Event 5603 on sbs 2003

Tech-Archive recommends: Fix windows errors by optimizing your registry

I get the following message in my event log quite regularly:

"A provider, PerfProv, has been registered in the WMI namespace,
ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
HostingModel property..."

I have found dozens of messages in this group that state that this
message is "by design" and "can be ignored". My questions are:

1) How do I make it STOP LOGGING this, if I'm supposed to ignore it? I
want to quickly scan my logs each day for anything other than
"Information" entries, and don't want to have to keep a mental list of
which "Warnings" aren't really "Warnings" at all.

2) What is PerfMon? Can it be disabled?

3) What is the WMI namespace? Can I make it go away?

Here's a bunch of information that people will probably ask for, rather
than answering my questions:

---------------------------
SBS 2003 Premium, SP1
Dell Poweredge 830, pentium D 3.2Ghz, 2GB Ram
Dell Perc 4e/DC Raid Controller, 2x73GB Fast/Wide SCSI drives (Raid-1)

---------------------------
ipconfig/all:

Windows IP Configuration

Host Name . . . . . . . . . . . . : SERVER
Primary Dns Suffix . . . . . . . : noyfb.local
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : Yes
DNS Suffix Search List. . . . . . : noyfb.local

Ethernet adapter WAN Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast
Ethernet NIC
Physical Address. . . . . . . . . : 00-08-54-2D-99-B8
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.2.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.2.1
DNS Servers . . . . . . . . . . . : 192.168.1.123
NetBIOS over Tcpip. . . . . . . . : Disabled

Ethernet adapter LAN Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit
Ethernet
Physical Address. . . . . . . . . : 00-15-C5-5E-68-2E
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.1.123
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.1.123
192.168.1.100
Primary WINS Server . . . . . . . : 192.168.1.100
Secondary WINS Server . . . . . . : 192.168.1.123

---------------------------
Actual event text:

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 11/2/2006
Time: 1:23:36 PM
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
A provider, PerfProv, has been registered in the WMI namespace,
ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
HostingModel property. This provider will be run using the LocalSystem
account. This account is privileged and the provider may cause a
security violation if it does not correctly impersonate user requests.
Ensure that provider has been reviewed for security behavior and update
the HostingModel property of the provider registration to an account
with the least privileges possible for the required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
---------------------------


Thanks for any information you can provide.
KC

.

Relevant Pages

  • Everytime I install WMI...
    ... permissions of the the service account I am running it from or rename the ... A provider, ExtnProv, has been registered in the WMI namespace, ... correctly impersonate user requests. ...
    (microsoft.public.sms.admin)
  • Event warning
    ... A provider, HiPerfCooker_v1, has been registered in the WMI namespace, ... to use the LocalSystem account. ... impersonate user requests. ...
    (microsoft.public.windowsxp.security_admin)
  • Event 63 Warning
    ... A provider, OffProv12, has been registered in the WMI namespace, ... to use the LocalSystem account. ...
    (microsoft.public.windowsxp.general)
  • Event 63 Provider Registered in RootMSAPPS 12
    ... A provider, OffProv12, has been registered in the WMI namespace, ... to use the LocalSystem account. ...
    (microsoft.public.office.misc)
  • Re: loading tab-delimited files...
    ... error msg: Test connection failed because of an error initializing ... I went through and looked at every provider which might allow ... You should only specify the path. ... The filename is specified in the SQL statement as in the example I posted. ...
    (microsoft.public.dotnet.framework.adonet)