PRB: WinMgmt Warning Message When You Install and Run Application Center SP2 (820460)


The information in this article applies to:

  • Microsoft Application Center 2000 SP2

SYMPTOMS

When you install Application Center Service Pack 2 (SP2), you may receive the following warning message in the Application event log:Event ID: 63
Source: WinMgmt
Event Type: Warning
Description:

A provider, Provider_Name, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.
Note You may also periodically receive this warning message when you are running Application Center SP2.

CAUSE

Health Monitor registers several Windows Management Instrumentation (WMI) providers to run under the local system account to access the information that the providers supply. Because providers that run under the local system account pose a greater risk if they are compromised, Microsoft Windows 2003 generates warnings when these providers are registered. Warnings are generated for the following providers:
  • PerfProv
  • HealthMonPingProvider
  • PortConnectProvider
  • MicrosoftComPlus_AppStats
  • MicrosoftComPlus_AppName
  • HTTPProvider
  • MicrosoftHM_MethProvider
  • MicrosoftHM_InstProvider

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
Modification Type:MajorLast Reviewed:5/24/2003
Keywords:kbprb kbinfo KB820460 kbAudDeveloper
©2002 Microsoft Corporation. All rights reserved.