I've been having a problem with a server that has the SCCM 2012 R2 agent reinstalled every 4-5 hours. In the event log I'm seeing event id 63 "A Provider has been registered in the Windows Management Instrumentation namespace xxx This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests." about hundred times with a varying message. From my understanding this is normal, during the installation of the SCCM agent, but the agent re-installing itself every 4-5 hours (seeing 400 warning event id 63's a day) is not. The system is a running Windows Server 2012 R2 and the agent is version 5.00.7958.1303 (2012 R2 CU2). I've looked through the log files client.msi, ccmsetup, ccmsetup-ccmeval and haven't found anything yet. I've tried a couple of fixes and nothing resolves the issue. Anything I'm overlooking?
I've tried rebuilding the WMI repository as well, with no success. The errors only appear when the SCCM agent is installed, once removed no WMI errors show up in the event viewer.
client.msi.log
ccmsetup.log
ccmsetup-ccmeval.log
