Performance Monitoring Events

I found the warnings listed below in the event logs of our Windows SBS2003
SP1 machine after startup. They were also logged when I attempted to email
myself the performance monitoring report (along with an error dialog that
told me that an error had occured, and that I should check the configuration
settings). I saw some things about unloading/reloading DLLs, reseting
performance counters, reinstalling IIS and updating registry entries, but I
would like a little more information and some reassurance before doing
anything like that.

Thanks,

Rob

Here are the events that are logged (from what I gather, I can ignore the
duplicate 5603 errors, but I'm guessing my problem lies with that last one):

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 10/15/2005
Time: 9:29:39 PM
User: NT AUTHORITY\SYSTEM
Computer: BRADFORDDC01
Description:
A provider, PerfProv, has been registered in the WMI namespace,
ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
HostingModel property. This provider will be run using the LocalSystem
account. This account is privileged and the provider may cause a security
violation if it does not correctly impersonate user requests. Ensure that
provider has been reviewed for security behavior and update the HostingModel
property of the provider registration to an account with the least
privileges possible for the required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 10/15/2005
Time: 9:29:39 PM
User: NT AUTHORITY\SYSTEM
Computer: BRADFORDDC01
Description:
A provider, PerfProv, has been registered in the WMI namespace,
ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
HostingModel property. This provider will be run using the LocalSystem
account. This account is privileged and the provider may cause a security
violation if it does not correctly impersonate user requests. Ensure that
provider has been reviewed for security behavior and update the HostingModel
property of the provider registration to an account with the least
privileges possible for the required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: Perflib
Event Category: None
Event ID: 2003
Date: 10/15/2005
Time: 9:29:43 PM
User: N/A
Computer: BRADFORDDC01
Description:
The configuration information of the performance library
"C:\WINDOWS\system32\inetsrv\w3ctrs.dll" for the "W3SVC" service does not
match the trusted performance library information stored in the registry.
The functions in this library will not be treated as trusted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


.

Relevant Pages

  • Unknown Error Logs--Help Decifering
    ... >account from logging in, etc. and am running the XP ... >Computer: MyComputer ... >Windows cannot unload your classes registry file - it is ... >A provider, OffProv10, has been registered in the WMI ...
    (microsoft.public.windowsxp.security_admin)
  • Re: permission problem?
    ... I got an warning in the Application Event Log. ... service was still using the registry during log off. ... This is often caused by services running as a user account, ... no SQLAGENT.OUT file under that SQL log folder. ...
    (microsoft.public.sqlserver.server)
  • Unknown Error Logs--Help Decifering
    ... Computer: MyComputer ... Windows cannot unload your classes registry file - it is still in use ... A provider, OffProv10, has been registered in the WMI namespace, ... to use the LocalSystem account. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Problems installing any CD/DVD burning software
    ... >> A provider, Rsop Planning Mode Provider, has been registered in the WMI ... >> provider will be run using the LocalSystem account. ... >> privileged and the provider may cause a security violation if it does not ... >> was still using the registry during log off. ...
    (microsoft.public.windowsxp.help_and_support)
  • Exchange "critical" - Cant create Public folder with Distribution list.
    ... Check the database connection ... Warning - ID 1003: TraceFileName parameter not located in registry; ... Warning: ID63: A provider, PerfProv, has been registered in the WMI ... This account is privileged and the provider may cause a security ...
    (microsoft.public.windows.server.sbs)
Loading