesting" entries. To try and narrow it down you could try to disable the extensible counter DLLs to prevent them from being loaded. If this solves the problem, enable the extensible counter DLLs one at a time to see when it breaks again.

To disable one or more extensible counter DLL(s):
  1. Start the Registry Editor (RegEdt32.exe).
  2. Navigate to the following registry subtree:
  3. Click Find Key on the View menu.
  4. Type Performance as the search string, then search down from there.
  5. At each Performance entry you find, select the Library value and modify the library name by prefixing it with two x's: for example, change OrigLib.dll to xxOrigLib.dll
  6. When you have done each Performance entry under the CurrentControlSet\Services key, restart Perfmon to see whether it works. If it does, then repeat the above two steps, only restoring the original library name and trying Perfmon after each change to see which library causes the fault.
For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
164018 Controlling Remote Performance Monitor Access to Windows NT Servers


Article ID: 152513 - Last Review: February 21, 2007 - Revision: 2.5
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional Edition
  • Microsoft Windows NT Advanced Server 3.1
  • Microsoft Windows NT Server 3.5
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0 Standard Edition
  • Microsoft Windows NT Workstation 3.1
  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Advanced Server 3.1
kbtshoot KB152513

Give Feedback


Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from