stevejum

More data, my event log has about 50 or more WMI events ... all right in a row ... half of which are hard errors (event ID 24 in red) and half of which are warnings (event ID 63 in yellow).

The first entry (informational), Event ID 5617 says:

- "Windows Management Instrumentation Service subsystems initialized successfully"

And then is followed by around 50 WMI errors and warnings as noted below.

The 25 or so Event ID 24's are all similar, e.g.:

- "Event provider $Core attempted to register query "select * from __InstanceOperationEvent" whose target class "__InstanceOperationEvent" in //./root namespace does not exist. The query will be ignored."

- "Event provider $Core attempted to register query "select * from __SystemEvent" whose target class "__SystemEvent" in //./root/SECURITY namespace does not exist. The query will be ignored."

- "Event provider $Core attempted to register query "select * from __TimerEvent" whose target class "__TimerEvent" in //./root/SECURITY namespace does not exist. The query will be ignored."

Those errors are followed by about 25 Event ID 63's, which are all similar, e.g.:

- "A provider, ActiveScriptEventConsumer, has been registered in the Windows Management Instrumentation namespace root\default to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests."

- "A provider, CommandLineEventConsumer, has been registered in the Windows Management Instrumentation namespace root\default to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests."

SOooooo ... does anyone know who this mysterious event provider "$Core" is .... ?