How to fully uninstall a performance monitor extension

Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows registry


This article discusses how to fully uninstall a custom performance monitor extension. The article also describes some of the implications when only the counter names and descriptions are removed with unlodctr.

More Information

The documentation in the Platform SDK describes in detail how to install and uninstall performance monitor extension:
  • Creating the application's performance key.
  • Adding counter names and descriptions to the registry.
  • Removing counter names and descriptions from the registry.
  • Creating other registry entries.
However, an important step to uninstall a performance monitor extension is to remove the application's performance key. For the author of a performance monitor extension, the steps required to properly remove the extension are:

  1. Use unlodctr to remove the counter names and descriptions.
  2. Remove the application's performance key. See the information in the Platform SDK documentation about "Creating the application's performance key" for specifics.
Note The order is important. Unlodctr cannot unload the performance monitor extension without the associated registry key preset.

Symptoms that occur as a result of leaving the application's performance key in the registry after unloading counter names and descriptions may vary depending on how the extension is implemented. However, one typical symptom is extra Event 1008 messages added to the Application Event Log by the Perflib source. When the performance monitor reads all counters for the first time, the extension's Open procedure is called. A typical task for the Open procedure is to read what range of object indexes it supports from the registry. These index values are stored in the First Counter, First Help, Last Counter, and Last Help registry values under the application's performance key. This fails the Open procedure call because unlodctr deletes these values, which in turn causes Windows NT to post Event 1008 to the Application Event Log.

As a user of a vendor's software, after uninstalling, if you find Event 1008 in the Application Event Log for the Perflib source, which indicates that the software's performance extension is failing the Open procedure, you should contact the vendor of the product so the vendor can correct its uninstall procedure. However, you may be able to correct the situation yourself.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
  1. To completely remove a performance monitor extension, first identify the service name of the product that supported the custom counters.
  2. Use RegEdt32.exe to traverse to the following subkey:


    where <application> refers to the service name in step 1.
  3. Select the Performance subkey and from the Edit menu, click Delete. This action deletes the Performance subkey and all its values.


For more information about developing performance monitor extensions, see the Platform SDK documentation user Base Services; Performance Monitoring; Performance Data; The Registry Interface; Adding Counters.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

226494 Events for performance monitor extensions


ID do Artigo: 247226 - Última Revisão: 21 de nov de 2006 - Revisão: 1