The "Online - Data retrieval failures occurred" error in Windows Server 2022 typically appears in Server Manager when it fails to pull inventory or status data from a local or remote node. This often stems from corrupted event log channels or WinRM limitations. 🛠️ Top Fix: Increase WinRM Envelope Size
When a server has many roles (like in a Failover Cluster or Exchange DAG), the data packet exceeds the default WinRM limit. Open PowerShell as Administrator on the target server.
Run the following command to increase the size to 8MB:Set-WSManInstance -ResourceURI winrm/config -ValueSet @MaxEnvelopeSizekb = "8192". Restart the WinRM (Windows Remote Management) service. 🔍 Secondary Fixes for Known Bugs
If increasing the envelope size doesn't work, try these targeted workarounds:
Repair Corrupted Event Channels: A known bug involves the Microsoft-Windows-Kernel-IoTrace/Diagnostic channel.
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-IoTrace/Diagnostic in Registry Editor.
Set Enabled to 0 and reboot the server. Windows should automatically rebuild the channel metadata.
Fix "Event Log Readers" Permissions: Add the server's own Computer Account to the local Event Log Readers group via Computer Management > Local Users and Groups > Groups.
Remove Obsolete Registry Keys: If you performed an in-place upgrade to 2022, outdated keys in ...\WINEVT\Channels from removed features (like File Services or Media Foundation) can trigger this error. 🛡️ Best Practices to Prevent Future Failures
Keep Patched: Ensure your server has the latest Cumulative Updates (LCU), as Microsoft has released various fixes for these retrieval bugs since 2024.
Run System Repairs: Use sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to fix general OS corruption that may impact management providers. If you'd like, let me know: Is your server part of a Failover Cluster?
Are you seeing any specific Event IDs (like 45) in the ServerManager-ManagementProvider log?
Did this start after an in-place upgrade or a specific update? data retrieval failures occurred showing in server manager
In Windows Server 2022, the error "Online - Data retrieval failures occurred" in Server Manager typically signals a communication or configuration break between the management console and target nodes. This error often surfaces in Failover Clusters or complex environments like Exchange DAGs, preventing administrators from viewing real-time health and status data. Common Causes
WinRM Envelope Size Limits: The default WinRM packet size (MaxEnvelopeSize) may be too small to transmit the large volume of metadata required for complex cluster configurations.
Corrupted Event Log Channels: Specifically, the Microsoft-Windows-Kernel-IoTrace/Diagnostic channel is known to trigger this failure if its metadata becomes corrupted or missing.
Insufficient Permissions: The account running Server Manager may lack rights to access specific event logs on remote nodes.
WMI Repository Issues: Corruption in the WMI repository can halt the data flow required by Server Manager. Troubleshooting and Resolution Steps 1. Increase WinRM MaxEnvelopeSize
If your server is part of a large cluster, increasing the allowed packet size for the WS-Management service often resolves the issue instantly.
In Windows Server 2022, the "Online - Data retrieval failures occurred" error in Server Manager typically signals that the system cannot successfully poll status information from a local or remote node . This is frequently caused by corrupted event log metadata or WinRM (Windows Remote Management) configuration limits . Common Causes
Corrupted Event Log Channels: The most frequent culprit is the Microsoft-Windows-Kernel-IoTrace/Diagnostic channel, which can become corrupted or lose its metadata .
WinRM Packet Size Limits: In clustered environments (like Exchange DAGs or S2D), the data being retrieved may exceed the default maximum envelope size allowed by the WS-Management service .
Insufficient Permissions: The server's computer account may lack the necessary rights to read its own event logs through WinRM .
Feature Removal/Migration: In-place upgrades or migrations (e.g., VMware to Hyper-V) can leave behind orphaned registry entries for removed features that Server Manager still attempts to poll . Recommended Solutions 1. Reset Problematic Event Log Channels
The Kernel-IoTrace diagnostic log is often the primary source of this failure . Disabling it forces Windows to rebuild the metadata.
Navigate to the following Microsoft Learn support page for registry modification details.
Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-IoTrace/Diagnostic The "Online - Data retrieval failures occurred" error
Action: Change the Enabled DWORD value from 1 to 0 and reboot . Windows typically resets this to 1 automatically upon a successful reboot with clean metadata . 2. Increase WinRM MaxEnvelopeSize
If you are managing a Failover Cluster or Exchange DAG, the default data packet limit might be too low . Open PowerShell as Administrator.
Run the following command to increase the limit:Set-WSManInstance -ResourceURI winrm/config -ValueSet @MaxEnvelopeSizekb = "700" . Restart the WinRM service. 3. Update Event Log Reader Permissions
Ensure the server can access its own logs via the network stack. Open Local Users and Groups (lusrmgr.msc). Go to Groups > Event Log Readers.
Add the local computer account (e.g., SERVERNAME$) to this group .
If using a Failover Cluster, also add the Cluster Name Object (CNO) . 4. Repair System File Corruption
General system corruption can interfere with the management providers . Run sfc /scannow in an elevated command prompt.
Run DISM /Online /Cleanup-Image /RestoreHealth to repair the component store .
Are you seeing this error on a standalone server or within a Failover Cluster?
Server Manager problem: Online - Data retrieval failures occurred
These failures typically appear as:
WinHTTP / WinINET errors (e.g., 12002, 12152).NET HttpRequestException or WebExceptionchkdsk /scan on Healthy VolumesUnlike the older /f, /scan allows online detection without dismount:
chkdsk D: /scan
On [start date], the Windows Server 2022 environment began experiencing recurring failures when attempting to retrieve data from external online sources (APIs, cloud storage endpoints, and web services). These failures resulted in incomplete data synchronization, delayed batch processing, and application timeouts. Initial troubleshooting pointed to a combination of network configuration drift, TLS protocol mismatches, and Windows update-related changes.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"Enabled"=dword:00000001
"DisabledByDefault"=dword:00000000
Reboot required.
The "Online – Data Retrieval Failures Occurred" error on Windows Server 2022 is rarely a false alarm. It signals a degraded yet still communicative storage device, often requiring physical replacement or metadata scrubbing. By methodically isolating physical from logical causes, checking NVMe driver versions, and leveraging PowerShell repair cmdlets, administrators can restore full I/O capability without rebuilding the entire environment.
Remember: WS2022’s storage stack is more resilient than 2016/2019, but it expects tighter hardware compliance. Always validate your firmware and driver versions against the Windows Server Catalog before deployment. A few minutes of proactive configuration can save hours of chasing "online but broken" nightmares.
Further Reading:
Repair-VirtualDisk and Storage Spaces HealthLast updated: Q3 2025 – applies to Windows Server 2022 builds 20348.x and higher.
The Issue
One of our company's Windows Server 2022 machines, used for online data storage and retrieval, started experiencing intermittent data retrieval failures. The server was set up to store and serve large amounts of data to various applications across the network. The failures were reported by users who were unable to access critical data, resulting in significant disruptions to business operations.
Initial Troubleshooting
The IT team initially investigated the issue by checking the server's event logs, performance monitors, and disk space. They found:
In-Depth Investigation
To dig deeper, the IT team:
chkdsk to scan for disk errors and found no issues.Root Cause Identification
After thorough investigation, the root cause of the data retrieval failures was identified: Timeouts when accessing web APIs or cloud storage
Resolution
To resolve the issue, the IT team:
Post-Resolution
After implementing the fixes, the data retrieval failures ceased, and the server resumed normal operation. The IT team continued to monitor the server's performance to ensure that the issue was fully resolved.
Lessons Learned
The experience provided valuable insights:
The IT team documented the issue and resolution, ensuring that similar problems could be quickly identified and addressed in the future.
The error "Online - Data retrieval failures occurred" in Windows Server 2022's Server Manager typically indicates a communication or metadata issue between the management console and the managed nodes. While often considered a "cosmetic" bug that doesn't impact core server functionality, it can prevent administrators from seeing health statuses or adding roles. Common Causes
WinRM Envelope Size Limits: The Windows Remote Management (WinRM) default maximum packet size (512 KB) is often too small for cluster metadata, especially in environments with Failover Clustering or Exchange DAGs.
Corrupted Event Log Channels: A specific channel, Microsoft-Windows-Kernel-IoTrace/Diagnostic, is known to become corrupted or have missing metadata, causing the "system cannot find the file specified" error.
Permission Issues: The computer account or management account may lack necessary permissions to read specific event channels via WinRM.
Registry Remnants: In-place upgrades can leave behind registry entries for features that were removed, leading to "ghost" data requests that fail.
Server Manager problem: Online - Data retrieval failures occurred
The solution for me was as following and is important to follow the order as below: Add the affected node itself (computer object) Microsoft Community Hub data retrieval failures occurred showing in server manager
In Windows Server 2022, "Online - Data retrieval failures occurred" typically occurs because of corrupted event log channels permission issues preventing Server Manager from collecting inventory data Quick Fixes & Immediate Actions Add Computer to "Event Log Readers": Computer Management Local Users and Groups Event Log Readers and add the server's own computer account If using a cluster, add the Cluster-Aware Updating (CAU) computer object as well. Increase WinRM Envelope Size:
In some cases, especially with Exchange DAG members, the data payload exceeds the default size. Run PowerShell as Administrator and execute:
Set-WSManInstance -ResourceURI winrm/config -ValueSet @MaxEnvelopeSizekb = "700" Step-by-Step Troubleshooting Guide 1. Identify the Problematic Channel
Server Manager often fails because it cannot access a specific event log provider. Event Viewer Applications and Services Logs ServerManager Operational for specific provider names. A common culprit is the Microsoft-Windows-Kernel-IoTrace/Diagnostic 2. Reset Corrupted Log Channels (Registry Fix)
If a channel is identified as broken, you can force Windows to rebuild its metadata. Registry Editor Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ Locate the problematic channel (e.g., Microsoft-Windows-Kernel-IoTrace/Diagnostic Change the DWORD value from Reboot the server. Windows should automatically set this back to and recreate missing files during boot. 3. Clean Up Legacy Registry Entries (For Upgraded Servers)
If you performed an in-place upgrade to Windows Server 2022, removed features like "Media Foundation" or "File Services" may leave behind ghost registry entries. WINEVT\Channels
registry key for entries related to removed features and consider removing them after a full backup. 4. Run System Repairs
Corruption in system files can interfere with management providers. Open PowerShell as Administrator and run: sfc /scannow DISM /Online /Cleanup-Image /RestoreHealth 5. Verify Cluster "DumpPolicy" (Advanced)
In clustered environments, a specific binary value in the cluster's dump policy can trigger this error.
Dealing with the "Online - Data retrieval failures occurred" error in Windows Server 2022 Server Manager can be incredibly frustrating. This persistent warning often indicates that the server cannot properly communicate with its management providers or that specific event logs are corrupted, preventing a full refresh of the dashboard status.
Here is a comprehensive guide to understanding and fixing this issue. Common Causes In Windows Server 2022, this error is frequently linked to: 2. Storage Spaces Metadata Corruption
Corrupted Event Log Channels: Specifically, the Microsoft-Windows-Kernel-IoTrace/Diagnostic channel often becomes corrupted or loses its metadata.
WinRM Packet Size Limitations: The default maximum size for Windows Remote Management (WinRM) packets may be too small for the data being retrieved.
Permission Issues: The server's computer account may lack the necessary permissions to read its own event logs.
WMI Repository Corruption: The Windows Management Instrumentation (WMI) repository may need repair to allow data flow back into Server Manager. Step-by-Step Troubleshooting and Fixes 1. Repair Corrupted Event Log Channels (Most Common Fix)
The most frequent culprit for this error is a corrupted diagnostic log channel. You can often resolve this by temporarily disabling the channel and forcing a rebuild. Registry Modification:
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-IoTrace/Diagnostic. Locate the Enabled DWORD and change its value from 1 to 0.
Reboot the server. Upon restart, Windows typically resets this value to 1 and recreates the necessary metadata files.
Add Permissions: Add the server's own Computer Object to the local Event Log Readers group to ensure it can access these channels through WinRM. 2. Increase WinRM MaxEnvelopeSize
If the server is part of a large cluster or has extensive roles installed, the data payload might exceed the default WinRM limits.
Open PowerShell as an Administrator and run the following command to increase the envelope size to 8192 KB or higher: powershell
Set-WSManInstance -ResourceURI winrm/config -ValueSet @MaxEnvelopeSizekb = "8192" Use code with caution.
Some administrators have found success increasing this to even higher values (e.g., 1024000) to resolve communication drops between cluster nodes. 3. Clean Up Legacy Registry Entries (For In-Place Upgrades)
If you upgraded to Windows Server 2022 from an older version, "ghost" features that were removed during the upgrade might still have entries in the registry.
Check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels for entries related to removed features like Media Foundation or older File Services.
Removing these orphaned keys (after taking a backup) can clear the retrieval failure. 4. Repair WMI Repository
If the registry and WinRM fixes don't work, the issue may lie deeper in the WMI repository.
Run the following commands to check and repair the repository: powershell winmgmt /verifyrepository winmgmt /salvagerepository Use code with caution.
Relaunch Server Manager after the repair is complete to see if data begins to flow. 5. Standard System Repairs
Always ensure basic system integrity isn't the root cause. Run the following standard repair tools: sfc /scannow DISM /Online /Cleanup-Image /RestoreHealth Summary Table: Quick Fixes Key Action Why it Works Registry Fix Set Kernel-IoTrace/Diagnostic to 0 Forces rebuild of corrupted log metadata. WinRM Fix Increase MaxEnvelopeSizekb to 8192 Allows larger data payloads to pass through. Permissions Add server to Event Log Readers Resolves access denied errors for WinRM. WMI Fix Run winmgmt /salvagerepository Repairs the core management data provider.
Is your server part of a Failover Cluster, or is this a standalone instance of Windows Server 2022?
Server Manager problem: Online - Data retrieval failures occurred
The solution for me was as following and is important to follow the order as below: Add the affected node itself (computer object) Microsoft Community Hub
Use diskpart to read the partition info without mounting:
diskpartselect disk Xlist partition – if this hangs, the GPT is corrupt.list disk
select disk X
convert gpt (only if the disk is currently MBR)
gpt repair:
gpt disk id=[disk number] type=fixed
Better approach – use Test-Disk from the Storage module:
Repair-Disk -Number X -Scan
Repair-Disk -Number X -Fix
For more information on troubleshooting online data retrieval failures on Windows Server 2022, check out the following resources: