Why do I receive a warning in the event log that a provider has registered in the Windows Management Instrumentation (WMI) namespace?

A. The message you describe reads

A provider, <name>, has been registered in the WMI namespace,
<namespace>, to use the LocalSystem account. This account is privileged
and the provider may cause a security violation if it does not correctly
impersonate user requests.

An example <name> would be OffProv (for Microsoft Office) and an example <namespace> would be Root\MSAPPS. Although this warning sounds serious, it's an informational message letting you know that WMI has received a registration for a new provider that will run with elevated privileges (SYSTEM). If you're satisfied that this component can run safely with these privileges, you can ignore this message. Otherwise, you might want to uninstall the provider component or contact the provider's manufacturer.

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.