Microsoft small business knowledge base

Article ID: 836605 - Last Review: October 26, 2006 - Revision: 3.3


When you use Windows Management Instrumentation (WMI) and you configure it to log all events on your Microsoft Windows Server 2003-based computer or Microsoft Windows XP-based computer for quick analysis and troubleshooting of problems, the file size of both the Framework.log and the Framework.lo_ files may be greater than what you configured for them.


Windows Server 2003

To resolve this problem, set the permissions on the %systemroot%\system32\wbem\logs folder so that the Network Service account has the Delete permission.

To set the permissions on the %systemroot%\system32\ wbem\logs folder, follow these steps:
  1. Locate the %systemroot%\system32\wbem\logs folder, right-click on the folder, and then select Properties.
  2. On the Security tab, click the Advanced button.
  3. Select the NETWORK SERVICE account from the Permission entries list, and then click Edit.
  4. Locate the Delete permission, and then click to select the Allow checkbox.
  5. Click OK three times.
Note If you follow these steps on a member server which is later promoted to a Domain Controller, you must perform these steps again.

Windows XP

To resolve this problem, obtain the latest service pack for Windows XP. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
322389  ( ) How to obtain the latest Windows XP service pack


You can configure an error log for WMI through the registry:
  • The destination folder for all log files is set by this registry subkey:
  • The maximum file size is set by the following registry subkey:
    HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\Log File Max Size
The following registry subkey determines how the Windows Driver Model (WDM) provider will log errors:

The logging entry uses the following values:
  • 0: Turns off logging.
  • 1: Logs errors only.
  • 2: Verbose logging.

The default value for the Log File Max Size entry is 64 kilobytes (KB). When a log file reaches this size, the log file will be backed up to Log_file_name.lo_, and a new log file starts collecting entries. The only exception to this is the Framework.log file. The Framework.log file continues to increase even after the file has exceeded the Log File Max Size setting.

During the DCPROMO process, the DefltDC.inf template is used to apply certain NTFS permissions, registry permissions, and default user rights. The DefltDC.inf template removes the previously configured delete permissions for the NETWORK SERVICE account again.


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Microsoft Windows XP Service Pack 2.

  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Home Edition
  • Microsoft Windows Management Instrumentation 1.5
atdownload kbwinxpsp2fix kbpending kbwinxppresp2fix kbfix kbbug KB836605
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support