Microsoft KB Archive/915148

= Event ID: 5603 occurs when you install Windows Server 2003 Service Pack 1 or Windows XP Service Pack 2 =

Article ID: 915148

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows Server 2003 Service Pack 1
 * Microsoft Windows XP Service Pack 2

-





INTRODUCTION
After you install Microsoft Windows Server 2003 Service Pack 1 or Microsoft Windows XP Service Pack 2, the following Windows Management Warning event may be logged in the Application event log: Event Type: Warning

Event Source: WinMgmt

Event ID: 5603

User: NT AUTHORITY\SYSTEM

Description:

A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.



MORE INFORMATION
This event occurs because the Windows Management infrastructure notifies users that any provider that runs under the Local System account is a potential security risk. Because the Resultant Set of Policy (RSoP) provider runs under the Local System account, this event is expected.

RSoP data is used only for monitoring and diagnostic purposes. No known security implications exist when the RSoP provider runs under the Local System account.

Keywords: kbhowto kbinfo KB915148

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.