Online - Data Retrieval Failures Occurred Windows Server 2022 May 2026

In Windows Server 2022, the error "Online - Data retrieval failures occurred" in Server Manager typically signals a communication or configuration break between the management console and target nodes. This error often surfaces in Failover Clusters or complex environments like Exchange DAGs, preventing administrators from viewing real-time health and status data. Common Causes

WinRM Envelope Size Limits: The default WinRM packet size (MaxEnvelopeSize) may be too small to transmit the large volume of metadata required for complex cluster configurations.

Corrupted Event Log Channels: Specifically, the Microsoft-Windows-Kernel-IoTrace/Diagnostic channel is known to trigger this failure if its metadata becomes corrupted or missing.

Insufficient Permissions: The account running Server Manager may lack rights to access specific event logs on remote nodes.

WMI Repository Issues: Corruption in the WMI repository can halt the data flow required by Server Manager. Troubleshooting and Resolution Steps 1. Increase WinRM MaxEnvelopeSize

If your server is part of a large cluster, increasing the allowed packet size for the WS-Management service often resolves the issue instantly.

In Windows Server 2022, the "Online - Data retrieval failures occurred" error in Server Manager is typically caused by corrupted event log channels or WinRM size limitations. This often presents as a "manageability error" and may appear after system updates or migrations. Common Fixes for Data Retrieval Failures

Reset Corrupted Event Log Channels: A frequent culprit is the Kernel-IoTrace/Diagnostic channel. In Windows Server 2022, the error "Online -

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-IoTrace/Diagnostic in the Registry Editor. Change the Enabled value from 1 to 0.

Reboot the server. Windows should automatically reset the value to 1 and rebuild the clean metadata.

Increase WinRM MaxEnvelopeSize: If the data being retrieved is too large, you must increase the allowable packet size on the target server.

PowerShell Command: Run as Administrator:Set-WSManInstance -ResourceURI winrm/config -ValueSet @MaxEnvelopeSizekb = "8192"

Manual Registry Fix: Create or modify the DWORD maxEnvelopeSize at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Client and set it to 8192.

Update Permissions: Ensure the server can properly read its own event logs by adding the computer object to the local Event Log Readers group. Open Computer Management > Local Users and Groups > Groups.

Add the server's own computer account (and the Cluster Object if using Failover Clustering) to the group. Run as Local System to test service account

Rebuild WMI Repositories: If the issue persists, use the Microsoft Support Community Guide to run the mofcomp command for auto-recovery.

For detailed technical walkthroughs, refer to official Microsoft Q&A threads or specialized hardware guides like the Dell Support Knowledge Base.

10. Final Step: Reproduce & Log

Create a minimal reproduction script:

$url = "https://your-online-data-source.com/api/data"
try 
    $response = Invoke-WebRequest -Uri $url -Method Get -UseBasicParsing -ErrorVariable err
    Write-Host "Success: $($response.StatusCode)"
 catch 
    Write-Host "Failure: $($_.Exception.Message)"
    Write-Host "Details: $($_.Exception.Response)"

Run as Local System to test service account access:

psexec -i -s powershell.exe

What Does "Online - Data Retrieval Failures" Mean?

In Windows Server 2022, this status typically appears for:

Physical disks in a storage pool
Virtual disks in Storage Spaces
Cluster shared volumes (CSVs)
Pass-through disks in Hyper-V or Failover Clustering

The system marks the disk as Online (meaning it can be addressed by the storage stack) but flags data retrieval failures because one or more critical read operations—such as fetching disk layout, partition table, or storage pool metadata—have timed out or returned corrupted data.

Scenario A: iSCSI Target Unreachable (Most Common)

Reset the iSCSI initiator without losing configuration: this status typically appears for:

Disconnect-IscsiTarget -SessionIdentifier (Get-IscsiSession).Identifier -Confirm:$false
Start-Sleep -Seconds 5
Connect-IscsiTarget -NodeAddress (Get-IscsiTarget).NodeAddress -IsPersistent $true

Increase iSCSI timeouts to tolerate network jitter (Server 2022 default is low):

Set-IscsiChapSecret -InitiatorSecret "yoursecret"
Set-IscsiTargetPortal -TargetPortalAddress 192.168.1.100 -InitiatorPortalAddress 192.168.1.50 -LinkDownTime 60

Disable iSCSI Error Recovery Level 2 (ERL 2 can cause infinite retries):

Set-IscsiTarget -SessionIdentifier (Get-IscsiSession).Identifier -EnableErrorRecoveryLevel2 $false

Check for expired intermediate certs

View in certlm.msc → Intermediate Certification Authorities.

8. Diagnose with Tools

| Tool | Purpose | |------|---------| | curl (built-in) | curl -v https://target.com shows TLS & HTTP details | | Test-NetConnection -DiagnoseRouting | Advanced network path check | | Wireshark | Capture TLS handshake & TCP retransmits | | Fiddler Everywhere | Inspect HTTP requests/responses | | Process Monitor | See which file/reg keys the app accesses before failure |

Scenario D: Partition Table Repair (Non-Destructive)

Use diskpart to read the partition info without mounting:

Open diskpart
select disk X
list partition – if this hangs, the GPT is corrupt.

Repair GPT:

list disk
select disk X
convert gpt   (only if the disk is currently MBR)

Or use gpt repair:

gpt disk id=[disk number] type=fixed

Better approach – use Test-Disk from the Storage module:

Repair-Disk -Number X -Scan
Repair-Disk -Number X -Fix