Windows media installation warnings

Question

Just installed update kb5086672 (26200.8117), and event viewer warnings appeared.

They refer to: provider HiPerfCooker

                       SystemConfigurationChangeEvents

                       VolumeChangeEvents

                        MS_Power_Management_Event_Provider

All with ID 63, and warning of security possibilities.

As these came from Windows update, should I be concerned?

Answer 1

Hi Kenneth,

Thanks for posting your question here. No need to worry.

Event ID 63 simply means that certain built‑in Windows WMI providers are registered to run under a privileged system account (LocalSystem). It does not indicate an actual security issue, exploit, or compromise. Microsoft has confirmed this behavior is by design for core Windows components and does not require any action as long as the system is working normally and the update installed successfully.

You can refer to this link: Event ID 63 occurs when you run the Microsoft System Information program from Office 2007 or from Office 2003

Let me know if you have questions, I'm here to help

Thanks,

Jobelle C.

Answer 2

Event ID 63 warnings like the ones shown (for providers such as HiPerfCooker, SystemConfigurationChangeEvents, VolumeChangeEvents, MS_Power_Management_Event_Provider) indicate that a WMI provider is registered to run under a privileged account (typically LocalSystem) and that, if it did not correctly impersonate user requests, it could theoretically cause a security violation.

This type of warning is expected behavior when certain providers are registered or started and does not by itself indicate a malfunction or compromise. A similar behavior is documented for Office’s OffProv11 WMI provider, where Event ID 63 is logged as a warning about LocalSystem usage, and that behavior is explicitly described as “by design.”

Because these providers are installed and configured by Windows and its updates, and there is no indication in the log that an update failed or that Secure Boot or other security components are blocked from updating, these warnings alone are not a cause for concern and do not require action.

If the system is otherwise functioning normally and Windows Update completes successfully, these Event ID 63 entries can be safely ignored.

---

References:

• Event ID 63 occurs when you run the Microsoft System Information program from Office 2007 or from Office 2003
• Secure Boot DB and DBX variable update events