locked
SCCM 2012 client installation RRS feed

  • Question

  • Hi everyone after I've installed client on my Exchange Cas server, I find a lot of warning ID 63 Source WMI:

    Log Name:      Application Source:        

    Microsoft-Windows-WMI Date:          22/04/2013 14:32:47

    Event ID:      63

    Task Category: None Level:         Warning

    Keywords:      Classic

    User:          SYSTEM

    Computer:      CAS.dominio.it

    Description: A provider, PolicyAgentInstanceProvider, has been registered in the Windows Management Instrumentation namespace root\CCM\Policy\****************** to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

    Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">   <System>     <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />     <EventID Qualifiers="32768">63</EventID>     <Version>0</Version>     <Level>3</Level>     <Task>0</Task>     <Opcode>0</Opcode>     <Keywords>0x80000000000000</Keywords>     <TimeCreated SystemTime="2013-04-22T12:32:47.000000000Z" />     <EventRecordID>423758</EventRecordID>     <Correlation />     <Execution ProcessID="0" ThreadID="0" />     <Channel>Application</Channel>     <Computer>CAS.dominio.it</Computer>     <Security UserID="********" />   </System>   <EventData>     <Data>PolicyAgentInstanceProvider</Data>     <Data>root\CCM\Policy\*************</Data>   </EventData> </Event>

    I have found the following KB:

    http://support.microsoft.com/kb/2688239/en-us

    It tells me that:

    This problem occurs because Configuration Manager is not included in the Windows Management Instrumentation (WMI) exclusion list of providers that can run under the local system account at the time of installation.

    But where can I find this exclusion?

    Thanks for all.

    Monday, April 22, 2013 1:03 PM

All replies

  • Hi,

    According to the KB article, these messages are expected during setup and can be ignored:

    These messages are expected during the installation of Configuration Manager Client and can be safely ignored. PolicyAgentInstanceProvider is registered as safe with WMI during Setup, so the warning messages should stop being logged as soon as the Setup program is finished.

    Are you still seeing these messages after installation?

    Monday, April 22, 2013 1:11 PM
  • Description: A provider, PolicyAgentInstanceProvider, has been registered in the Windows Management Instrumentation namespace root\CCM\Policy\****************** to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.


    Just ignore that warning message (it's not an error). It just tells you what happened (see the quote) during the installation.

    Torsten Meringer | http://www.mssccmfaq.de

    Monday, April 22, 2013 1:11 PM
  • Do you need to find the exclusion?  As the KB article suggests, the exclusion is created during setup so these messages only appear as setup is run and can be ignored.

    "These messages are expected during the installation of Configuration Manager Client and can be safely ignored. PolicyAgentInstanceProvider is registered as safe with WMI during Setup, so the warning messages should stop being logged as soon as the Setup program is finished."

    Are the warnings still appearing even after the client has successfully installed?

    Monday, April 22, 2013 1:13 PM
  • I' m finding the warnings on all Windows 2008 server after installation of the SCCM client version 5.00.7804.1000.
    Monday, April 22, 2013 1:59 PM
  • Only once (which I would expect) or multiple times?

    Torsten Meringer | http://www.mssccmfaq.de

    Monday, April 22, 2013 2:12 PM
  • It appears often, to install or distribute the client I'm using a custom user with domain admins permission.
    Monday, April 22, 2013 6:34 PM