JSI Tip 10251. You receive Event ID 5603 after installing Windows Server 2003 SP1 (Service Pack 1) or Windows XP SP2 (Service Pack 2)?

After installing Windows Server 2003 SP1 or Windows XP SP2, your Application event log contains the following warning:

Event Type: Warning
Event Source: WinMgmt
Event ID: 5603
User: NT AUTHORITYSYSTEM
Description: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, rootRSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

This behavior occurs because Windows Management reports any provider that runs under the local System account, because that is normally a security risk.

Even though RSoP (Resultant Set of Policy) runs under the local System account, there are no known security implications. You may safely ignore this warning.