Event ID: 5603 occurs when you install Windows Server 2003 Service Pack 1, Windows XP Service Pack 2, or Windows XP Service Pack 3

After you install Windows Server 2003 Service Pack 1, Windows XP Service Pack 2, or Windows XP Service Pack 3, the following Windows Management Warning event may be logged in the Application event log:

Event Type: Warning
Event Source: WinMgmt
Event ID: 5603
User: NT AUTHORITY\SYSTEM
Description:
A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

This event occurs because the Windows Management infrastructure notifies users that any provider that runs under the Local System account is a potential security risk. Because the Resultant Set of Policy (RSoP) provider runs under the Local System account, this event is expected.

RSoP data is used only for monitoring and diagnostic purposes. No known security implications exist when the RSoP provider runs under the Local System account.