A provider, InvProv, has been registered in the Windows Management Ins

[maninblk]

I am worried about a security violation.

A provider, InvProv, has been registered in the Windows Management Instrumentation namespace Root\cimv2 to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

This message is in my event viewer today. Never seen it before.

I can't find any information in InvProv anywhere online.

Does anybody know what and who the provider InvProv is?
Any information is appreciated.
Thanks.

 

[EmotionalHobo]

Did this show up for you right after a restart for a windows update on March 24/25th? If so the same thing just happened to me, I can't find any information online either.

 

[maninblk]

Yes. EmotionalHobo. Exactly. But I talked to Microsoft Technical Support at https://support.microsoft.com/en-us/contactus?pid=14019&TID=&STID=
and they were totally clueless.

My simple question is who and what is InvProv?

 

[EmotionalHobo]

I want to say that is just related to the windows update, I'd like a third person to confirm that, but it's hard to find any reliable information. Because the message makes me scared of a major security vulnerability. Anyways, I've created two threads about it elsewhere and I'll link those now, hopefully one of them will get some kind of response: After the most recent windows update, InvProv error in event log. - Security | DSLReports Forums. and [WIN7] After the most recent windows update, InvProv error in event log. - Microsoft | DSLReports Forums.

EDIT: I'm actually not at all surprised that Tech Support knows nothing about this, this could be a very minor issue effecting very few people without any actual negative effect if it's actually a microsoft verified provider, so they would only know about it if information had been passed along.

 

[monkE60]

same problem 3/25/2015

I got the same msg in event viewer this morning. I had just installed today's updates and restarted the comp and got "no signal" to monitor. I was wondering if the update somehow messed with the graphics - I have been using software rendering instead of gpu as the gpu has been acting up in this ancient machine. is it just me or is ms churning out some bad product updatewise lately? anybody have any info on "InvProv"?

 

[monkE60]

maybe an answer - of sorts

from what I've been able to gather ,"InvProv" is a new provider to the WMI. Microsoft periodically adds new providers to the wmi. I'm no bigtime computer savvy person so I don't quite understand a lot of it but here is a link with some info that may be helpful. Windows Management Instrumentation - Wikipedia, the free encyclopedia. the upshot is that I think "InvProv" is kosher.

 

[maninblk]

In response to monk epope:

monk, how did you arrive at the conclusion that InvProv is a new provider to WMI that was added by Microsoft? I can't find anything to indicate that Microsoft added, approved, or is even aware of it.
Please list the source of your information.
Thanks.

 

[monkE60]

deduction on my part

the initial msg in event viewer described "InvProv" as being registered to the wmi. ms adds new providers as time goes on - there are over a hundred now - according to the Wikipedia article I referenced. I'm assuming, (I know that's dangerous) the potential for a security threat as stated in event viewer was until the new provider was vetted by the system. my conclusion was based on my own observations and what I was able to glean from the wiki article. that ms doesn't know anything about it is not damning in itself as they are notorious for not having any info to provide. however, this is simply my attempt to provide some kind of insight and I make no warranties either express or implied.

 

[Jacee]

This update helps Microsoft make improvements to the current operating system in order to ease the upgrade experience to the latest version of Windows.

https://support.microsoft.com/en-us/kb/2952664

 

[EmotionalHobo]

I hope this doesn't basically Opt us into getting the free windows 10 upgrade.

 

[maninblk]

logical assumption re: MS Patch

Based on all your responses, I must agree that InvProv is related to the latest MS patch. Hopefully MS will confirm that they added this provider, so as to alleviate my and our concerns about the security risk.
Thanks for the responses everybody.
I now know I was not the only one with the identical event log message after the MS patch.

 

[bearpie514]

I got the same message after updating last night as well