Online - Data retrieval failures occurred (Activated)

Question

Online - Data retrieval failures occurred (Activated)

Syed Bukhari 0

In Windows Server 2022 datacenter Server Manager, the target server shows a manageability status of "Online - Data retrieval failures occurred". The server is online, but Server Manager cannot successfully refresh or pull configuration data and event logs, likely due to a WinRM communication or event log access issue. i did my best to resolve it with the available information on the internet.

0 comments

3 answers

Your answer

Answer 1

For Online - Data retrieval failures occurred on a Windows Server 2022 target in Server Manager, the most relevant checks are WinRM connectivity, authentication/SPN issues, alternate credentials, and event log access.

Check whether alternate credentials are required In Server Manager, right-click the affected server in the Servers tile and select Manage As. Use an account that has rights on the target server. This is especially relevant when Server Manager shows manageability errors such as:
- Kerberos target resolution error
- Kerberos authentication error
- Online - Access denied
Check for WinRM listener/configuration problems on the target server On the affected server, run these commands in an elevated prompt:
```
   winrm invoke Restore winrm/Config
   winrm quickconfig
```
This restores the WinRM listener configuration and performs the default WinRM service/listener configuration.
Check for WinRM proxy configuration Server Manager and related management tools rely heavily on WinRM. A WinHTTP proxy can break remote management. In an elevated command prompt on the affected server, run:
```
   netsh winhttp show proxy
```
If a proxy is configured, remove it for testing:
```
   netsh wintthp reset proxy
```
This is a test step to confirm whether the proxy is the cause.
Review WinRM Group Policy settings On the affected server, check: Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Remote Management (WinRM) Temporarily removing WinRM-related GPO settings can be used as a test to determine whether policy is blocking or misconfiguring remoting.
Check WinRM operational logs In Event Viewer on the affected server, review: Applications and Services Logs > Microsoft > Windows > Windows Remote Management > Operational This is the primary place to look for WinRM errors that explain why Server Manager cannot refresh data.
Check for HTTP SPN conflicts if Kerberos is failing If the issue is intermittent, affects FQDN connections, or shows Kerberos-related failures, check whether default HTTP SPNs are registered to a service account:
```
   setspn -q HTTP/servername.or.fqdn
```
If the SPN is found but the server name is not in the highlighted field of the error, configure a dedicated WinRM SPN with the port and machine account:
```
   setspn -s HTTP/servername.or.fqdn:5985 servername
```
If connecting through PowerShell remoting, use:
```
   Enter-PSSession -ComputerName servername.or.fqdn -SessionOption (New-PSSessionOption -IncludePortInSPN)
```
If WinRM returns status 500 This usually means WinRM could not process the request. Confirm that remoting is enabled, the WinRM listener accepts requests, and check event logs for related errors such as file access problems.
Understand what Server Manager is trying to collect Server Manager thumbnails and manageability status depend on whether the server is accessible, whether the signed-in account has sufficient rights, whether required remote-management software is available, and whether the server is configured to be queried remotely. Event data shown in Server Manager also depends on successful event log retrieval.

If the issue remains after these checks, collect the following before escalating:

Windows Server 2022 version/build using winver or:
```
  (Get-ComputerInfo).OsVersion
```
Event data from:
- System
- Application
- Microsoft-Windows-Storage-Diagnostics/Operational if relevant
Output of:
```
  Get-Disk | Format-List
```

Answer 2

Hello Syed,

The “Online - Data retrieval failures occurred” status in Server Manager for Windows Server 2022 Datacenter almost always points to a WinRM or WMI communication issue between the Server Manager console and the target server. Even though the server is online, Server Manager cannot query configuration data or event logs.

The first thing to confirm is that WinRM is properly enabled and listening. On the target server, run winrm quickconfig and ensure the service is running and set to start automatically. If you are managing remotely, check that TCP ports 5985 (HTTP) and 5986 (HTTPS) are open and not blocked by the firewall. In many cases, the Windows Firewall profile may allow ICMP/ping but block WinRM traffic, which causes exactly this symptom.

Next, verify that the Event Log service is running. Open services.msc and confirm “Windows Event Log” is set to Automatic and started. If the service is stopped or disabled, Server Manager cannot pull logs and will throw the data retrieval error.

Also check DCOM and WMI permissions. Run wmimgmt.msc, right-click WMI Control, and select Properties. If you see “Failed to connect” errors, you may have namespace corruption or insufficient permissions. In that case, re-register WMI with winmgmt /verifyrepository followed by winmgmt /salvagerepository if corruption is detected.

If you are managing the server from a domain-joined machine, ensure that the account you are using has administrative rights on the target server. Non-admin accounts often trigger this error because Server Manager cannot query system data without elevated rights.

Finally, check for Kerberos or CredSSP authentication issues. If you are managing across domains or using IP addresses instead of hostnames, WinRM may fail due to SPN mismatches. In that case, try adding the target server with its FQDN and ensure DNS resolution is correct.

If all of the above checks out and the issue persists, it may be a known bug in Server Manager’s refresh mechanism. Microsoft has documented intermittent failures in Server Manager when querying large event logs or when the WinRM listener is misconfigured. In such cases, clearing the Server Manager cache (%appdata%\Microsoft\Windows\ServerManager\Cache) and re-adding the server sometimes resolves the problem.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.

Syed Bukhari 0 Reputation points

2026-09-03T21:04:04.84+00:00

Hi Harry,

Thank you for your suggestions. I have completed the recommended checks, including WinRM, WMI, Event Log service, firewall, FQDN/WinRM connectivity, authentication, and WinHTTP proxy checks. I also restarted the server and confirmed that WMI is consistent and WinRM is functioning correctly.

However, the “Online - Data retrieval failures occurred” issue in Server Manager is still present.

The Server Manager logs show GetServerInventory failing because it cannot access one or more event logs. I am also seeing multiple Event ID 45 errors reporting failures opening the metadata of the owning provider for various Event Log channels.

At this point, the basic WinRM/WMI/connectivity checks appear healthy, so I would appreciate further guidance on identifying and repairing the Event Log/provider metadata issue causing the Server Manager inventory failure.

Thanks, Syed

Answer 3

Thank you for all the suggestions. We have now completed all the recommended troubleshooting steps, including checking WinRM, WMI, Event Log service, firewall rules, FQDN/remote connectivity, authentication, WinHTTP proxy settings, and restarting the server.

We also tested with the Windows Firewall completely disabled, but this made no difference.

The results show that WinRM and WMI are working correctly:

Test-WSMan — successful
Invoke-Command — successful
WMI repository — consistent
WinRM service/listener — running correctly
Event Log service — running
No WinHTTP proxy configured

However, Server Manager still shows “Online – Data retrieval failures occurred.”

The Server Manager logs continue to show GetServerInventory failures related to accessing Event Logs, along with multiple Event ID 45 errors reporting failures opening the metadata of the owning provider for various Event Log channels.

At this stage, all the standard WinRM/WMI/connectivity and firewall checks have been completed, but the issue remains. Any further Microsoft-supported troubleshooting or guidance on the Event Log/provider metadata issue would be appreciated.

Thanks, Syed