Windows Server 2022 , the "Online - Data retrieval failures occurred" error in Server Manager is a common manageability issue often linked to corrupted event log channels or WinRM configuration limits. While frequently considered "cosmetic" because it doesn't always impact core server performance, it prevents Server Manager from refreshing correctly. Microsoft Learn Core Causes Corrupted Event Log Channels : The most frequent culprit is the Microsoft-Windows-Kernel-IoTrace/Diagnostic

channel. Corruption or missing metadata in this channel prevents WinRM from retrieving full status data. WinRM Packet Size Limits

: If the server is part of a cluster (e.g., Failover Cluster or Exchange DAG), the data being sent via WinRM may exceed the default MaxEnvelopeSize Insufficient Permissions

: The account or computer object may lack rights to read specific event logs. Feature Residuals

: In-place upgrades to 2022 sometimes leave orphaned registry entries for removed features that Server Manager still tries to query. Microsoft Community Hub Recommended Resolutions 1. Repair the Kernel-IoTrace Log Channel

This is the most successful fix for standalone and clustered Windows Server 2022 instances. Microsoft Learn Registry Editor Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-IoTrace/Diagnostic Change the DWORD value from Reboot the server

. After rebooting, Windows typically rebuilds the channel metadata and resets this value to automatically. Microsoft Community Hub 2. Increase WinRM MaxEnvelopeSize

Required if your logs are too large for standard remote management packets.

Server Manager problem: Online - Data retrieval failures occurred

The solution for me was as following and is important to follow the order as below: Add the affected node itself (computer object) Microsoft Community Hub

In Windows Server 2022, the "Online – Data retrieval failures occurred" error in Server Manager typically signifies a breakdown in communication between the Server Manager console and its management providers. This is frequently reported in Failover Clusters or after an in-place upgrade. Primary Causes

Corrupted Event Log Channels: A common culprit is the Microsoft-Windows-Kernel-IoTrace/Diagnostic channel, which may be missing metadata or referencing an invalid provider.

WinRM Packet Size Limitations: The management data package (envelope) might exceed the default maximum size allowed by the Windows Remote Management (WinRM) service.

Leftover Registry Entries: Following an upgrade, Server Manager may still try to pull data from features or services (like "Media Foundation") that were removed during the installation process.

Permission Issues: The server node's computer account may lack the necessary permissions to read certain event logs required for the dashboard refresh. Common Fixes and Workarounds

Users and experts from Microsoft Q&A and the Microsoft Community Hub suggest the following solutions:

Increase WinRM Maximum Envelope Size:If you are in a clustered environment (like an Exchange DAG), try increasing the maxEnvelopeSize to allow larger data transfers. Run this command in an Administrative Command Prompt:winrm set winrm/config @MaxEnvelopeSizekb="8192".

Disable/Reset the Problematic Diagnostic Channel:For issues specifically involving Kernel-IoTrace, you can disable the channel in the Registry Editor to force a rebuild on reboot:

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-IoTrace/Diagnostic. Change the Enabled DWORD value from 1 to 0. Reboot the server.

Add Account to Event Log Readers:Ensure the affected node's own computer account is a member of the local Event Log Readers group via Local Users and Groups.

Remove Obsolete Registry Keys:If you recently upgraded, check for orphaned keys under ...\WINEVT\Channels for features no longer present on your system and rename them to -old to stop Server Manager from attempting to query them.

While these errors are often categorized as "cosmetic" and may not impact the server's actual functionality, addressing them ensures your monitoring dashboard remains accurate.

Do you see any specific error codes (like "The system cannot find the file specified") in the Server Manager notification flag?

These failures typically appear as:

• Timeouts when accessing web APIs or cloud storage
• WinHTTP / WinINET errors (e.g., 12002, 12152)
• .NET HttpRequestException or WebException
• SQL Server linked server failures to external sources
• Backup software failing to fetch data from online repositories

Scenario A: iSCSI Target Unreachable (Most Common)

1. Reset the iSCSI initiator without losing configuration:

   Disconnect-IscsiTarget -SessionIdentifier (Get-IscsiSession).Identifier -Confirm:$false
   Start-Sleep -Seconds 5
   Connect-IscsiTarget -NodeAddress (Get-IscsiTarget).NodeAddress -IsPersistent $true
   

2. Increase iSCSI timeouts to tolerate network jitter (Server 2022 default is low):

   Set-IscsiChapSecret -InitiatorSecret "yoursecret"
   Set-IscsiTargetPortal -TargetPortalAddress 192.168.1.100 -InitiatorPortalAddress 192.168.1.50 -LinkDownTime 60
   

3. Disable iSCSI Error Recovery Level 2 (ERL 2 can cause infinite retries):

   Set-IscsiTarget -SessionIdentifier (Get-IscsiSession).Identifier -EnableErrorRecoveryLevel2 $false
   

4. Virtual Disks in Hyper-V or VMware

Pass-through disks or improperly configured virtual SCSI controllers can cause the guest OS to receive incomplete T10 PI (Protection Information) responses, triggering the error.

6. Authentication Failures

WinINET (used by IE, Office, some apps)

Check via Internet Options → Connections → LAN settings.