Log Dejargonizer

Windows Application Log · Event 10

Event 10 (WMI): An event subscription could not be restarted

Windows Management Instrumentation tried to reactivate a standing subscription at boot and failed. The famous version of this is a leftover Microsoft left in a Windows 7 install image, harmless and endlessly repeated. The version worth reading is the one where the query is not Microsoft's.

Also written as WMI Event ID 10WMI 0x80041003

What it means for you

On a personal computer

This is a background bookkeeping error, not something that affects how your PC works. Something asked Windows to watch for a condition — 'tell me when the CPU goes above 99 percent', for example — and Windows could not restart that watch after a reboot. If your machine is otherwise fine, it is fine.

For an analyst

Read the query and the namespace before you close it. Permanent WMI event subscriptions are a well-established persistence technique, and a broken one produces exactly this event on every boot. root\subscription is where the interesting ones live. The error code tells you why the reactivation failed, and 0x80041003 (access denied) on a subscription you do not recognise is a better lead than the same code on Microsoft's known leftover.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Log Name:      Application
Source:        WMI
Event ID:      10
Level:         Error
Computer:      DESKTOP-WKS042

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Processor' AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

The fields that decide it

Everything else in the log line is context.

Query
The WQL the subscription was watching for. This is the field that decides whether the event matters. Microsoft's known leftover watches Win32_Processor for LoadPercentage above 99 under the filter name BVTFilter; anything else deserves thirty seconds of thought.
Namespace
Where the subscription lives.
  • //./root/CIMV2The general-purpose namespace. Most monitoring and management software registers here.
  • //./root/subscriptionWhere permanent event subscriptions are stored. A failed reactivation here is worth listing the actual subscriptions to check.
Error code
Why reactivation failed.
  • 0x80041003WBEM_E_ACCESS_DENIED — the account the subscription runs under could not be used. The code in Microsoft's known Windows 7 leftover.
  • 0x80041010WBEM_E_INVALID_CLASS — the class named in the query does not exist, usually because software was uninstalled or a provider is broken.
  • 0x80041002WBEM_E_NOT_FOUND — the object the query refers to is gone.
  • 0x80041001WBEM_E_FAILED — a generic provider failure, often a corrupted WMI repository.

Ordinary reasons this happens

Most of the time it is one of these.

  • The Windows 7 and Server 2008 R2 leftover: a test subscription named BVTFilter escaped into the retail installation media and fails on every boot of a live system. Microsoft documented it and published a script to remove it.
  • Management or monitoring software uninstalled without removing its WMI subscriptions, leaving a query that references classes no longer present.
  • A vendor agent whose subscription runs as a user account whose password has changed.
  • A corrupted WMI repository after an unclean shutdown, which breaks reactivation for every subscription at once.
  • A hardware monitoring utility watching for a sensor class that a driver update renamed or removed.

When it is not ordinary

Permanent WMI event subscription used for persistence, where the filter or the consumer has been damaged or partially removed.

What gives it awayA filter name and query you cannot attribute to installed software, in root\subscription. List the subscription objects and look at the paired consumer — a CommandLineEventConsumer or ActiveScriptEventConsumer is the payload half.

ATT&CK T1546.003

A subscription whose consumer was cleaned up by antivirus, leaving the filter to fail on every boot.

What gives it awayThe event recurs at a fixed point in the boot sequence, the query references something like Win32_LogonSession or a timer class, and no product on the machine claims it.

ATT&CK T1546.003

What to do next

  1. Read the query text. If it is the Win32_Processor LoadPercentage query, you have Microsoft's documented leftover and can stop here.
  2. List what is actually registered: `Get-WmiObject -Namespace root\subscription -Class __EventFilter | Select-Object Name, Query` shows every filter on the machine.
  3. List the consumers, which are the half that does something: `Get-WmiObject -Namespace root\subscription -Class __EventConsumer | Select-Object __CLASS, Name, CommandLineTemplate, ScriptText`.
  4. List the bindings that connect them: `Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding`.
  5. Attribute each one to a product. Anything you cannot attribute — particularly a CommandLineEventConsumer running a script or an encoded command — is the finding.
  6. Remove a confirmed leftover by deleting the filter, the consumer, and the binding together. Deleting only one of the three leaves the event firing.
  7. If every subscription is failing rather than one, check the WMI repository: `winmgmt /verifyrepository`, and repair only if it reports inconsistency.

Queries to run

powershell The query text is only in the rendered message, so read it in full. 
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='WMI'; Id=10} -MaxEvents 30 | Format-List TimeCreated, Message
powershell Every standing filter on the machine. On a clean Windows install this list is short and unremarkable. 
Get-WmiObject -Namespace root\subscription -Class __EventFilter | Select-Object Name, Query, QueryLanguage
powershell The consumers. CommandLineEventConsumer and ActiveScriptEventConsumer are the two that execute something, and both are worth reading in full. 
Get-WmiObject -Namespace root\subscription -Class __EventConsumer | Format-List *
sigma Filters out Microsoft's documented leftover so only unattributed subscriptions surface. 
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: 'WMI'
    EventID: 10
  filter_known:
    Data|contains: 'Win32_Processor'
  condition: selection and not filter_known

Common questions

Is WMI Event ID 10 in the Application log dangerous?

Usually not. The most common version of it is a test subscription Microsoft accidentally shipped inside the Windows 7 and Server 2008 R2 installation media, which fails on every boot and does nothing else. Microsoft documented it and published a script to remove it. Before dismissing it, read the query in the event — if it is not the Win32_Processor one, find out which software registered it.

How do I stop the WMI Event 10 error?

Remove the subscription that is failing. All three parts have to go: the filter (__EventFilter), the consumer (__EventConsumer), and the binding (__FilterToConsumerBinding), all in the root\subscription namespace. Deleting only the filter leaves the event firing. For the specific Windows 7 leftover, Microsoft's published workaround script deletes all three.

What does error 0x80041003 mean in this event?

It is WBEM_E_ACCESS_DENIED — WMI refused the reactivation on permissions grounds. In the well-known Windows 7 leftover it simply reflects that the subscription was never meant to run on a live system. On a subscription you do not recognise it usually means the account the subscription was registered under can no longer be used.

Can WMI Event 10 indicate malware?

It can point at it. A permanent WMI subscription that runs a command when a condition is met is a recognised persistence technique, and one that has been damaged — by an antivirus cleanup, a partial uninstall, or an update — will fail to reactivate and log this event on every boot. The tell is a filter query you cannot attribute to any installed product, paired with a consumer that executes a command or a script.

Read next

Mentioned by

Vendor documentation

Last reviewed 7 September 2026