Why do I receive a warning in the event log that a provider has registered in the Windows Management Instrumentation (WMI) namespace?

A. The message you describe reads

A provider, , has been registered in the WMI namespace,, to use the LocalSystem account. This account is privilegedand the provider may cause a security violation if it does not correctlyimpersonate user requests.

An example would be OffProv (for Microsoft Office) and an example would be RootMSAPPS. Although this warning sounds serious, it's an informational message letting you know that WMI has received a registration for a new provider that will run with elevated privileges (SYSTEM). If you're satisfied that this component can run safely with these privileges, you can ignore this message. Otherwise, you might want to uninstall the provider component or contact the provider's manufacturer.