We help IT Professionals succeed at work.

WinMgmt error in Event log

ndidomenico
ndidomenico asked
on
Medium Priority
3,144 Views
Last Modified: 2008-01-09
I started to get this error in my event log about a week ago, and can't come up with anything on how to fix this. Running SBS2003. Not sure if there's any link, but this error started appearing the day after I upgraded the antivirus software on the server from SAV 9.0 to SAV10.0.2, along with SMSMSE 4.6.6.113.

Event Type:      Warning
Event Source:      WinMgmt
Event Category:      None
Event ID:      63
Date:            2006-03-29
Time:            21:23:49
User:            NT AUTHORITY\SYSTEM
Computer:      SBS01
Description:
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, to use the LocalSystem account.  This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Is this something I should worry about and try to fix, or just leave it there ?

Thanks.
Comment
Watch Question

Sr. Server Administrator
Commented:
1. Event ID 63 occurs when you run the Microsoft System Information program
from Office 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;891642 
2. Ionut Marin
As per Microsoft: "Health Monitor registers several Windows Management Instrumentation (WMI) providers to run under the local system account to access the information that the providers supply. Because providers that run under the local system account pose a greater risk if they are compromised, Microsoft Windows 2003 generates warnings when these providers are registered". See M820460 to find out for what providers this event is generated.

Adrian Grigorof
From a newsgroup post: "Typically occuring when a Service Pack is applied, these messages are completely normal. This happens when the Windows Management Instrumentation (WMI) Provider is doing it's business."  

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts

Author

Commented:
Should I just ignore this message ?
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.