The "Online – Data Retrieval Failures Occurred" error on Windows Server 2022 is rarely a false alarm. It signals a degraded yet still communicative storage device, often requiring physical replacement or metadata scrubbing. By methodically isolating physical from logical causes, checking NVMe driver versions, and leveraging PowerShell repair cmdlets, administrators can restore full I/O capability without rebuilding the entire environment.
Remember: WS2022’s storage stack is more resilient than 2016/2019, but it expects tighter hardware compliance. Always validate your firmware and driver versions against the Windows Server Catalog before deployment. A few minutes of proactive configuration can save hours of chasing "online but broken" nightmares.
Further Reading:
Last updated: Q3 2025 – applies to Windows Server 2022 builds 20348.x and higher.
The error "Online - Data retrieval failures occurred" in Windows Server 2022 Server Manager is a common manageability issue, frequently appearing when servers are part of a Failover Cluster or used in an Exchange Database Availability Group (DAG). This error indicates that Server Manager cannot successfully pull inventory or status data from a managed node, often due to corrupted event log metadata or restrictive WinRM (Windows Remote Management) limits. Core Causes of Data Retrieval Failures
Corrupted Event Log Metadata: The most common culprit is a corrupted metadata provider for specific event log channels, particularly Microsoft-Windows-Kernel-IoTrace/Diagnostic.
WinRM Envelope Size Limits: When a server belongs to a cluster or DAG, the data payload sent via WinRM may exceed the default maxEnvelopeSize, causing the retrieval to fail.
Insufficient Permissions: The account used for management may lack rights to access certain event logs through WinRM.
Missing Event Log Files: Following a system migration (e.g., VMware to Hyper-V), some event log providers may not be properly registered, or their .etl files may be missing. Primary Troubleshooting Solutions 1. Increase WinRM maxEnvelopeSize The "Online – Data Retrieval Failures Occurred" error
If your server is part of a Failover Cluster or Exchange DAG, the default data packet size might be too small to transmit the full inventory.
Registry Method: Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Client and set a new DWORD value named maxEnvelopeSize to 8192 (decimal).
PowerShell Method: Run the following command as an Administrator on both the management server and the target nodes:Set-WSManInstance -ResourceURI winrm/config -ValueSet @MaxEnvelopeSizekb = "8192"
Restart Service: Restart the Windows Remote Management (WinRM) service to apply changes. 2. Disable the Kernel-IoTrace Diagnostic Log
Corrupted metadata in this specific channel is a documented bug in Windows Server 2022 that triggers the "Online - Data retrieval failures" message.
Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-IoTrace/Diagnostic. Change the Enabled DWORD value from 1 to 0.
Reboot the node. In many cases, Windows will automatically re-enable this with clean metadata upon restart, resolving the error. 3. Grant Event Log Reader Permissions
Ensure the server's own computer account has permission to read its logs via remote management. Open Computer Management > Local Users and Groups > Groups. Further Reading:
Add the server's own Computer Account to the Event Log Readers group.
If using Cluster-Aware Updating (CAU), add the CAU computer object to this group as well. 4. Rebuild Event Log Metadata
If specific logs are broken, you can list and attempt to reload all event log metadata via PowerShell:wevtutil.exe el | foreach wevtutil.exe gl $_Identify logs that fail to load and consider deleting the corresponding .evtx files in C:\Windows\System32\winevt\Logs to allow the system to recreate them (ensure you have backups first). Comparison of Fixes Primary Use Case Risk Level Increase WinRM Envelope Clusters, DAGs, and large inventories Disable IoTrace Registry General manageability "Refresh failed" errors Medium (Registry change) Permissions Update Access-denied errors in Server Manager logs SFC / DISM Scan General system file corruption
"Online - Data retrieval failures occurred" error in Windows Server 2022 typically occurs within the Server Manager console when handling remote servers or failover clusters. Microsoft Community Hub
This issue is most frequently tied to corrupted event logs, insufficient event reading permissions, or WinRM data packets exceeding the allowed size. Microsoft Community Hub 🛠️ Step 1: Increase WinRM Max Envelope Size
This is the most common fix for clustered environments (such as Hyper-V or DAGs) where the volume of managed data exceeds default limits. Log on to the target server showing the error. PowerShell as an Administrator. Run the following command to increase the size to 8192 KB: powershell
Set-WSManInstance -ResourceURI winrm/config -ValueSet @{MaxEnvelopeSizekb = Use code with caution. Copied to clipboard Restart the Windows Remote Management service: powershell Restart-Service WinRM Use code with caution. Copied to clipboard Microsoft Q&A Discussion on MaxEnvelopeSize
for deeper community feedback regarding this specific command. Microsoft Learn 🔒 Step 2: Grant Event Log Permissions Last updated: Q3 2025 – applies to Windows
If Server Manager can't pull logs because the server account lack rights, adding permissions often ends the blockage. Microsoft Learn On the managed target server, open Computer Management Navigate to System Tools Local Users and Groups Double-click the Event Log Readers
and add the server's own computer object name (and the cluster object if you use a failover cluster). Refresh the Server Manager pool to see if it clears. 📝 Step 3: Address Corrupted IoTrace Channels
A known bug in Windows Server 2022's diagnostic channel can trigger data retrieval hangs. Microsoft Community Hub Registry Editor ) as an Administrator. Navigate to the following subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-IoTrace/Diagnostic Locate the DWORD value. Change its data from Reboot the server. Review this TechCommunity thread regarding IoTrace issues
to study edge-case behaviors reported by system administrators. Microsoft Community Hub 🧹 Step 4: Recompile WMI Repositories
These failures typically appear as:
Get-NetFirewallRule | Where-Object $_.Direction -eq "Outbound" -and $_.Action -eq "Block"
– Review any outbound block rules.
Get-WURebootStatus # (if using Windows Update)
Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations"