Windows 10: I keep getting Event ID 63 - WMI - Provider: IntelMEProv

Yesterday my pc updated a driver called: Intel - SoftwareComponent - 2130.1.15.0 .When I restarted my PC today I got this warning:Source: WMIEvent ID: 63A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user r

:)

 

IntelMEProv WMI Warning

Hi,

I'm running Windows 11 (OS Build 22000.348) and i've clean installed it from Windows 10 but i've started to receive this warning in event log

Log Name: Application Source: Microsoft-Windows-WMI Date: 30/11/2021 15:21:47 Event ID: 63 Task Category: None Level: Warning Keywords: User: SYSTEM Computer: Pz-DESKTOP Description: A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Event Xml: http://schemas.microsoft.com/win/2004/08/events/event"> 63 2 3 0 0 0x8000000000000000 6456 Application Pz-DESKTOP http://manifests.microsoft.com/win/2006/windows/WMI"> IntelMEProv root\Intel_ME

My system specs
Core i9 9900k

Asus ROG Strix Z390-F Gaming updated to latest bios 2004

Intel Management Engine Interface 2120.100.0.1085(SW 2134.15.0.2422) For Windows 10/11 64-bit

Can you help me please?

 

IntelMEProv WMI Warning

Hello Pz Sniper,

Thank you for responding.

As per article below, it stated that "this warning is by design". These warning messages are expected during the installation of Configuration Manager client and can be safely ignored. The reasoning behind the warning is that we are letting the users know that any WMI provider (IntelMEProv) that runs under the LocalSystem context is not optimal. Therefore, it just provide the warning anytime the WMI service starts up.

If the warning messages continue to be logged after the installation of Configuration Manager client is complete, it may be because the Configuration Manager Client Retry Task in Scheduled Tasks was not removed after the successful install. If you continue to experience these warning messages after the Configuration Manager client is successfully installed, deleting or disabling this task in Scheduled Task will stops the numerous WMI warning messages from being generated.

Please see articles below for more information:

WMI Warnings

Windows Management Instrumentation - Win32 apps | Microsoft Docs

The first link shows a different provider not 'IntelMEProv' but the warning message is exactly the same.

I hope I was able to help you today.

Thank you for choosing Microsoft. Have a great day and stay safe!

Best regards,



Microsoft Community Advocate

 

Powershell and WMI Event IDs

Is there a list of possible event IDs for Powershell and WMI similar to http://www.eventid.net/ or https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx?