Microsoft Windows Server 2003 – Event ID: 5603 Event Source: WinMgmt occurs when Microsoft Health Monitor is used.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

open WMI (Windows Management Infrastructure): Start > run > wmimgmt.msc
Windows Management Infrastructure (WMI) > WMI Control (local) > Properties
Properties > Security (tab) > Root (tree) > CIMV2 > MicrosoftHealthMonitor > PerfMon > Security (button)
Security for ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon > Security > Add (button) > Advanced > Find now > Performance Log Users (select) > OK
Performance Log Users (select) > Execute Methods (tick) > Enable Account (tick) > Remote Enable (tick)