Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Description:
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.
Resolution:
open WMI (Windows Management Infrastructure): Start > run > wmimgmt.msc
Windows Management Infrastructure (WMI) > WMI Control (local) > Properties
Properties > Security (tab) > Root (tree) > CIMV2 > MicrosoftHealthMonitor > PerfMon > Security (button)
Security for ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon > Security > Add (button) > Advanced > Find now > Performance Log Users (select) > OK
Performance Log Users (select) > Execute Methods (tick) > Enable Account (tick) > Remote Enable (tick)
