Online - Data retrieval failures occurred (Activated)

Thank you for all the suggestions. We have now completed all the recommended troubleshooting steps, including checking WinRM, WMI, Event Log service, firewall rules, FQDN/remote connectivity, authentication, WinHTTP proxy settings, and restarting the server.

We also tested with the Windows Firewall completely disabled, but this made no difference.

The results show that WinRM and WMI are working correctly:

• Test-WSMan — successful
• Invoke-Command — successful
• WMI repository — consistent
• WinRM service/listener — running correctly
• Event Log service — running
• No WinHTTP proxy configured

However, Server Manager still shows “Online – Data retrieval failures occurred.”

The Server Manager logs continue to show GetServerInventory failures related to accessing Event Logs, along with multiple Event ID 45 errors reporting failures opening the metadata of the owning provider for various Event Log channels.

At this stage, all the standard WinRM/WMI/connectivity and firewall checks have been completed, but the issue remains. Any further Microsoft-supported troubleshooting or guidance on the Event Log/provider metadata issue would be appreciated.

Thanks, Syed

Hello Syed,

The “Online - Data retrieval failures occurred” status in Server Manager for Windows Server 2022 Datacenter almost always points to a WinRM or WMI communication issue between the Server Manager console and the target server. Even though the server is online, Server Manager cannot query configuration data or event logs.

The first thing to confirm is that WinRM is properly enabled and listening. On the target server, run winrm quickconfig and ensure the service is running and set to start automatically. If you are managing remotely, check that TCP ports 5985 (HTTP) and 5986 (HTTPS) are open and not blocked by the firewall. In many cases, the Windows Firewall profile may allow ICMP/ping but block WinRM traffic, which causes exactly this symptom.

Next, verify that the Event Log service is running. Open services.msc and confirm “Windows Event Log” is set to Automatic and started. If the service is stopped or disabled, Server Manager cannot pull logs and will throw the data retrieval error.

Also check DCOM and WMI permissions. Run wmimgmt.msc, right-click WMI Control, and select Properties. If you see “Failed to connect” errors, you may have namespace corruption or insufficient permissions. In that case, re-register WMI with winmgmt /verifyrepository followed by winmgmt /salvagerepository if corruption is detected.

If you are managing the server from a domain-joined machine, ensure that the account you are using has administrative rights on the target server. Non-admin accounts often trigger this error because Server Manager cannot query system data without elevated rights.

Finally, check for Kerberos or CredSSP authentication issues. If you are managing across domains or using IP addresses instead of hostnames, WinRM may fail due to SPN mismatches. In that case, try adding the target server with its FQDN and ensure DNS resolution is correct.

If all of the above checks out and the issue persists, it may be a known bug in Server Manager’s refresh mechanism. Microsoft has documented intermittent failures in Server Manager when querying large event logs or when the WinRM listener is misconfigured. In such cases, clearing the Server Manager cache (%appdata%\Microsoft\Windows\ServerManager\Cache) and re-adding the server sometimes resolves the problem.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.