Windows users have complained about seeing warnings in the application log in the Event Viewer: “A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests “
This raises concerns about what IntelMEProv is and whether it’s safe. This article talks about what IntelMEProv is and what the warning could mean by breaking down components of the error message.
What is Intel ME?
Intel ME or IME, short for Intel Management Engine, is what Intel describes as an embedded microcontroller present on Intel chipsets produced post-2008. It runs its own code and has access to the PCs hardware components like memory, display and CPU. As per Intel, it runs various processes while your system is in sleep mode, during the start process and when it is running.
Its purpose is to “enhance performance and capability from your PC”. One of its key features is its independent power states from the host. With this feature, the IME can run even when the microprocessor and other system components are in sleep mode. This significantly reduces power consumption since the IME can respond to out-of-band (OOB) commands from the IT management system even while the rest of the system is turned off. IT administrators primarily use OOB commands to manage PCs and devices registered to the organisation remotely.
In 2017, external security researchers informed Intel about security vulnerabilities in their IME firmware. Intel’s advisory on the issue urges users to download the Intel CSME Version Detection Tool available for Windows and Linux to determine whether their system is vulnerable.
The advisory states that a system might be deemed vulnerable if the drivers, Intel® Management Engine Interface (Intel® MEI) driver or Intel® Trusted Execution Engine Interface (Intel® TXEI) driver are not installed.
Users must contact their system or motherboard manufacturer to update the necessary software and firmware and install the missing drivers.
What is Intel MEProv?
Intel MEProv is a Windows Management Instrumentation Provider (WMI Provider) used by IT admins to perform discovery and configurations on operating systems and PCs in their enterprise network environment using the Windows Management Instrumentation (WMI) infrastructure.
What is WMI?
Windows Management Instrumentation (WMI) is the platform developed by Microsoft and integrated into the Windows OS to obtain management data and activities on Windows-based operating systems.
Administrators use it to manage applications and devices in a Windows-based enterprise network. IT administrators and developers can use the platform infrastructure to write WMI scripts and applications to automate administrative tasks, even on remote machines.
WMI comprises components such as WMI providers, managed objects, WMI infrastructure and WMI repository. A WMI provider sends data collected from managed objects such as hard disk drives, operating systems, processes or services to the WMI and delivers messages from the WMI to the managed object.
What is Namespace?
In programming languages, namespaces are used to identify classes, types, functions or variables to differentiate similarly named objects belonging to different groups or libraries.
The WMI repository is organised using WMI namespaces. The WMI service creates a few default namespaces, while providers create the others. Microsoft mentions that the WMI security is based on namespace security. This means the WMI infrastructure has a list of users who can access a specific namespace.
What is a LocalSystem account?
WMI is located in a shared service host along with other services. LocalSystem is a system account with extensive local computer privileges and access to most system objects.
Is IntelMeprov safe?
Multiple users have brought up the IntelMeprov issue on the Microsoft Community forum and Reddit, among other platforms, often stating that the warning is as follows:
“A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged, and the provider may cause a security violation if it does not correctly impersonate user requests “
The event ID associated with said message is Event ID 63.
According to Microsoft support, event ID 63 occurs when running the Microsoft System Information programme from Office 2003 to Office 2007.
It may show when a 2007 Office or 2003 Office Service Pack 1 (SP1) runs on a WInodws XP Service Pack 2 (SP2)-based operating system. Service Packs are updates provided by Microsoft for Windows operating systems. However, the registered provided might show as OffProv11 instead of IntelMEProv in this case.
The other reason for Event ID 63 is when you are logged on to a computer with an account with privileged access such as an Admin account.
