SAM uses WMI to collect information from hosts. Essentially the request for information is passed to the operating system. The underlying Windows Operating System makes the call for information to the remote host via WMI no differently than any other Windows application which utilizes WMI would. WMI is built on another Windows technology called DCOM (Distributed COM). The errors you are seeing in the event viewer are from the operating system itself. They are triggered by requests for information by SAM, but they are not SAM events you are seeing in the event viewer. Unmanaging, disabling, or removing applications that are in a "down" or "unknown" state should reduce or even eliminate these messages from appearing in the Windows Event Log.
↧