Microsoft has just updated the following KB Article:
Many warning messages for PolicyAgentInstanceProvider are logged when you install the System Center 2012 Configuration Manager client
Symptoms
When you install Microsoft System Center 2012 Configuration Manager client, you may find that many warning messages for PolicyAgentInstanceProvider are logged in the Application log. Those messages resemble the following:
Log Name: Application
Source: Microsoft-Windows-WMI
Date: datetime
Event ID: 63
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: computer_name
Description:
A provider, PolicyAgentInstanceProvider, has been registered in the Windows Management Instrumentation namespace root\ccm\Policy\S_1_5_21_1979764342_3823638770_2321459288_500 to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
<System>
<Provider Name=”Microsoft-Windows-WMI” Guid=”{1edeee53-0afe-4609-b846-d8c0b2075b1f}” EventSourceName=”WinMgmt” />
<EventID Qualifiers=”32768″>63</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”datetime” />
<EventRecordID>1470</EventRecordID>
<Correlation />
<Execution ProcessID=”0″ ThreadID=”0″ />
<Channel>Application</Channel>
<Computer>computer_name</Computer>
<Security UserID=”UserID” />
</System>
<EventData>
<Data>PolicyAgentInstanceProvider</Data>
<Data>root\ccm\Policy\S_1_5_21_1979764342_3823638770_2321459288_500</Data>
</EventData>
</Event>
Source: Microsoft-Windows-WMI
Date: datetime
Event ID: 63
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: computer_name
Description:
A provider, PolicyAgentInstanceProvider, has been registered in the Windows Management Instrumentation namespace root\ccm\Policy\S_1_5_21_1979764342_3823638770_2321459288_500 to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
<System>
<Provider Name=”Microsoft-Windows-WMI” Guid=”{1edeee53-0afe-4609-b846-d8c0b2075b1f}” EventSourceName=”WinMgmt” />
<EventID Qualifiers=”32768″>63</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”datetime” />
<EventRecordID>1470</EventRecordID>
<Correlation />
<Execution ProcessID=”0″ ThreadID=”0″ />
<Channel>Application</Channel>
<Computer>computer_name</Computer>
<Security UserID=”UserID” />
</System>
<EventData>
<Data>PolicyAgentInstanceProvider</Data>
<Data>root\ccm\Policy\S_1_5_21_1979764342_3823638770_2321459288_500</Data>
</EventData>
</Event>