Event 63 Warning

[Edna]

WXP Pro SP3, Office 2007, One User, DSL ISP Provider, P4 CPU 3.6, 2.00 GB Ram
Desktop Wireless Network to a Laptop.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 63
Date: 11-Dec-08
Time: 6:27:38 AM
User: NT AUTHORITY\SYSTEM
Computer: SHARK
Description:
A provider, OffProv12, has been registered in the WMI namespace,
Root\MSAPPS12, to use the LocalSystem account. This account is privileged
and the provider may cause a security violation if it does not correctly
impersonate user requests.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

From what little I've found refers to a Server. I'm not on a Server but I
recall installing a large program in error, QML Server, something like
that, from MS Update site but it's long ago been uninstalled. Maybe there's
a missed entry.
I posted this morning to Office but no suggestions recvd. This board
usually has someone that can help.

 

[Peter Foldes]

http://support.microsoft.com/kb/891642

 

[Edna]

Peter, I need Help!! I'm the only one on this computer and I don't use a
Password. I just boot up and into Windows.
I read this carefully but it might as well been in a foreign language as,
considering my Computer knowledge, I understood nothing!

Is this the section that I should study and try to undestand what it's
telling me to do?

Managing WMI security
Updated: January 21, 2005

Managing WMI security
Windows Management Instrumentation (WMI) supports a limited form of security
that validates each user before the user is allowed to connect to WMI, on
either the local computer or a remote computer. This security is layered on
top of the operating system security. WMI does not override or circumvent
security provided by the operating system.

By default, all members of the Administrators group have full control of the
WMI services on the managed computer. All others have read/write/execute
permissions on their local computer only.

Permissions can be changed by adding a user to the Administrators group on
the managed computer or by authorizing users or groups in WMI and setting
their permission level. Access is based on WMI namespaces.

On computers running Microsoft Windows 95, Windows 98, or Windows Millennium
Edition (ME), all users have full control locally. However, permissions can
be set for users managing a Windows 95, Windows 98, or Windows ME computer
remotely.

Security is checked only when a user connects to the Windows Management
service. Thus, any changes made to a user's permissions while the user is
connected do not take effect until the next time the user starts a WMI
service. For example, if a user's access is revoked, the changes do not take
effect until the user exits from WMI and attempts to connect to the service
again.

For more information, see Modify permissions or delete authorized users.

Peter, I'm not retarded but ... Unless you or someone can give me specific
instructions to even locate WMI Service, I think should leave things as they
are as it's over my head.

 

[Edna]

I found Computer Mgmt\Services and Apps\WMI Control, Right Click,
Properties\Advanced Reading:
"Specify Advanced Settings in W Mgmt on a W2000 or W NT Computer."
Peter, No mention of WXP Pro.

"Default Namespace for Scripting: root\cimv2" ... I clicked "Change".

I clicked Root and under Root I see MSAPP12.
I clicked on it's Plus but it didn't expand.
I highlighted MSAPP12 but didn't click on the OK button. Instead i returned
here.
I didn't know what to expect or do, so didn't want to mess anything up.
I should have looked but I was already shaking with fear. LOL.

Would u tell me what to expect or even tell me if I'm in the right spot. If
so, instruct me from here? Thx for the URL. I did do some Searches prior
to Posting but didn't understand what I was reading. That's a big problem
encountered by Novices. We have to have everything spelled out step by
step. At least i do.

 

[Edna]

Eddiie, your comment is well founded and appreciated, but now that I'm this
far - presently have WMI Control Properties\Security Tab open, (Advanced Tab
to me didn't seem to apply) would it not be understandable to want to fix the
Event Warning?

If I highlight MSAPPS12 and click on the Security button, what may I expect
to see as to choices. Note this button doesn't read: Security ... just
plain Secuirity period. To me that means there's no further Window with
choices, to appear.

If MS wrote this "by design" why does it appear as an Event 63 Warning.
I concur to leave it as is but i know each time I see the Warning pop up I'm
going to wish I had "Fixed" it. LOL and Yes i DO have something more
important to do but I've been looking at this since time began and I'd like
to quit seeing it.

 

[nass]

WXP Pro SP3, Office 2007, One User, DSL ISP Provider, P4 CPU 3.6, 2.00 GB Ram
Desktop Wireless Network to a Laptop.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 63
Date: 11-Dec-08
Time: 6:27:38 AM
User: NT AUTHORITY\SYSTEM
Computer: SHARK
Description:
A provider, OffProv12, has been registered in the WMI namespace,
Root\MSAPPS12, to use the LocalSystem account. This account is privileged
and the provider may cause a security violation if it does not correctly
impersonate user requests.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

From what little I've found refers to a Server. I'm not on a Server but I
recall installing a large program in error, QML Server, something like
that, from MS Update site but it's long ago been uninstalled. Maybe there's
a missed entry.
I posted this morning to Office but no suggestions recvd. This board
usually has someone that can help.

This happen if a security updates been applied and the WMI is up and running
to alert you or create a log about other services running and their
activities.

Event ID 63 — WMI Provider Hosting
http://technet.microsoft.com/en-us/library/cc775090.aspx

It will be helpful if you created another account and test by using it and
see if the error/warrning will be logged in the evnt log.
How to Identify a Damaged User Profile and Create a New Profile
http://support.microsoft.com/kb/811151

But for now you can ignore this warnning as long as the service legit and
you what it is!
BTW about the server, most application to get uupdate or update its database
it has a virtual server prog that will connect through it to do its thingy <G>

HTH,
nass

 

[Peter Foldes]

Actually I have read the KB before and it was in my file for errors in Office since
this is not the first time this issue has been brought up in the Office newsgroups.

 

[Peter Foldes]

Edna

This issue showing up in your Event Viewer as a Warning usually and in your case not
a problem. All this is because you have one user or account in a higher privileged
mode.
This will not cause issues and should be just ignored

 

[Edna]

Peter I'm confident from reading your responses on this Board that you would
never have recommended a KB solution had u not checked it out.
You said: All this is because you have one user or account in a higher
privileged
mode.
Wish I knew how I did this when installing Office 2007 so I never repeat the
setting but I suspect Office makes this decision vs the User. Event ID 63
Warning is on Ignore. Thx for your contribution. ... Edna

 

[Edna]

This happen if a security updates been applied and the WMI is up and running
to alert you or create a log about other services running and their
activities.

Event ID 63 — WMI Provider Hosting
http://technet.microsoft.com/en-us/library/cc775090.aspx

It will be helpful if you created another account and test by using it and
see if the error/warrning will be logged in the evnt log.
How to Identify a Damaged User Profile and Create a New Profile
http://support.microsoft.com/kb/811151

But for now you can ignore this warnning as long as the service legit and
you what it is!
BTW about the server, most application to get uupdate or update its database
it has a virtual server prog that will connect through it to do its thingy <G>

HTH,
nass

Nass, You said: This happen if a security updates been applied and the WMI
is up and running
to alert you or create a log about other services running and their
activities.

I haven't applied any Updates to Office 2007 but I have a dozen or more
Event 63 Warnings since 25Nov08. The only program in Office I've even OPENED
is Word and I find the Toolbar excessive for my use having a Small Business.
So much so, I wish I'd stayed with Office 2003.

You said: "It will be helpful if you created another account and test by
using"
LOL Oh! You're soo FUNNY!!!

Thx Fellows! It's unfortunate my query took a lot of your time only to
conclude to do nothing although I'm now confident it's not a serious problem
that should be attended to. ... Edna