IntelMEProv WMI Warning

PzSniper · Nov 30, 2021

Hi,

I'm running Windows 11 (OS Build 22000.348) and i've clean installed it from Windows 10 but i've started to receive this warning in event log

Log Name: Application Source: Microsoft-Windows-WMI Date: 30/11/2021 15:21:47 Event ID: 63 Task Category: None Level: Warning Keywords: User: SYSTEM Computer: Pz-DESKTOP Description: A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Event Xml: http://schemas.microsoft.com/win/2004/08/events/event"> 63 2 3 0 0 0x8000000000000000 6456 Application Pz-DESKTOP http://manifests.microsoft.com/win/2006/windows/WMI"> IntelMEProv root\Intel_ME

My system specs
Core i9 9900k
Asus ROG Strix Z390-F Gaming updated to latest bios 2004
Intel Management Engine Interface 2120.100.0.1085(SW 2134.15.0.2422) For Windows 10/11 64-bit

Can you help me please?

glasskuter · Nov 30, 2021

Look in the event. What is the SOURCE of the warning. The way I read Microsoft's gobbly gook about that warning is some program on your computer is trying to access the web using http rather than https. It could be checking for updates or something like that. One of you gurus verify if my understanding about this is valid.

Zardoc · Nov 30, 2021

Event 63? don't sweat it. It's probably the MEI that added a software provider DAL, ICLS or Intel management WMI in Device manager which is probably new.

You can remove warning from journal:

This is a reg file that will keep warnings with this particular code from showing up.

Just save the file as a .REG and double click and it will activate.
To re enable warning, just change
"Enabled"=dword:00000000
to
"Enabled"=dword:00000001

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger\{1edeee53-0afe-4609-b846-d8c0b2075b1f}]
"Enabled"=dword:00000000
"EnableLevel"=dword:00000000
"Status"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger\{1edeee53-0afe-4609-b846-d8c0b2075b1f}\Filters]
"Enabled"=dword:00000000
"EventIdFilterIn"=dword:00000001
"EventIds"=hex:0b,00,16,00,e5,16,17,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-Application\{1edeee53-0afe-4609-b846-d8c0b2075b1f}]
"Enabled"=dword:00000000
"EnableLevel"=dword:00000000
"LoggerName"="EventLog-Application"
"MatchAnyKeyword"=hex(b):00,00,00,00,00,00,00,80
"MatchAllKeyword"=hex(b):00,00,00,00,00,00,00,00
"EnableProperty"=dword:00000001
"Status"=dword:00000000

iko22 · Dec 1, 2021

PzSniper said:
Hi,

I'm running Windows 11 (OS Build 22000.348) and i've clean installed it from Windows 10 but i've started to receive this warning in event log

Log Name: Application Source: Microsoft-Windows-WMI Date: 30/11/2021 15:21:47 Event ID: 63 Task Category: None Level: Warning Keywords: User: SYSTEM Computer: Pz-DESKTOP Description: A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Event Xml: http://schemas.microsoft.com/win/2004/08/events/event"> 63 2 3 0 0 0x8000000000000000 6456 Application Pz-DESKTOP http://manifests.microsoft.com/win/2006/windows/WMI"> IntelMEProv root\Intel_ME

My system specs
Core i9 9900k
Asus ROG Strix Z390-F Gaming updated to latest bios 2004
Intel Management Engine Interface 2120.100.0.1085(SW 2134.15.0.2422) For Windows 10/11 64-bit

Can you help me please?

I think the Log has issued a warming that is saying the user group "SYSTEM" is running/registered as high privilege/admin user rights in a LocalSystem Account . LocalSystem Account is not generally recognised as being high privilege. You can choose to ignore this warning or try and find the program that is registering as a WMI provider.
EDIT: I see, the provider in question is IntelMEProv. This is representing Intel Manageability Engine (IME) , which in turn is part of an Intel-based motherboard.
So, it looks like you got some software that is querying the IME with elevated privileges. Dunno if that helps you in any way.

Zardoc · Dec 1, 2021

I think that's what I mentioned above

iko22 · Dec 1, 2021

Zardoc said:
I think that's what I mentioned above

Yes, sorry. It wasn't intended as a duplicate post - just hadn't noticed the detail in your screenshot! However, I wanted to draw attention to the fact that warning message might be some program causing the warning - that was the difference. (On hindsight I could have just mentioned that and cut out the duplication.)
Let's hope the O.P. can track the culprit program down.

Kol12 · Dec 6, 2021

I'm getting the same Event 63 multiple times per day. It would be nice to understand exactly what this warning means...

iko22 · Dec 6, 2021

Kol12 said:
I'm getting the same Event 63 multiple times per day. It would be nice to understand exactly what this warning means...

Like we were discussing - this warning may be caused by a piece of software running elevated privileges in a local system account.
You can try find out which software is causing the warning. The clue is that it polls the motherboard for information.

PerpetualCycle · Dec 6, 2021

I get those too. It is the Intel Management Engine WMI Provider. I think you can safely ignore it. if it bugs you enough, uninstall it through the device manager - it is not a necessary software component.

Kol12 · Dec 6, 2021

iko22 said:
Like we were discussing - this warning may be caused by a piece of software running elevated privileges in a local system account.
You can try find out which software is causing the warning. The clue is that it polls the motherboard for information.

Where is the clue that it polls the motherboard?

iko22 · Dec 6, 2021

Kol12 said:
Where is the clue that it polls the motherboard?

Here, extracted from the warning message: "A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace ..." . As @geneo states, it is probably the Intel Management Engine WMI Provider, as that program uses IntelMEProv .

PerpetualCycle · Dec 6, 2021

iko22 said:
Here, extracted from the warning message: "A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace ..." . As @geneo states, it is probably the Intel Management Engine WMI Provider, as that program uses IntelMEProv .

I didnt say probably. It definetly is. i tracked it down once when installing the management engine software.

Zardoc · Dec 6, 2021

geneo said:
I didnt say probably. It definetly is. i tracked it down once when installing the management engine software.

Ditto.

.

iko22 · Dec 6, 2021

geneo said:
I didnt say probably. It definetly is. i tracked it down once when installing the management engine software.

Okee-doke :):
I saw IntelMEProv was a software class (see link in previous post), so maybe accessible from a SDK API somewhere? If that was so, it could be accessed from another s/w

. But who is going to write another program when Intel have already provided one? 99.9% chances are you and @Zardoc have found the correct program at fault here.

PerpetualCycle · Dec 6, 2021

iko22 said:
Okee-doke :):
I saw IntelMEProv was a software class (see link in previous post), so maybe accessible from a SDK API somewhere? If that was so, it could be accessed from another s/w . But who is going to write another program when Intel have already provided one? 99.9% chances are you and @Zardoc have found the correct program at fault here.

Intel Management Engine (IME) is part of the Intel software/firmware that allows for remote IT provisioning and gathering information about the computer at a very low level (through the chipset firmware). I believe the WMI provider provides the ability to get information on the IME through Windows WMI API. That is all.

iko22 · Dec 6, 2021

geneo said:
Intel Management Engine (IME) is part of the Intel software/firmware that allows for remote IT provisioning and gathering information about the computer at a very low level (through the chipset firmware). I believe the WMI provider provides the ability to get information on the IME through Windows WMI API. That is all.

Cool

. I'm with you on that.

I did however have a rummage round, and I discovered that Intel does let the programmer access it's API via C++ and C# developments with their AMT SDK . Fat chance anyone has written such s/w.

Lets hope the O.P. comes back to clarify their situation.