Re: WMIPROV event

WMI (Windows Management Instrumentation) is a core Windows Management
Technology. It is used manage local and remote systems by accessing or
modifying relevant management data. Various WMI providers exist to achieve
this management.

Windows XP provides greater flexibity for the security context providers can
be made to run under. Providers written for Windows 2000 do not take
advantage of this flexibility and so they run in the most privileged
account. Windows XP writes these warnings when such providers are
registered so that administrators know that a greater risk is posed by these
providers and can encourage the provider maker to update it to run in a
lower privileged account.

"Frankie Deschacht" <anonymous@discussions.microsoft.com> wrote in message
news:1804001c449b3$80132b10$a101280a@phx.gbl...
> In the windows xp event viewer, i recently got a warning
> that said:
> Event Type: Warning
> Event Source: WinMgmt
> Event Category: None
> Event ID: 63
> Date: 03/06/2004
> Time: 14:20:30
> User: SERVER\Frankie Deschacht
> Computer: SERVER
> Description:
> A provider, WMIProv, has been registered in the WMI
> namespace, Root\WMI, to use the LocalSystem account. This
> account is privileged and the provider may cause a
> security violation if it does not correctly impersonate
> user requests.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Although my pc is running alright, I'm just curious as to
> what this means.