Question WMIRegistrationService question

Arbiter051

Distinguished
Mar 28, 2016
375
4
18,795
Hello. When I updated my pc through windows update a couple of weeks ago, the service WMIRegistrationService seems to be running all the time now. I also see errors in event viewer that happen at every start up, 3 at a time listed as WMI Event 63 with the description:

"A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests "

I am sure this is nothing but, but I it is a little annoying and I was wondering if it was safe to just disable the service in services entirely. I have also done virus scans and nothing has been found and I have determined this happen after windows update on july 12th (I believe it was this tuesday) because before that non of these errors show up event viewer and non of this was going on.

Thank you very much.
 

Colif

Win 11 Master
Moderator
Its part of Intel Management Engine Interface

Do you have an Intel motherboard? which one? might want to check if newer version of program. IMEI talks to CPU, its the chipset software - https://www.intel.com.au/content/www/au/en/support/articles/000008927/software/chipset-software.html

its not needed for windows but it might make PC work better. It shouldn't be running all the time.

What is the KB number of the 12 July patch? Look in update history and see if any drivers updated at same time, as they can come through windows update. Good chance Intel updates through it.

what did you scan for viruses using?
 

Arbiter051

Distinguished
Mar 28, 2016
375
4
18,795
Its part of Intel Management Engine Interface

Do you have an Intel motherboard? which one? might want to check if newer version of program. IMEI talks to CPU, its the chipset software - https://www.intel.com.au/content/www/au/en/support/articles/000008927/software/chipset-software.html

its not needed for windows but it might make PC work better. It shouldn't be running all the time.

What is the KB number of the 12 July patch? Look in update history and see if any drivers updated at same time, as they can come through windows update. Good chance Intel updates through it.

what did you scan for viruses using?
Hitmanpro pro is my go to.

intel does update through windows update which is another reason I figured it was windows update that did it.

I do have an intel motherboard, I can go to the manufactures website and see if they have a new driver version for it but the last time I checked it was from last year I think.
 

Arbiter051

Distinguished
Mar 28, 2016
375
4
18,795
what model motherboard, i can go look for a newer driver as motherboard makers aren't always up to date with them.
Intel may have a newer one.

hitman pro would have been one suggestion. Bitdefender free another.
z390 Aorus pro

I’ll check Intels website a little later when I get home. Hopefully the newer driver fixes this annoyance haha.
 

Arbiter051

Distinguished
Mar 28, 2016
375
4
18,795
There was an intel update from windows update on July 12. that is the day this all started. I think

The file is in system 32 and it’s signed by both Microsoft and intel. Virus total also says it’s nothing. At this point I think it’s just an intel update or Microsoft screwed something up.

I scanned with emsisoft tool kit and it also found nothing.

After doing more research almost everyone says it’s just a warning and is by design that can be safely ignored and it is related to the intel management engine. Not sure what it is warning me about exactly, I see conflicting answers.
 
Last edited:

Colif

Win 11 Master
Moderator
oh yeah, You can mostly ignore events but I only looked as you said it was running more.

most of the events in event viewer happen once and are recorded, but the same action might work every other time. So its just a record of things happening, its not where I go to figure out problems in windows.
 

Arbiter051

Distinguished
Mar 28, 2016
375
4
18,795
oh yeah, You can mostly ignore events but I only looked as you said it was running more.

most of the events in event viewer happen once and are recorded, but the same action might work every other time. So its just a record of things happening, its not where I go to figure out problems in windows.
Oh yea don’t get me wrong I understood the concern. The registration service is constantly running now but it is def legit. I just don’t understand why it’s constantly running. It wasn’t before the windows update.
I can disable it in services but idk what that would do.
 

Arbiter051

Distinguished
Mar 28, 2016
375
4
18,795
its hard to tell if the results I find are for a virus/trojan pretending to be that program or that the results of the post include that file name

I can't find a result similar for that application.
Whenever I look up something like this 90% of the results are this is a Trojan/virus pretending so I never know either.
 

Colif

Win 11 Master
Moderator
try running this and see if it helps
right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter


Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

could be you first person to notice it too, I used to find problems before other people did. Might help to just check in a week or so.
 

Arbiter051

Distinguished
Mar 28, 2016
375
4
18,795
try running this and see if it helps
right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter


Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

could be you first person to notice it too, I used to find problems before other people did. Might help to just check in a week or so.
Ah yea that was the first thing I tried but sfc said nothing was wrong.

may be right and I should just wait it out a bit. Maybe next windows update it will be fixed 🤞